Keragon Integration

Automating Healthcare Workflows with ConsentCollect & Keragon

ConsentCollect natively supports integration with Keragon, a leading healthcare-specialized automation platform. This partnership allows clinical teams, researchers, and sponsors to easily connect their eConsent workspaces with 400+ healthcare tools without writing any code.

Whether syncing signed consent forms with Electronic Health Records (EHRs) like athenahealth, Elation, or DrChrono, or pushing study indicators directly to Electronic Data Capture (EDC) engines like REDCap, Keragon handles the clinical data routing securely. It also supports automating general communications through Slack, Microsoft Teams, email, or SMS notification systems.

How to Connect in Three Steps

Connecting your ConsentCollect workspace to Keragon requires zero custom programming. Follow these setup steps:

Step 1: Generate an API Key

Log in to your ConsentCollect workspace.
Go to Settings in the sidebar navigation and select the API Keys tab.
Click the New API Key button.
Enter a clear label, for example: Keragon Integration.
Select the required permission scopes for your workflow:
- forms:read (required to check consent status and download logs)
- forms:write (required to create and send new consent requests)
- signatories:read/signatories:write (required to manage patient demographic lists)
- templates:read (required to load active template directories)
Click Generate Key.
Copy the raw API key immediately and store it securely. For safety, this key is only displayed once.

Step 2: Add ConsentCollect to Keragon

Log in to your Keragon Workspace (app.keragon.com).
Navigate to Connected Apps on the left menu.
Click Connect App in the top right corner.
Search for ConsentCollect in the search bar and select it.
In the connection window, paste your copied ConsentCollect API Key.
Click Connect. Keragon will verify the key and confirm the connection.

Step 3: Build Your Automation Workflows

Open the Keragon workflow editor. You can now select ConsentCollect triggers (events that start a workflow) and actions (steps that ConsentCollect performs) to connect with your other healthcare tools.

Example Automation Workflows

Here are three common automation recipes utilized by clinical practices and research sponsors:

Automatically dispatch a surgical consent form when a new patient appointment is scheduled in an EHR:

Trigger: athenahealth (New Patient Appointment Scheduled)
Action 1: ConsentCollect (Create Patient Record using patient name, email, and MRN)
Action 2: ConsentCollect (Create Form using the template for Knee Surgical Consent)
Action 3: ConsentCollect (Send Form to Patient)
Result: The patient receives a secure signing link via email or SMS before their visit.

Recipe 2: Post Clinical Alerts to Slack

Keep clinical teams updated on signature progression:

Trigger: ConsentCollect (Consent Form Fully Signed)
Action: Slack (Post Message to a private channel)
Result: The channel receives an automated notification: Surgical Consent - Knee Replacement signed by all required participants.

Recipe 3: Clinical Trial Auto-Enrollment

Connect clinical screening databases with patient-facing consent forms:

Trigger: REDCap (New Subject Screened and Eligible)
Action 1: ConsentCollect (Create Patient Record)
Action 2: ConsentCollect (Create Form from template)
Action 3: ConsentCollect (Send Form to Subject)
Trigger: ConsentCollect (Consent Form Fully Signed)
Action 4: REDCap (Update Record status to “Consented”)
Result: Enrollment statuses are updated in real time without manual coordinator data entry.

Supported Triggers & Payloads

Triggers allow ConsentCollect to start workflows in Keragon. Outbound payloads are delivered via cryptographically signed webhooks.

1. `form.completed` (Consent Form Fully Signed)

Fires when all required signers (the patient, witness, and investigator) have completed their signatures. This trigger provides the final metadata used to write back files to charts:

{
  "id": "evt_018f1a2b3c4d5e6f",
  "type": "form.completed",
  "created": 1722427200000,
  "workspace_id": "kinde_usr_abc123",
  "data": {
    "form_id": "jd7abc123def456",
    "form_title": "Surgical Consent – Knee Replacement",
    "status": "completed",
    "consent_type": "Surgical Consent",
    "specialty": "orthopedics",
    "country": "US",
    "signer_count": 3,
    "signatures_collected": 3,
    "snapshot_hash": "a1b2c3d4e5f6..."
  }
}

2. `form.signed` (Individual Signer Signs)

Fires after each individual signature step. This helps you track participant progress:

{
  "id": "evt_018f1a2b3c4d5e7a",
  "type": "form.signed",
  "created": 1722427180000,
  "workspace_id": "kinde_usr_abc123",
  "data": {
    "form_id": "jd7abc123def456",
    "signer_role": "subject",
    "signatures_collected": 1,
    "signer_count": 3,
    "status": "in_progress"
  }
}

3. `form.withdrawn` (Form Withdrawn / Voids)

Fires when a study coordinator voids or cancels a form, or when a patient revokes consent:

{
  "id": "evt_018f1a2b3c4d5e8b",
  "type": "form.withdrawn",
  "created": 1722427300000,
  "workspace_id": "kinde_usr_abc123",
  "data": {
    "form_id": "jd7abc123def456",
    "status": "withdrawn"
  }
}

Supported Actions

Actions let Keragon perform tasks within your ConsentCollect workspace by calling our HIPAA-compliant API:

Action Name	Required Scope	Description
Create Consent Form	`forms:write`	Generates a new consent form from a library template.
Send Form to Patient	`forms:write`	Adds signers and sends the form, updating status to sent.
Get Form Details	`forms:read`	Fetches active statuses and compliance metadata for any form.
List Forms	`forms:read`	Retrieves forms in your workspace with optional filters.
Create Patient Record	`signatories:write`	Creates or updates patient demographic records.
List Templates	`templates:read`	Browses templates available for form creation.
Get Audit Trail	`forms:read`	Exports the cryptographically chained audit logs.

HIPAA Compliance and Security Features

ConsentCollect maintains a strict data security boundary. Automations run in a fully compliant framework:

PHI-Free Webhooks: Webhook payloads sent to Keragon contain only form metadata. Patient names, emails, dates of birth, and medical record numbers are never sent in plain text. Patient identifiers remain in ConsentCollect behind authentication.
HMAC-SHA256 Request Signing: Webhook payloads are cryptographically signed. You can verify the X-ConsentCollect-Signature header to verify the authenticity of the webhook call.
Scoped Access Control: API keys are restricted to specified scopes. You only grant the permissions that each particular workflow needs.
Keys Hashed at Rest: Raw API keys are displayed once and are not stored in plaintext. The database only retains SHA-256 hashes of the keys to verify requests.
End-to-End Encryption: All data is encrypted at rest using AES-256-GCM. Signing credentials are kept in memory-isolated databases.
Keragon Compliance: Keragon is a HIPAA-compliant platform that signs Business Associate Agreements (BAAs), keeping your automated clinical data pipelines secure.

FAQ

Is the Keragon integration free?

Yes. Connecting ConsentCollect to Keragon is free. Keragon handles pricing for its automation runs separately. You can check the billing plans on their pricing page.

What patient data is shared via webhooks?

Webhooks contain only metadata: form ID, title, status, consent type, specialty, and signature count. If your workflow requires patient details, you must perform an API action using a validated API Key.

How do I verify webhook signatures?

Every webhook includes an X-ConsentCollect-Signature header. Compute the HMAC-SHA256 signature using your signing secret and compare it with the header value. The secret is displayed once when you create the webhook in Settings > Webhooks.

Which ConsentCollect plans support API access?

All plans, including the Free Sandbox tier, support API key creation. You can manage keys under Settings > API Keys in the dashboard.