Offline spa intake e-forms on cruise ships: HIPAA and GDPR in 2026

TL;DR

Offline spa intake e-forms replace the paper health questionnaire a cruise spa hands guests before a treatment, and keep working when the ship loses its shore link. In 2026 the legal design matters as much as the software.

• HIPAA reaches a spa only if it is a covered entity or works for one.
• GDPR follows guests who are in the EU, and health answers are special category data that need explicit consent.
• The HHS proposal to make encryption mandatory, published January 6, 2025, was still not final on October 1, 2026.
• Mercury Development's onboard spa software for OneSpaWorld has run on over 160 ships since 2018 on servers with no external internet connection.

Why cruise spas still collect health data on clipboards

CLIA's 2026 State of the Cruise Industry report, as summarized by TravelPulse, counts a record 37.2 million cruise passengers in 2025. A guest who books a massage or a facial usually answers health questions first.

OneSpaWorld, which runs spas for cruise passengers, spells it out in its privacy policy. The health forms guests complete before a spa service collect health history, count as special category data and are processed on prior explicit consent under EU law.

Paper makes that promise hard to keep. A clipboard cannot prove which questions a guest saw, and an erasure request means searching a box on board by hand.

The HIPAA Security Rule update is still pending in October 2026

On January 6, 2025, the HHS Office for Civil Rights proposed a broad update to the HIPAA Security Rule. It would drop the split between required and addressable safeguards and require encryption of electronic protected health information with limited exceptions. Each regulated entity would also inventory its technology assets and map how that information moves through its systems. Compliance would follow 180 days after the final rule takes effect.

As of October 1, 2026, no final rule had been published, so encryption is still addressable. Build to the proposal anyway: adding encryption to an offline tablet fleet after the rule lands costs more than designing it in.

How we put this guide together

We read the three pages that answer this topic in AI search. FormFleet sells offline-first forms for maritime crews. SpaSoft Digital Intake replaces paper spa forms at resorts and hotels. Accountable asks whether a task tool is HIPAA-compliant for cruise infirmaries. None covers a spa questionnaire filled in at sea under both HIPAA and GDPR.

Law was read from primary text and regulator guidance in October 2026. This is not legal advice, and Mercury Development builds this kind of software, so read it as an interested view.

Paper, online forms and offline e-forms at a glance

Does HIPAA apply to a spa on a cruise ship

Start with the definition. Under 45 CFR 160.103, a covered entity is a health plan, a clearinghouse, or a health care provider who transmits health information electronically in connection with a standard transaction. Paubox names the usual trigger: insurance billing. A med spa whose licensed clinician diagnoses, prescribes or bills insurance likely qualifies. A massage charged to a cabin account usually does not.

Cases that still pull a cruise spa toward HIPAA:

• A medispa service by a licensed clinician, billed to insurance.
• Spa records handled for a covered entity, which makes the operator a business associate.
• A contract. Buyers write HIPAA-level controls into requirements anyway, and Accountable recommends them even where HIPAA is not triggered.

Where HIPAA applies, look ashore. HHS cloud guidance says a cloud provider storing encrypted ePHI is a business associate even without the key. The conduit exception covers transmission only.

Where it does not, health data is still regulated. The FTC says the FTC Act reaches companies collecting health information outside HIPAA. Washington's My Health My Data Act, in force since March 31, 2024 per Stoel Rives, covers Washington residents, requires consent to collect separate from consent to share, and gives consumers a private right of action.

What GDPR asks of a spa health questionnaire

GDPR follows the guest more than the ship. Article 3(2) applies it to a controller outside the EU that offers services to people who are in the Union, and Article 3(1) to any controller with an EU establishment. Whether an EU-flagged ship falls under Article 3(3) is a question for counsel.

Five articles shape the form:

1. Article 9: health data is a special category. For a spa, the workable basis is usually 9(2)(a), explicit consent for a specified purpose.
2. Article 7(1): you must be able to demonstrate consent, so store its wording, version, timestamp and signature with the answers.
3. Article 5(1)(e): keep data in identifiable form no longer than necessary, so set a retention period per form type.
4. Article 32: encryption and pseudonymisation are named security measures.
5. Article 35: large-scale processing of special category data requires an impact assessment before you start.

