I just picked up a job for integrating Hushmail's Secure Web Forms into a medical website. The forms will submit patient's (PHI) data to Hushmail's servers, encrypt the data, and then send it to their Hushmail email account. Routing a form is accomplished by simply changing the form action attribute to https://forms.hush.com/webformname.
This seems like it is lacking security to me. For one, the medical site is not using SSL and nowhere in Hushmail's documentation do they mention SSL being necessary on the websites end for a truly secure transmission. Obviously these form submissions need to be HIPAA compliant. It seems to me that any mediocre hacker could capture the packet before it is sent to Hushmail and encrypted.
Is this secure? Would using an iframe of the form be more secure? (it is using SSL) Should I convince them to setup SSL on the site?
I have been trying to read up on HIPAA, but I'm having problems finding anything technical for developers. Any references would be welcomed.