HIPAA and your clinic website: forms, tracking and what to avoid.

First, check that HIPAA covers your clinic

HIPAA applies to covered entities and to the businesses that work for them. A health care provider, such as a doctor, dentist, psychologist, chiropractor or clinic, is a covered entity only if it sends health information electronically in one of the transactions HHS has set a standard for. Billing an insurer electronically is the usual one. HHS links to a question and answer tool that walks you through the test.

If you are covered, everything below applies. If you are not, for example an aesthetic clinic that is paid directly and never bills insurance, HIPAA may not reach you, but other rules still do:

• The FTC Act. In 2023 the FTC acted against GoodRx and the online counselling service BetterHelp over health information they had shared with advertising platforms.
• State health data laws. Washington's My Health My Data Act, for example, has required consent to collect consumer health data since 2024, unless the data is needed for a service the person asked for. It exempts information that HIPAA already covers.
• In Europe, the GDPR, which treats health data as a special category. The last section covers it.

This guide is general information, not legal advice. Whoever handles HIPAA for your practice, or your lawyer, has the final word on your setup.

What counts as health information on a website

Protected health information is information that identifies a person and relates to their past, present or future health, care or payment for care, held by a covered entity or a business working for one. On a website the identifying part is easy to collect: a name, an email address, a phone number, even an IP address.

HHS's position is that identifying information a covered clinic collects through its website is generally protected health information, even when the visitor is not yet a patient and even when no treatment is named. In practice, these are covered:

• A contact or booking form that sends a name and a reason for the visit.
• A booking widget without a login, once someone picks a service and enters an email address.
• A symptom checker, or a quiz that gives a health result.
• The login and registration pages of a patient portal, once someone types into them.
• Everything behind the portal login.

And these are not, in HHS's own examples: a visit to a page about job vacancies or visiting hours, even with the visitor's IP address recorded, because nothing about anyone's health is involved.

What a first-contact form should ask

Health information on a form is not forbidden. It has to go to the right places. Even so, a first-contact form should ask only what your team needs to call or write back, because every extra field is one more thing to protect. HIPAA calls this the minimum necessary.

A dental practice's first-contact form can stop here:

• Name.
• Phone number or email, and which one to use.
• New or existing patient.
• What it is about, as a choice: check-up, toothache or broken tooth, cosmetic treatment, a question about a bill, something else.
• Best days and times to call back.
• A short message box, with a line under it: "Please don't include medical details here. We'll ask what we need when we call."

Leave out date of birth, insurance member numbers, medications and medical history. Those belong in your registration and medical history forms, inside your practice software or a form tool that has signed a business associate agreement. Never ask for a Social Security number or card details on a website form.

Put your urgent instructions above the form, not in the confirmation email. Someone with swelling that makes it hard to swallow should see the phone number before they start typing. A physiotherapy clinic can use the same shape, with "new injury, ongoing problem, after surgery" as the choices, and our page on dental clinics lists the questions patients ask before they get that far.

Which companies behind your website need a BAA

A business associate is any company that creates, receives, maintains or transmits protected health information on your behalf. Each one needs a business associate agreement, a BAA, that says what it may do with the information, how it protects it and that it reports breaches to you. A subcontractor doing the same work for one of your business associates is a business associate too.

Walk the path a form submission takes and list everyone on it:

• The form tool, or your website platform if it keeps submissions in its own database.
• Your email provider, if the form emails the details to you. Microsoft includes a BAA in the data protection terms for its business services. Google's Workspace BAA has to be accepted by an administrator in the Admin console before any patient information goes in. A personal Gmail account is not covered.
• The CRM, spreadsheet or helpdesk the enquiry is copied into.
• Your booking tool, and any text message service that sends reminders.
• A chat widget, and the AI service behind it if it writes the replies. HIPAA and AI chatbots follows that chain.
• Call tracking or call recording on the numbers you advertise.
• Your web developer or IT support, if they can open the submissions or the database.
• Backup services that copy any of the above.

Two traps. The conduit exception is narrow: it covers services that only carry information, like the postal service, with no storage beyond what the delivery itself needs. Anything that keeps a copy is a business associate, even if the copy is encrypted and the company holds no key. And HHS does not certify or endorse products, so a badge on a vendor's website tells you nothing about your own account.

A "HIPAA compliant" form tool means nothing until you hold a signed BAA for the plan you actually pay for. Many vendors offer one only on a higher plan.

Where the form lands matters as much as the form

The form is only the first step. Follow one test submission through a small dental practice:

• The form emails the full message to info@, which three people read.
• One of them has info@ forwarded to the mail app on a personal phone.
• The receptionist copies the name and reason into a spreadsheet shared by link.
• The form plugin also keeps every submission in the website's database, on a host that has not signed a BAA.

Four copies, and three of them sit outside any BAA. The fixes are dull, and they work. If your email is not covered, send a notification that says "New enquiry, open the form tool to read it" instead of the details. Stop the forwarding. Keep the list in a covered system with named users. Switch off storage in the website database, or move to a host or form tool that signs.

Then decide how long enquiries that never become patients are kept, and delete them on a schedule. A list of every enquiry since the site launched is a breach waiting for a reason.

