HIPAA and your website: forms and PHI
A contact form is the most common way a practice website quietly starts collecting protected health information. The fix is straightforward once you know where the line is.
A contact form is the most common way a practice website quietly starts collecting protected health information. The line is clearer than most people expect — and once you can see it, the fix is usually straightforward.
The problem with an open message box
You cannot control what patients type. Put a free-text “How can we help?” box on a medical practice site and some proportion of people will describe their symptoms in it — regardless of what the label says. That submission then travels wherever your form sends it.
The risk is rarely the form itself. It is the path afterwards: a third-party form service that stores submissions on its servers, a notification email to a personal Gmail account, a plugin database sitting on shared hosting, or a CRM nobody has a BAA with.
Two workable approaches
Keep PHI off the form entirely
Collect only what is needed to make contact: name, preferred contact method, and a general reason from a fixed dropdown (“new patient”, “billing”, “appointment”). Add a clear line: please do not include medical details — we will contact you to discuss. Simplest and safest for a marketing site.
Treat the whole path as clinical
If you genuinely need clinical detail — intake, symptom triage — then everything it touches must be covered: encrypted in transit and at rest, access-controlled, logged, retained on a defined schedule, and every vendor in the chain under a signed BAA. Usually this belongs in your patient portal or a purpose-built intake product, not a website form.
Where submissions go
| Best | Your patient portal or EHR intake module — already access-controlled, logged and covered. |
|---|---|
| Workable | A handler you control, delivering to a practice mailbox on infrastructure under a BAA, retaining nothing longer than needed. |
| Needs a BAA | Any third-party form or CRM service that stores submissions. Many will sign one; several popular ones will not. Ask before you build on it. |
| Avoid | Submissions forwarded to a personal Gmail, Yahoo or Hotmail account. Consumer accounts are not covered, and this is a common real-world finding. |
The part practices miss: analytics and tracking
This is now the most active enforcement area in healthcare websites, and it catches people who never thought of it as a form problem at all.
- Tracking pixels on clinical pages. An advertising pixel on a page about a specific condition can transmit the visitor’s identifiers together with the fact they viewed that page. Regulators have treated that as a disclosure of PHI, and there have been substantial settlements.
- Session-recording and heatmap tools can capture what a visitor typed into a form — including text they never submitted.
- Chat widgets route conversations through a vendor. Patients tell chatbots things they would never put in a form.
- Anything embedded in your patient portal deserves particular scrutiny, since visitors there are identified patients by definition.
A practical checklist
- HTTPS everywhere, no exceptions.
- Form fields limited to what you actually need — no field “just in case”.
- A clear note asking patients not to send medical detail.
- Submissions delivered to a practice mailbox, never a personal one.
- A signed BAA with every vendor that stores or transmits submissions.
- No advertising or analytics trackers on clinical pages or the portal.
- A defined retention period, and something that actually enforces it.
- A privacy notice that describes what you collect truthfully.
FAQ
Is a plain appointment request form allowed?
Yes, and it is normal. Keep it to contact details and a general reason, send it somewhere covered, and do not invite clinical detail. The request itself implies a patient relationship, so still treat the destination carefully.
We have used a popular form service for years. Is that a problem?
It depends entirely on whether they will sign a BAA and whether your plan includes it — several offer HIPAA-eligible tiers only on higher plans. Being on the free tier of a service that can be compliant does not make you compliant.
Can we email patients about their care?
Patients may request unencrypted email after being warned of the risk, and you may honour that — document the request and the warning. Do not initiate clinical detail over plain email as a default, and never send it to an address you have not verified.
Does using a US-hosted provider make us compliant?
No. Data location is one consideration among many. What matters is the safeguards, the access controls, and the signed BAA — see Business Associate Agreements.