Built to receive a code, not a patient.

What is transmitted

A case, as it travels between your browser and the server on every request, carries:

• Item responses. One value from 0 to 3 per item, or nothing for an unanswered item.
• An assigned code like TB-4KQ7M: five random characters the tool generates, derived from nothing about the person.
• An optional Case ID you type, restricted to letters, digits, dots and dashes, up to 24 characters, with no spaces: a code of your own, never a name.
• The year the case was entered and the year each administration was started and completed. No month, day or time exists anywhere in the record.
• The mechanics of the administration: which form, whether it was taken on screen or transcribed from paper, an internal id per case and per administration, and a number that puts them in order.

The part the software does, and the part you do

This is the distinction the rest of the page rests on, so it is worth being exact about it.

What the software guarantees. There is no name field, no note field, no comment field and no date field. Dates are reduced to the year before they are stored, so no month, day or time can be recorded about anyone. The Case ID is limited to 24 characters from a fixed alphabet, which rules out sentences, addresses and most of what free text invites. Nothing is stored on our side at all, so there is no database here to breach, subpoena or misconfigure.

What is yours to get right. The Case ID is a field you type into, and the alphabet cannot tell a meaningless code from a meaningful one. P-0147 is what it is for; SMITH-J-1985 would fit just as well and would defeat the purpose. Choose a code that means nothing outside your own records, the same way you would choose one for any coded data set. The tool assigns every case a random code of its own, so you never have to type anything at all.

One other field takes free text: the paste box on the paper-entry screen, where you paste back a transcription of a completed sheet. Whatever you paste is parsed for item numbers and values, shown to you for confirmation, and only the 0 to 3 values are ever stored. The pasted text itself is never written to the record or to a backup. It does reach the server in the request and appear on the preview page you are shown, so paste responses, not notes.

What is stored on the server

Nothing. The record lives in your browser, in up to 3 cookies (the first is tb_bench, 400 days from the last change). The server decodes them to render each page, re-issues them when a page changes the record, and holds no copy between requests: no database, no file, no access log, no analytics. A rebuild or a reboot of the server loses nobody anything, because nobody's record was ever on it.

Where the link to a person lives

With you. The map from an assigned code or a Case ID to a person exists only in your own records, under your own safeguards. This site never receives that map and holds nothing it could rebuild one from.

Why no business associate agreement is offered

HIPAA binds covered entities and their business associates. A business associate is one that creates, receives, maintains or transmits protected health information on a covered entity's behalf. Our reading is that Trait Bench does none of those, because a record used as intended is de-identified under the Safe Harbor method (45 CFR 164.514(b)(2)), and a de-identified data set is not protected health information (45 CFR 164.514(a)). Five of the eighteen Safe Harbor identifiers bear on a tool like this:

Identifier	How it is handled
1. Names	No name field exists. The Case ID alphabet excludes spaces and most punctuation, which rules out a written name, though it cannot stop a determined abbreviation. Choosing a meaningless code is yours.
3. Dates finer than a year	Enforced in the software. The record stores and prints the year alone, and there is no field for any other date.
7. Medical record numbers	No field asks for one. A Case ID is free enough to hold one, so do not use your MRN as your Case ID.
15. IP addresses	Transport, not data. The origin server sees one for the duration of a request and writes no log; Cloudflare sees it at the edge (below). It is never joined to a case.
18. Any other unique identifying number, characteristic or code	The assigned code is a re-identification code under 45 CFR 164.514(c): random, and derived from nothing about the person. That provision permits such a code only where it is not derived from or related to information about the individual. The assigned code always meets that; a Case ID meets it only if you choose it so.

On that basis the site holds no information that could re-identify a record (45 CFR 164.514(b)(2)(ii)), because the map is not here. This is our own analysis of how the tool is built, offered so that you can check it. It is not legal advice and it is not a determination about your practice: whether your use of any tool meets HIPAA is a judgement for you and your own counsel or compliance officer, and the facts on this page are what we can give you to make it.

Transport

The public site is served over HTTPS through Cloudflare, which terminates TLS at its edge and forwards requests to the origin over a private tunnel. A request for traitbench.com that arrives over plain HTTP is redirected to HTTPS by the origin itself. Cloudflare sees the visitor's address and keeps edge logs under its own policy; Cloudflare Web Analytics is not enabled for this site, and no analytics script of any kind is served, which a test keeps true. Google Fonts supplies the typeface: two requests per page load, one to fonts.googleapis.com for the stylesheet and one to fonts.gstatic.com for the font file. The pages work without either.

Every response carries these headers. The values below are read from the running code, not retyped:

Header	Value
Cache-Control	no-store on every page; static files carry a content-addressed cache policy of their own
Referrer-Policy	no-referrer
X-Content-Type-Options	nosniff
Strict-Transport-Security	max-age=31536000 on public HTTPS responses
Content-Security-Policy	default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; style-src-elem 'self' https://fonts.googleapis.com; style-src-attr 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'

The policy allows script from this site only and none inline, allows the page to fetch from this site only, forbids framing, and names the only external hosts a page may reach, both Google Fonts. A test holds the templates to exactly that list.

What stays your responsibility

This tool cannot make a practice compliant. Its design keeps identifiers out of the fields it controls; the rest is yours to cover in your own risk analysis:

• The Case ID you choose. The first item on the list, because it is the only one where a keystroke can undo the design.
• The device. The record is a cookie in a browser profile. Full-disk encryption, a screen lock, and knowing who else can use that profile are what protect it.
• Backup files. A backup is plain JSON on your disk and travels wherever you send it. It holds the same record, but it is your file.
• Printed sheets. A blank questionnaire has a Case ID line and a date line for your own use. What a respondent writes on paper stays on paper; only the responses are typed back in.
• The crosswalk. Wherever you keep the map from code to person, that is the record HIPAA applies to.

What this page is not

It is a description of how the site is built, written in September 2026, describing the site as deployed then. It is not legal advice, and it is not a determination that any particular use is compliant.