Your website contact form needs to be HIPAA compliant when your practice is covered by HIPAA and the form collects health information about a person, such as a symptom or the treatment they are asking about. When it does, the form needs encryption, a vendor that signs a business associate agreement, limited access, alerts that keep health details out of email, and no ad tracking. The simplest fix is to ask for less. HIPAA is the federal law that protects patients' health information.
A form is often the first thing a new patient sends you, and it is easy to get wrong without noticing. The page looks fine and the message lands in an inbox, but nobody checks where the data went on the way. We review the contact, intake and booking tools on every site we build as part of our medical website design work. This is the checklist we use.
Does Your Website Contact Form Need to Be HIPAA Compliant?
Two questions decide it.
Is your practice a covered entity? A covered entity is an organization HIPAA applies to directly. For providers, HHS says that means providers who send health information electronically in connection with a transaction HHS has set a standard for, such as billing insurance electronically. Most practices that bill insurance qualify. A cash-pay practice may not, so check the CMS covered entity decision tool or ask your compliance advisor.
Does the form collect protected health information? Protected health information (PHI) is health information tied to a specific person, like a name together with a symptom, a condition or a treatment request. When it is stored or sent electronically, the HIPAA Security Rule calls it electronic PHI and requires safeguards for it.
If both answers are yes, the form is part of your HIPAA program. Even if they are not, a patient who types a health question into your site expects you to handle it with care, so the steps below are worth doing either way.
The Six Things a HIPAA-Compliant Form Needs
- Encryption in transit. The page and the form submission run over HTTPS, the padlock in the browser bar. The Security Rule's transmission security standard requires guarding health information sent over a network against unauthorized access.
- A vendor that signs a business associate agreement. A business associate agreement (BAA) is the contract HIPAA requires with any vendor that creates, receives, stores or sends PHI for you. HHS lists cloud service providers that handle electronic PHI as business associates, which covers most form builders. If a vendor will not sign one, do not use it for health information.
- Secure, limited storage. Submissions stay encrypted in the vendor's system, only named staff can open them, and every view is logged. These match the Security Rule's access control and audit control standards.
- Alerts without health details. The email your front desk gets should say a new inquiry arrived and link to where it is stored, not repeat the patient's message.
- No ad tracking on the form. Advertising and analytics tags can record what someone types or which page they submit from. The tracking section below explains why this matters.
- Only the fields you need. Every extra field is more health information to protect. A contact form only needs enough to call the person back.
A Safer Contact Form, Field by Field
| Field | What it reveals | Where it belongs |
|---|---|---|
| Name, phone, email | That this person contacted a medical practice | Contact form, with the safeguards above |
| Best time to call | Nothing about health | Contact form |
| Service of interest | The treatment the person wants | Contact form, with the safeguards above |
| Open message box | Often a symptom or condition, even when you did not ask | Contact form only with the safeguards above, or swap it for a short list of services |
| Date of birth, insurance, medications, history | Detailed health and identity information | A secure intake form or patient portal after the first call |
Add one line under the message box: "Please don't include medical details. We'll ask what we need when we call." It will not stop everyone, which is why the safeguards still apply, but it cuts down what arrives.
Why Ad Tracking Is the Part Most Practices Miss
Tracking technologies are snippets of code from Google, Meta and others that record what visitors do on your site, usually installed to measure ads. HHS guidance says tracking on pages where people can schedule an appointment without logging in "may have access to PHI in certain circumstances." It also says regulated practices must make sure tracking vendors sign a BAA before PHI is disclosed to them.
In June 2024 a federal court in Texas set aside part of that guidance: the part about connecting a visitor's IP address to a public page about a health condition or provider. Pages with forms and scheduling are still the ones to be careful with. Before you run ads to a page with a form, have your compliance advisor review which tags load there. Our guide to Google Ads for medical practices covers how to report on ads without sending patient details to the ad platforms.
What to Ask Your Form Vendor
- Will you sign a business associate agreement, and on which plan?
- Are submissions encrypted in transit and while stored?
- Can we limit who sees submissions, and is every view logged?
- Can alerts go out without the form's contents?
- How long do you keep submissions, and can we delete them?
- Do any third-party scripts load on the form?
Get the answers in writing. HHS says a business associate agreement must spell out how the vendor may use the information and require it to report security incidents. The same questions apply to your marketing agency and every other tool that touches patient information; see Healthcare Marketing and HIPAA: Questions to Ask Your Agency.
HIPAA-Compliant Forms at a Glance
| Requirement | What it means | How to check |
|---|---|---|
| Encryption in transit | HTTPS on the page and the submission | Padlock in the browser bar on the form page |
| Business associate agreement | A signed contract with the form vendor | A signed copy on file |
| Secure storage | Encrypted, limited access, every view logged | Ask the vendor; review who has a login |
| Alerts | An alert without the message contents | Submit a test and read the email you get |
| Tracking | No ad tags recording form data | Ask your web team which tags load on the page |
| Fewer fields | Contact details and a time to call | Cut any field you do not use on the first call |
Common Questions About HIPAA-Compliant Forms
Do I need a BAA with my form builder?
Yes, if the form collects health information for your practice and the vendor stores or sends it. HHS counts cloud service providers that handle electronic health information as business associates, so they need a signed business associate agreement before patient information goes through them.
Can I just remove health questions from my contact form?
Yes, and it is the simplest way to lower the risk. Ask for name, phone, email and a good time to call, ask visitors not to include medical details, and collect health history in a secure intake form after the first call. Keep the encryption and leave ad tracking off either way, because people still type symptoms into message boxes.
Can I use the Meta pixel or Google tags on a page with a form?
Only after a privacy review. HHS guidance says tracking vendors that receive patient information must sign a business associate agreement, and pages where people request appointments can expose it. A 2024 court ruling narrowed part of that guidance, so have your compliance advisor approve what loads on form pages.
Is emailing form submissions to my office HIPAA compliant?
It can be, if your email provider signs a business associate agreement and messages are protected in transit. The simpler setup is an alert that says a new inquiry arrived, with the details kept in the secure system that stores the form.
Does a med spa contact form need to be HIPAA compliant?
It depends on whether the med spa is a covered entity, which usually turns on whether it bills insurance electronically. A cash-pay med spa may not be, but clients still share health details through forms, so the same safeguards are good practice. Check with your compliance advisor.
What to Do This Week
Fill out your own contact form with a made-up symptom and follow it. Where did the alert land, and does it show the symptom? Which vendor stores the submission, and is a signed business associate agreement on file? Ask whoever manages your site which tracking tags load on that page. If any answer is "not sure," that is your first fix.
This article is general information, not legal advice. Your compliance advisor has the final word on your setup.
Sources
- U.S. Department of Health and Human Services. Covered Entities and Business Associates (which providers are covered entities). Content last reviewed August 21, 2024.
- Centers for Medicare & Medicaid Services. Are You a Covered Entity? (decision tool), accessed October 2026.
- U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule (electronic PHI; access control, audit control and transmission security standards). Content last reviewed August 7, 2026.
- U.S. Department of Health and Human Services. Business Associates (cloud service providers as business associates; what the agreement must require). Content last reviewed October 21, 2026.
- U.S. Department of Health and Human Services. Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024, with notice of the June 20, 2024 court order in American Hospital Association v. Becerra).
- U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule (what counts as protected health information). Content last reviewed March 14, 2025.