HIPAA and Your Practice Website: What to Know About Online Forms

Most doctors think carefully about HIPAA in the exam room and the EHR. Fewer think about it on their website. Yet a simple "request an appointment" box can collect a patient's name, date of birth, and reason for visit, and then send it somewhere you never intended. If you are wondering whether you need HIPAA compliant medical website forms, the honest answer for most practices is yes, as soon as a form asks for anything about a person's health.

This article is general information, not legal advice. Every practice is different, so confirm the specifics with your compliance officer or a healthcare attorney. What follows will help you ask the right questions.

When a Website Form Collects Health Information

A form that asks only for a name and a phone number to "call me back" is lower risk. The picture changes when the form asks why the person is reaching out, what symptoms they have, what insurance they carry, or whether they are an existing patient. Combined with identifying details, that information can be protected health information, often called PHI.

Many website forms are built to make that easy to share. A field labeled "How can we help?" invites a patient to type their diagnosis. So even if you did not ask for health details, you should plan as if you will receive them.

Business Associate Agreements: The Key Question

Under HIPAA, a vendor that creates, receives, stores, or transmits PHI on your behalf is generally a business associate. Before that vendor handles PHI, you typically need a Business Associate Agreement, or BAA, in place. The BAA is a contract in which the vendor agrees to protect the information as HIPAA requires.

For your website, that means asking every company in the path of a form submission a direct question: will you sign a BAA? That includes the form tool itself, where submissions are stored, and anything that forwards them. Many popular form builders and website platforms do not sign BAAs on their standard plans. If the answer is no, that tool should not be collecting health information from your patients.

If a vendor touches patient information and will not sign a Business Associate Agreement, it does not belong on your website.

Why Ordinary Email Is a Weak Link

A very common setup works like this: a patient fills out a form, and the website emails the full submission to the front desk inbox. It feels convenient. But ordinary email may pass through servers you do not control, sit unencrypted in inboxes, and get forwarded to personal phones.

A safer pattern keeps the health details inside a HIPAA-compliant system and sends staff only a notification that a new submission is waiting, with no PHI in the email itself. Staff then log in to view it securely. Ask your form provider whether it supports this kind of notification.

Be Careful With Tracking Tools

Analytics scripts, advertising pixels, chat widgets, and heatmap tools are common on websites. On a page where patients enter health information, or on pages that reveal something about a person's condition, these tools can send data to third parties who have not signed a BAA. Federal regulators have issued guidance on online tracking technologies, and parts of it have been challenged in court, so ask your compliance team or attorney how it applies to your practice.

Practical steps:

• Make an inventory of every script running on your site. Your developer should be able to list them.
• Keep advertising pixels and session recording tools off form pages and patient portal pages entirely.
• Ask whether your analytics setup is appropriate for a healthcare site, and review it with your compliance team.
• Remove tools nobody uses anymore. Old scripts are a common surprise.

Replying to Reviews Is a HIPAA Issue Too

Reviews are not a form, but they are part of your online presence, and they cause real trouble. Never confirm that a reviewer is your patient. Never reference their visit, their condition, or their treatment, even if they described it publicly. A short, general reply that invites them to contact the office is the safe pattern. Our post on doctor reviews and AI search explains why reviews deserve attention in the first place.

A Simple Website Compliance Checklist

• Every form that could collect health information runs through a provider that signs a BAA.
• Form submissions are not sent in full through ordinary email.
• The site uses HTTPS on every page.
• Tracking and advertising tools are reviewed and kept away from pages with patient data.
• Your privacy policy describes what the site collects and how it is used.
• Staff know the rules for replying to reviews and messages online.
• Someone owns this list and reviews it at least once a year, and whenever the site changes.

How We Handle Forms at Propelled MD

Every site we build routes patient forms through HIPAA-compliant providers that sign a Business Associate Agreement. Our sites are coded from scratch, which means we know every script on the page because we put it there. There is no plugin quietly adding a tracker after an update.

If you are not sure what your current site is doing, our free Position Report gives you a written analysis of what patients, Google, and AI see, delivered in two business days. And when you are ready for a site built with compliance in mind from the first line of code, start with our approach to medical website design.