HIPAA Website Forms: What a Practice's Form Needs

Your website form falls under HIPAA once it collects identifiable health information for a practice HIPAA covers. A vendor's "HIPAA compliant website forms" label is only a start. What counts is where each entry goes, who can read it and what the form asks.

Quick answer

• List every field. A visit reason, symptoms or an insurance card photo make it a patient form.
• Submit one test entry and follow it: which inbox, which dashboard, which spreadsheet receives it.
• Ask each vendor in that path for a business associate agreement (BAA). Without a contract, at least leave health details off.
• Trim the web form to what a callback needs. Move symptoms and insurance to the call.

When a form counts

HIPAA covers a provider who "transmits any health information in electronic form" in a standard transaction, such as an electronic insurance claim. A cash-only med spa may not be one.

The rule's test for the vendor is whether it "creates, receives, maintains, or transmits" protected health information (PHI) on the practice's behalf. If yes, the vendor is a business associate, and the practice needs a written contract with it, called a BAA.

HIPAA's minimum necessary standard tells a practice to "limit protected health information to the minimum necessary" when it uses or discloses it. It sets no field limit for a form, but every field is copied to the vendor, so I read it as a reason to ask less online. I'm not a lawyer, and this isn't legal advice. Your privacy officer or a health lawyer draws your line.

In Canada, HIPAA does not apply. Canada's federal privacy commissioner lists Ontario's Personal Health Information Protection Act (PHIPA) among four provincial health information laws that in many cases apply instead of PIPEDA. Which law applies is decided case by case.

Where one submission travels

Patient sends form

fields and uploads

Vendor stores it

their servers

Email alert

to the front desk

Sheet or CRM

synced copy

Patient sends form

fields and uploads

Vendor stores it

their servers

Email alert

to the front desk

Sheet or CRM

synced copy

Each stop raises its own contract question:

• The notification email. A form that emails each entry puts patient details in an ordinary inbox. Jotform's HIPAA accounts work the other way: every field starts as PHI and "PHI fields will be removed from the email content". So staff log in to read the entry. Cognito Forms tells customers to mark PHI as protected to keep it out of email, unless patients signed a waiver.
• The vendor's storage. Gravity Forms is a WordPress plugin, so entries sit in your own database. Its docs say entry data "is not encrypted during storage" by default. It won't sign a BAA because it doesn't host your data, so your web host is the party to contract with.
• File uploads. An insurance card photo puts a name and a member ID in one file. Cognito Forms says HIPAA-account forms are encrypted at rest, including File Upload files. Gravity Forms obscures upload links by default and gives developers a filter that requires a login before one opens the file.
• Ad tags. A tracking tag on the form or thank-you page can send the visit to Google or Meta. I cover this in HIPAA-conscious conversion tracking: send a bare event, never a name or a reason for the visit.
• The sheet or CRM. Jotform's BAA says it isn't responsible for PHI "after It is sent, exported or downloaded" and allows an integration only with a BAA for its provider. A copy in a free spreadsheet is a second place to protect.

What the form tools publish

Wix says a form built on old Wix Forms can't convert, so you delete and recreate it. If you cancel the site plan, Wix says the data stays "protected under HIPAA standards" for 30 days, then falls back to its normal security.

Google lists Forms in its Drive entry of Workspace services the BAA covers. Its admin page leaves "Additional Google Services" out of the BAA.

Website form or phone call

Put on the form only what the office needs to call back. Everything else belongs in the call, portal or visit.

A contact form built this way has less to leak. Still, HHS guidance says identifiable details collected on a covered practice's website generally are PHI, even before the person is a patient. A June 2024 court ruling set aside only its part on tracking visits to public pages about a condition or provider.

For a longer intake before the first visit, use a portal or a form vendor with a BAA. The same logic runs through HIPAA text messaging and the forms section of medical website design.

A test entry from your own phone

1. Open your contact page on your phone and list every field and upload slot.
2. Submit one entry with a dummy name and your own phone number.
3. Check the alert inbox for the answers, not just a notice, and note who else receives it.
4. Open the dashboard, note any synced sheet, Zapier connection or CRM, and who has a login, with or without a second sign-in step.
5. For an upload field, copy one file's link and open it in a private window: it should ask for a login.
6. Open the thank-you page. If it loads an ad tag, ask your agency what it sends.
7. Search the form tool's help center for "BAA" and confirm it names your plan.

Anything with no contract behind it goes on a fix-or-remove list for your privacy officer.

What to ask your agency or web designer

• Which tool receives the form, and is there a BAA with that vendor?
• Who has a login, and who removes it when they leave?
• What does the form cost over a year on the plan that includes the contract?

If a quote for a new site leaves this out, the line item is missing from the cost too.

Prices and rules checked on 2026-10-26.