What the 2024 court ruling changed

HHS's Office for Civil Rights published a bulletin on online tracking which said, among other things, that an IP address combined with a visit to a public page about a health condition or a provider could be protected health information. Hospitals sued. On 20 June 2024, in American Hospital Association v. Becerra, a federal court in Texas declared that part unlawful and vacated it. HHS withdrew its appeal in August 2024.

The court took out that one piece. HHS's page says the rest of the bulletin stands, and that it is evaluating its next steps. What still applies:

• Tracking on pages behind a login, such as a patient portal, generally has access to protected health information.
• Tracking on public pages where someone books an appointment, uses a symptom checker or types into a portal login or registration form can collect it too.
• A tracking vendor that receives protected health information is a business associate and needs a BAA.
• A cookie banner is not a HIPAA authorisation, and a line in your privacy policy does not make a disclosure allowed.
• A vendor's promise to strip out health information after it arrives is not enough.
• Sending protected health information to a vendor for marketing, such as retargeting ads, needs each patient's HIPAA authorisation.

What the ruling did change: tags on general pages, such as your home page, opening hours or a careers page, are less likely to count as a disclosure on their own. That lowers the risk on those pages. It does not remove it. If the same tags fire on the booking page or the thank-you page after a form, you are back inside the bulletin.

Which pages can carry which tags

Sort your pages into three groups and treat each one differently:

• General pages: home, about, location, opening hours, careers, blog. Basic analytics here carries the least risk after the ruling.
• Pages about specific treatments or conditions. A visit alone is now less likely to count, but if the page has a form, a chat box or a booking button that sends details, it belongs in the third group.
• Pages where someone gives details or is identified: forms, booking pages and widgets, the thank-you page after a form, symptom checkers, portal login and registration, and everything behind the login. No third-party analytics, ad pixels, heatmaps or session recordings here unless the vendor has signed a BAA.

The ad platforms say much the same in their own terms. Google says it does not offer a BAA for Google Analytics, and that covered customers should not put its tags on pages behind a login or on public pages related to health care services. Meta's Business Tools Terms say advertisers must not send it health information through its pixel and other tools.

Look for the quieter leaks too:

• Page addresses and titles that name the treatment, such as /book/implant-consultation/thank-you, which every tag on the page receives.
• Tag features that pick up form fields or email addresses automatically.
• Session recording scripts that capture what people type.
• A booking widget or chat window loaded from another company's site, carrying that company's own trackers.
• Old tags nobody remembers adding, often left over from a past ad campaign.

Measuring ads without sending health data

You can still tell which campaigns bring patients. The difference is where the counting happens.

• Keep campaign tags in your ad links, and record the campaign with each enquiry in your own covered system rather than in the ad platform.
• Ask "How did you hear about us?" on the form or on the first call.
• Report totals by campaign each month: enquiries and booked first visits, with no names attached, next to what each campaign cost.
• If you need more, HHS's bulletin points to one route: a customer data platform that signs a BAA, removes the identifying details and passes only de-identified data to vendors that will not sign.

Our general guides on tracking leads from Meta ads and Google Ads lead tracking describe pixel-based setups. A covered clinic should use them only on pages in the first group above, and have the setup checked before any conversion tag goes near a form.

Clinics in Europe: health data under the GDPR

The GDPR defines data concerning health as personal data about a person's physical or mental health, including the care they receive, that reveals their health status. Article 9 bans processing it unless an exception applies. The two that matter to a clinic are the patient's explicit consent, and processing needed to provide health care under the responsibility of a professional bound by secrecy.

In practice the checks are the HIPAA ones under other names:

• Every tool that processes form submissions for you is a processor and needs a contract under Article 28.
• Ask for what the purpose needs and no more. The GDPR calls this data minimisation.
• Non-essential cookies and tags need consent before they load, which is a subject of its own: see Google Analytics and the GDPR.
• Set how long you keep enquiries, and who can read them.

One point of relief for small practices: the GDPR's recitals say that an individual health professional processing patients' data is not processing on a large scale, so a data protection impact assessment is not mandatory for that alone. The GDPR checklist covers the rest of the website side.

A one-hour check of your own site

You can do most of this yourself, with a made-up test patient and your browser:

• List every form, booking button, chat box and quiz on the site, and every field each one asks for.
• Send a test submission through each one and follow it: every inbox, phone, spreadsheet and system it reaches.
• For each stop, find the signed BAA, or mark it as missing.
• Open your booking page, a form page and the thank-you page with your browser's developer tools on the network tab, and list every outside company each page talks to.
• Open your tag manager and remove tags nobody can explain.
• Read the page addresses of your booking and thank-you pages for treatment names.
• Write down what you found and what you changed, with the date.

Then take the list to whoever handles HIPAA for your practice. If you are rebuilding the site anyway, we agree before each build what is stored, where and for how long: see websites.

Mistakes that show up on clinic websites

• A form vendor's HIPAA plan mentioned on the site, while the clinic pays for a cheaper plan with no BAA.
• Submissions emailed in full to a personal Gmail address.
• An ad pixel on the thank-you page, recording a conversion called "implant consultation".
• A first-contact form that asks for date of birth, insurance details and current medications.
• A booking widget embedded from a vendor that never signed anything.
• Every submission since the site launched still sitting in the website database.
• A chat widget added for convenience, with no thought about where its transcripts go.
• Heatmap or session recording tools left running across the whole site.