HIPAA-Compliant Contact Forms: What Your Website Actually Needs

The question usually arrives backwards. Is our contact form HIPAA compliant. It's a reasonable thing to ask, and it skips the question that decides the answer, which is whether the form should be touching that information at all.

Most contact forms shouldn't need to be

HIPAA attaches to protected health information: information that identifies someone and relates to their health, their care, or payment for that care. A form collecting a name, a phone number, an email address and a preferred appointment time isn't that.

Add a box saying tell us what's going on, and a patient will write three sentences about their symptoms. Now it is. The form didn't change, the field did.

So the cheapest compliant design is usually the smallest one. Collect enough to call the person back and have the clinical conversation on the phone or in the portal, where it belongs anyway. Most practices don't need a specialist form product. They need a shorter form. It's the same principle running through the rest of a practice site: ask for the minimum that gets you to a conversation.

What turns an inquiry into PHI

• An open box asking how the practice can help, which is the single most common cause and the one that looks most harmless.
• A dropdown asking the visitor to select their concern or the procedure they're interested in. It's structured, which makes it easier to process, not less identifying.
• File uploads. Referral letters, scans and insurance cards all arrive this way.
• Insurance member numbers collected before anyone has spoken to the patient.
• Anything asking about current medications, symptoms or history, which belongs in intake paperwork rather than on a public page.

Follow one submission the whole way

This is where practice sites fail in the real world, and it has very little to do with which form plugin got installed. Trace the actual path. The browser sends the submission to a server or a form service. That service composes an email. The email arrives in an inbox. The inbox may forward it somewhere else.

The padlock in the address bar covers the first hop. Standard email isn't encrypted end to end, and once a message lands it lands wherever the recipient list says it should, on whatever device that account is signed into.

I've opened live practice sites where form submissions were going to a personal Gmail address, and more than once to an account belonging to somebody who had left the practice. Nobody had noticed, because from the outside the form worked perfectly. It sent, it produced a thank-you message, and somebody was answering.

Every hop after the send button was somebody's decision at some point, usually a decision nobody wrote down. It's worth knowing what yours are before deciding whether you have a compliance problem, because in my experience the destination is the weak link far more often than the transmission.

If you do need to collect it

Some practices genuinely need clinical detail before a first appointment. If that's you, the requirements are well established.

• Use a form provider that will sign a business associate agreement. If a vendor creates, receives, maintains or transmits this information on your behalf, that agreement is the mechanism that makes it lawful, and a provider unwilling to sign one is telling you something.
• Encryption in transit and at rest, not just the padlock on the page.
• Delivery into a practice-controlled destination, ideally straight into the record system or a portal, rather than into an ordinary email inbox.
• A named, limited set of people with access, and a plan for what happens when one of them leaves.
• A retention decision. Inquiries sitting in a mailbox for six years are a liability nobody chose.

The portal is usually the right home for clinical intake. The website form is for please call me, and keeping that line clean removes most of the problem.

The tracking question, and what actually happened to it

This deserves correcting, because a lot of published advice is describing a rule that no longer stands as written. In December 2022 the Office for Civil Rights issued a bulletin on tracking technologies, revised in March 2024, and the broad reading of it was that an IP address combined with a visit to a public page about a health condition could itself be protected information.

In June 2024 a federal court in the Northern District of Texas declared that specific part unlawful and vacated it. In August 2024 the department withdrew its appeal, and no replacement guidance has been issued since. That reading does not stand.

What it doesn't mean is that tracking is now a free-for-all. Anything behind a patient login, and anything tied to a form submission or a confirmation page, sits in a different category entirely. The FTC has its own position on health data sharing, and state privacy laws have moved considerably. The practical build rule hasn't changed much: know exactly which scripts are on the site and what they send, and keep third-party trackers off pages behind a login and off the page a submission lands on.

None of that is legal advice, and the specifics belong with whoever handles compliance for you. What I can tell you is which scripts are running on your site right now, which is usually the part nobody has looked at.

Draw the map before you need it

What's worth producing out of all this is a map. One page showing every place a patient's information travels when they use your site: which fields collect what, where each submission gets delivered, which accounts can open it, and which third-party scripts are running on the pages patients land on.

Almost no practice has one, and it's the first thing anybody reviewing your compliance will ask to see. It also makes the awkward conversation easy, because the answer stops being that you think it goes to the office email and becomes a line on a page somebody can check.

Building that map is part of the free audit here. I work through the forms, the delivery path, the recipient accounts and the scripts loading on your patient-facing pages, then write it up as something you can hand straight to whoever owns compliance at your practice. It arrives with the search findings inside 24 to 48 hours, at no cost. What they do with it is between you and them, and at least it'll be a conversation about something written down. The same review sits inside how I approach building a medical site in the first place.

Written by Ashikur Rahman

Founder of Proximity Ranker, with nine years in SEO and a law background that shapes the medical and legal work we do. Meet the founder.

Back to the blog