Patient Forms on Your Practice Website: HIPAA Questions to Ask First
Before you add a patient form to your practice website, find out what it will collect, where each submission travels and is stored, and whether every vendor that touches it will sign a business associate agreement. A simple contact form can be fine for general questions, but forms that collect health details usually belong in a tool built for protected health information, and your compliance officer should review the setup.
A website form is part of your HIPAA picture, not separate from it.
A form on a website feels small. A patient types a few lines and clicks Submit. But that message has to go somewhere, and it can end up in more places than you expect.
A typical website contact form can save a copy in the website’s database, send the full message by email to one or more inboxes, pass through a spam filter run by an outside company, and land on staff phones that sync that email. Each of those is a place where information lives.
The HIPAA Privacy and Security Rules apply to protected health information wherever it goes, including your website. We are a web team, not your compliance officer or attorney. Think of this article as the list of questions to bring to the person who is responsible for compliance at your practice.
Sort every form into “general” or “health” before anything else.
Start by listing every form on your site. Most practices have more than they remember: contact, appointment request, new patient intake, careers, billing questions, newsletter sign-up.
Usually general
- Questions about hours, directions or parking
- Job applications
- Newsletter or event sign-ups
Usually health-related
- Symptoms, conditions or the reason for a visit
- Medications, allergies or medical history
- Insurance member details tied to a patient
- Intake questionnaires of any kind
The line is not always obvious. Even a name and phone number can become sensitive in context, for example on a form for a specific condition or treatment. Ask your compliance person where your practice draws that line, and write it down so your web team can follow it.
Then cut every field you do not truly need. Each field you remove is one less thing to protect.
Five questions to ask about any form that collects health details.
- Where does each submission go? Email, the website’s database, a third-party form service, your patient portal or your EHR? Get the full path, not just the first stop.
- Is it encrypted along the way and where it is stored? A secure (HTTPS) connection on the page is the baseline, not the finish line. Ask about storage too.
- Will every vendor that handles it sign a business associate agreement (BAA)? Not every form tool, email service or hosting plan offers one, and some offer it only on certain plans. Get the answer in writing.
- Who can see submissions, and how do they sign in? Named accounts for each person, strong passwords and two-factor sign-in, with access removed when someone leaves.
- How long is it kept, and how is it deleted? Old submissions sitting in an inbox or database for years are a risk with no benefit.
If nobody at your practice can answer one of these, that is your first task, not your website’s.
Health details can leak from places nobody thinks to check.
The form itself is only part of it. These are the spots that tend to get missed:
- Notification emails that paste the full submission into a regular inbox
- Website backups that include a database full of old form entries
- Spam filters and chat widgets that send form content to outside services for processing
- Tracking and analytics tools on appointment or condition pages. The U.S. Department of Health and Human Services has published guidance on online tracking technologies used by HIPAA-covered entities, so ask your compliance person how it applies to your site.
- Old forms on pages nobody visits anymore, still collecting and still emailing
A short review with your web team and your compliance person can map all of these in one meeting.
When a form needs health details, use a tool built for that job.
You do not have to build sensitive intake on an ordinary website form. Most practices have better options:
- Your patient portal. If your EHR includes one, link to it from your website rather than recreating its forms.
- A form service designed for protected health information, set up with a signed BAA and limited staff access.
- A phone call. For some questions, the best form is a button that says “Call us” during office hours.
Your general contact form can then stay simple, with a short note above it such as: “Please do not include medical details in this form. For questions about your care, call our office or use the patient portal.” Have your compliance person approve the exact wording.
This is how Atomic Interactive approaches healthcare forms: keep protected health information out of ordinary contact forms and email, and when a form must collect it, recommend a service built for that and set it up with you.
Your next step: inventory your forms with this checklist.
Set aside an hour with whoever manages your website and whoever handles compliance. Go through each form and check:
- We have a list of every form on the site, including old pages.
- Each form is labeled “general” or “health,” and we agree on where the line is.
- Every field on each form is actually needed.
- We know every place each submission goes and is stored.
- Every vendor that handles health information has a signed BAA on file.
- Notification emails do not contain health details.
- Staff access uses individual accounts with two-factor sign-in.
- Tracking tools on sensitive pages have been reviewed by our compliance person.
- General forms carry a short note asking patients not to include medical details.
- Old submissions are deleted on a schedule we chose on purpose.
Anything you cannot check off goes on a short list for your compliance person and your web team. Fix the forms that collect the most sensitive information first.
To see how we handle forms, booking and accessibility for practices, visit our medical and healthcare website design page.