HIPAA and Your Website Contact Form: What Is and Is Not Protected Health Information

A website contact form is a HIPAA issue only when it collects health information tied to a person: a symptom, a diagnosis, a medication, a visit. Name, phone, email and a good time to call are identifiers, not protected health information. The rule is narrower than most physicians fear, and a safe form is easy to build.

This is not legal advice, and your compliance officer or attorney has the final word for your practice. It is the working understanding we build websites with, in plain language.

What is protected health information?

HIPAA protects individually identifiable health information held or transmitted by a covered entity (a practice that bills insurance electronically is one) or its business associates. Two things have to be true at once: the information has to identify a person, and it has to relate to their health, their care or payment for it.

The left column is a marketing inquiry. The right column, received by a covered entity, is PHI, even though it arrived through a public web page. The form did not change the rule. The content did.

When does a contact form cross the line?

A contact form crosses into PHI in three common ways, and all three are design choices you control.

• A free-text box with no guidance. “How can we help?” invites a paragraph about symptoms. The moment a patient writes one, you are holding PHI in whatever system received it.
• Delivery to the wrong place. Submissions forwarded to a personal email address, a shared inbox with no access control, or a form vendor that will not sign a business associate agreement.
• Fields that only make sense for existing patients. Date of birth, insurance member number, reason for visit. Those belong in an intake system built for PHI, not in the marketing form.

How do you build a contact form that stays on the right side?

Ask for what a scheduler needs, and nothing else

A prospective patient wants a call back. Name, phone, email and a good time to call are enough to make that happen. Everything clinical can wait for the phone call or the pre-visit form on a platform the practice controls, where it belongs.

Tell people not to type medical details

One line next to the message box, in both languages: “Please do not include medical information here; we will ask what we need when we call.” It changes what people write, and it documents that you tried.

Deliver to a controlled inbox

Submissions should land somewhere with access limited to the staff who need it, not in a personal email. If your form vendor or your email provider can see the content, they should be able to sign a business associate agreement, or the content should never contain PHI. Both approaches work; “we never thought about it” does not.

Encrypt in transit, retain little

HTTPS on the whole site, always. Then decide how long form submissions live and where. A marketing inquiry from three years ago has no reason to still exist in an inbox.

Keep real intake where it belongs

Symptom questionnaires, medical histories, portals and appointment systems that capture medical details are PHI systems. They belong on infrastructure with the right agreements in place, designed for that from the start, never in the same generic form builder as your newsletter. Our guide to secure platforms for medical practices lists them by need, and online scheduling for medical practices covers the appointment form specifically.

What about analytics and advertising pixels?

This is the part most practices have never considered. Advertising pixels and some analytics tools send what a visitor does on your site to a third party, sometimes with enough detail to identify them.

Federal guidance has warned that on pages behind a patient login, and on pages where visitors share health information, that can involve PHI. A federal court narrowed part of that guidance in 2024, and the area is still moving.

You do not need to follow the litigation to make a safe decision. Keep advertising pixels off pages where patients describe conditions or request care, use analytics that does not identify individual visitors, and review what every script on your site sends and to whom. If a marketing vendor cannot answer that question, that is the answer.

The mistakes we find on physician sites

• A “tell us about your condition” box on the public contact page, delivered to a personal Gmail.
• A full pre-visit form built in a generic form tool with no agreement and no access control.
• Advertising pixels on the “symptoms” and “book now” pages.
• A privacy badge or a compliance claim on the website with nothing behind it. There is no such certification for a website, and claiming one invites scrutiny.
• A web developer who has never asked what the form collects or where it goes.

The bottom line

HIPAA does not forbid a contact form. It asks you to know what the form collects, where it goes and who can see it, and to keep health information out of places that were never built for it.

Every platform we build for physicians starts with that decision: the marketing site collects no PHI, and anything that does is designed for it from day one. See how we approach medical website design, or read the wider physician website design guide, which covers HIPAA alongside everything else a physician site needs.

Article written by

Roger de Oca

Web designer, developer, and founder of DEOCAs. Roger builds and maintains web platforms for physicians and medical organizations, including the 2025-2026 president of a national medical society, and writes about what actually works for practices online.

rogerdeoca.com LinkedIn

This article is general information for physicians and practice managers, not legal, medical or financial advice. Rules and prices change; confirm anything that affects your practice with your own advisors.