Is your practice website's contact form HIPAA compliant?
Almost every practice website has a contact form. Most were added by a web designer in an afternoon, and few practice owners know where the messages actually go once a patient presses Send.
That matters, because patients will type health details into any box you give them. Here is how to think about it, and a setup that keeps your website useful without turning it into a privacy risk.
Why a simple form can become a privacy problem
If your practice is a HIPAA covered entity, information a patient sends you about their health, care or payment is protected health information (PHI), whether it arrives by fax, phone or your website.
A typical website form passes each message through several companies: the form plugin, the website host, an email delivery service and your inbox. HIPAA expects you to have a business associate agreement (BAA) with any vendor that creates, receives, stores or transmits PHI on your behalf. Most website builders, form plugins and email services don't sign one, or only do so on specific paid plans.
Two kinds of forms, two different jobs
The cleanest approach is to separate the jobs. A general contact form handles non-clinical questions: hours, insurance accepted, directions, new-patient availability. It should say plainly that patients must not include health information.
Anything clinical, such as intake questionnaires, symptoms, medications, referrals or insurance details, belongs in a tool built for it: your EHR's patient portal or a secure form service that signs a BAA and is configured correctly.
- Label the general form clearly: "Please do not include patient or sensitive health information."
- Keep its fields minimal: name, email or phone, and a short message.
- Send intake and scheduling requests to your portal or BAA-backed forms instead.
- If health details arrive through the general form anyway, move them into the clinical record and delete them from the inbox.
Check where your form messages actually go
You don't need to be technical to audit this. Ask your web person, or check yourself:
- Which service stores form submissions, and for how long?
- Which email address receives them, and who can open that inbox?
- Does any vendor in that chain sign a BAA, and on which plan?
- Are old submissions sitting in a website dashboard nobody checks?
Tracking tools on booking and intake pages
Analytics and advertising pixels have been the bigger enforcement story. In 2022 the HHS Office for Civil Rights (OCR) issued guidance on online tracking technologies, revised in March 2024. In June 2024 a federal court in Texas vacated one part of it: the position that an IP address combined with a visit to a public page about a health condition is, on its own, PHI.
The rest of the guidance was not vacated. Tracking on pages behind a login, such as patient portals, and on pages where patients schedule or submit information still deserves close scrutiny. A practical rule for small practices: keep advertising pixels off booking, intake and portal pages, and use privacy-friendly analytics on the rest of the site.
What a sensible setup looks like
- A website contact form for general questions, with a clear no-health-information notice.
- Online scheduling and intake through tools that sign a BAA.
- Analytics that don't follow visitors across sites, and no ad pixels on clinical pages.
- A privacy policy that describes what the site actually collects.
This guide is general information for practice owners, not legal advice. For decisions about your own compliance, talk with a healthcare attorney or your compliance advisor.