Patient forms, HIPAA and your practice website

Most of a practice website is public information: what you treat, who your doctors are, where you are and when you're open. HIPAA starts to matter the moment the website collects patient information or passes it on to someone else. That's where most practice websites get into trouble, usually without anyone noticing.

Here is what to look for on your own website, in plain words. It isn't legal advice, so check anything you're unsure about with your compliance advisor.

What counts as patient information on a website

Health information becomes protected when it can be tied to a person. On a website, that usually happens in a few places:

• An appointment request that asks for a name and the reason for the visit
• A contact form where patients describe symptoms or ask about their care
• Intake or new patient forms filled in online
• Uploads like insurance cards or photos of a skin concern
• Messages sent through a patient portal

If any of these are on your website, the information has to be handled by tools built and contracted for it.

The simplest safe setup: link out

The safest practice websites keep patient information off the website entirely. The book button opens your online booking tool. The patient portal button opens your portal. New patient forms open in a secure form tool. The website itself only shows public pages.

This is how we build every practice website. Your booking, forms and portal stay in the secure tools you already use, so no patient information is stored on your website or passes through it.

Contact forms

A general contact form is fine for questions like hours or directions, but patients will type health details into any box you give them. Keep it to name, email or phone and a short message, and add a line asking patients not to include health information. Or skip the form and list your phone number with a link to the portal for anything about care.

Business associate agreements

Any company that stores, receives or handles patient information for your practice is a business associate, and HIPAA requires a signed business associate agreement with it before you use it. That includes your booking tool, your online form provider and any email service that carries patient messages.

Most healthcare booking, portal and form tools offer one. If a tool won't sign a business associate agreement, don't use it for anything patients fill in.

Tracking pixels and analytics

Tools like the Meta Pixel and Google Analytics record what visitors do on your website. In 2022, the U.S. Department of Health and Human Services warned that these tools can share patient information with tech companies when they run on healthcare websites.

In June 2024, a federal court in Texas struck down the part of that guidance covering public pages, where the only thing collected was a visitor's IP address and the page they viewed. HHS dropped its appeal in August 2024. The rest of the guidance still stands, including the parts about pages behind a login, like patient portals.

In practice:

• Keep tracking tools off your patient portal, booking pages and form pages
• Never send what patients type into a form to an advertising platform
• Know which tracking tools run on your website and what each one collects
• Check your state's own health privacy laws, which can be stricter

A quick checklist for your website

• Book, portal and patient forms link out to secure tools
• Every tool that handles patient information has signed a business associate agreement
• Contact forms ask only for contact details and a short message
• No tracking tools on pages behind a login or on form and booking pages
• A notice of privacy practices is linked in your footer

Websites built this way from the start

We design websites for dermatology, dental and med spa practices with the book button, patient portal and forms linked out to the tools you already use, so no patient information is stored on the website. See the dermatology website designs or browse all our designs.