Where these records may be stored, and how to split US and EU data, is covered in our guide to healthcare data residency.

Offline does not mean unprotected

An offline e-form leaves a guest's answers in several places. Each needs its own control.

• The tablet. Android supports file-based encryption from 7.0 and does not allow full-disk encryption on new devices running Android 10 and higher. Pin the tablet to the form app with lock task mode and clear each form once the ship server confirms receipt.
• The browser, for a web app. Per MDN, best-effort storage can be evicted under storage pressure. Call navigator.storage.persist() so an unsynced signed form survives.
• The ship server. It owns the voyage's forms and appointments, reached over the ship's network, so nothing waits for the satellite.
• The shore link. Queue changes with acknowledgements. RabbitMQ's Shovel plugin reconnects after a failure and acknowledges a message only after the destination confirms it.

The ship server and sync design behind these layers is in our guide to offline-first mobile apps for ships.

Make every signed form evidence

A signed intake form is a record you may have to produce later.

• Version the questions. Store the wording the guest saw next to each answer, so editing the template never changes an old record.
• Append, never overwrite. A therapist's note or a correction is a new version with its own timestamp.
• Separate the consents. OneSpaWorld's policy asks separately for promotional photos.
• Sign on the device. Under 15 U.S.C. 7001, a signature may not be denied legal effect solely because it is electronic.
• Log access: who opened which form, on which tablet, when.

Who sells digital intake for ships and spas

Watch-outs: FormFleet lists an immutable audit trail on its roadmap, not as a current feature. SpaSoft names resorts, hotels and casinos, not ships. Mercury's OneSpaWorld work has no public case page yet.

The spa systems these forms feed are compared in our ranking of the best spa management software for cruise lines.

Which setup fits your spa operation

• A spa on land with steady Wi-Fi: hosted intake such as SpaSoft.
• Crew checklists across a fleet: FormFleet.
• Guest health questionnaires on ships that lose the shore link: an offline e-form with a ship server.
• A medispa that bills insurance: the same, plus a full HIPAA program and a BAA with every vendor storing the forms.

What our cruise spa programs show

From Mercury's project and contract records.

The OneSpaWorld spa platform has run since 2018 on over 160 ships operated by multiple cruise lines. ReactJS web applications run on onboard servers with no external internet connection, and spa staff use them on Android tablets in kiosk mode or on ordinary computers. Guest intake forms are branded and localized into several languages. A shore-side admin changes the set of forms per vessel and updates onboard software.

Its E-Forms platform runs pre-treatment surveys on more than 1,000 devices for over 3,000 staff members. Questions include signature and drawing, and every question and answer keeps a version history. Data and app updates sync in near real time over low or sporadic bandwidth, on TypeScript, React, .NET and RabbitMQ.

Windstar Cruises guests now book spa appointments on a guest-facing site instead of through OneSpaWorld's call center.

Two delivery lessons repeat. A message broker does not split a large signed form or photo for you. Ship latency and onboard hardware cannot be recreated ashore, so budget a test on a real vessel.

Across our closed contracts for cruise software, the median is $250,000 and the range runs from $10,000 to $1,000,000.

Treat the intake form as health data even where HIPAA does not reach

Whether HIPAA binds your spa is a narrow legal question. Whether the answers are health data is settled: GDPR and Washington both say so. Design for the strictest regime your guests bring on board, and one architecture serves every ship.

Change the vendor interview. Ask: "A guest signs offline, then asks for erasure a week later. Show me every copy and how each one is deleted." A team that has built this answers with a data map.

Own the result. Mercury's About page states that the customer owns the code and all underlying IP.

Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The contract and delivery records behind this article's figures on Mercury's cruise programs sit in the operations he oversees.

Replacing paper spa questionnaires on your ships? Start with a data map

Tell us where guests fill in health forms today, which systems read them and which laws your counsel says apply. We will map where each answer lives and which control each copy needs before you commit to a build.