HIPAA compliant contact forms: what a practice website needs

A contact form looks harmless. But the moment a patient types their name next to a symptom, a treatment or an appointment request on your website, that form is handling protected health information. Here is what that means for a HIPAA covered practice, in plain English. It is a practical guide, not legal advice, so have your attorney or compliance lead review your setup.

When does a form collect PHI?

For a covered entity, such as a practice that bills insurance electronically, information that identifies a patient and relates to their health or care is protected health information. A form asking for a name, email and "reason for your visit" usually collects it. So does an appointment request, a new patient intake form or a question about a specific treatment.

A general enquiry form that only asks for a name and email and "how can we help?" is lower risk, but patients will still type health details into a free text box. Build as if they will.

Your form vendor needs a BAA

Any company that receives, stores or transmits PHI on your behalf is a business associate, and HIPAA requires a business associate agreement with them. That includes the form builder, the service that emails submissions, and the place submissions are stored. Many popular form tools do not sign BAAs on their standard plans, so check before you build.

What a compliant form setup looks like

• A form tool, inbox or database whose provider signs a BAA, covering every place the submission goes
• Encryption in transit (HTTPS) and at rest, so submissions are not readable if intercepted or leaked
• Submissions delivered to a secure inbox or portal, not copied in full into ordinary email
• Only the fields you need. Ask for symptoms at the appointment, not on a public form, unless you must
• Access limited to the staff who handle enquiries, with logins that are not shared
• A clear privacy notice next to the form, and a retention rule for old submissions

Tracking pixels on form pages

HHS guidance warns that tracking technologies such as advertising pixels and analytics can disclose PHI. In 2024 a federal court in Texas vacated part of that guidance, the part about public pages that only reveal a visit, and HHS later withdrew its appeal. The rest of the guidance was not vacated, and pixels that capture what patients type into booking, intake or portal pages remain a serious risk. Private lawsuits over pixels are common too.

The safe default: no advertising pixels on any page with a form that can collect health information, and analytics set up so they never capture form contents or treatment-specific URLs.

State laws can go further

Some states regulate consumer health data beyond HIPAA, including for businesses HIPAA does not cover. If you see patients from those states, check them with your attorney. Our US laws and regulations hub summarises the main ones.

Questions to ask your web team

• Which vendors does a form submission touch, and has each one signed a BAA?
• Where are submissions stored, for how long, and who can see them?
• Which scripts, pixels and analytics run on pages with forms?
• What happens to a submission if the email fails or the form tool has an outage?

Hizmedia builds practice websites and forms with these answers in place, signs a BAA, and audits every script on the site before launch. See websites for US practices.