HIPAA compliant website forms are not something you get by installing the right plugin. A form is compliant when every place the submitted data lands, from the visitor’s browser to your inbox to your ad platform, is either covered by a business associate agreement (BAA) or kept out of the path entirely. Most practice sites fail at one of the later hops, not at the form itself.
The short version: treat anything a visitor types into a practice form as protected health information (PHI), get a signed BAA from every vendor that stores or relays it, and keep tracking tools away from the form and its confirmation page. The rest of this guide shows how to check each step, and where we think practices over-collect.
When does a website form collect PHI?
Assume it does. A name and phone number sent to a dental office with “I want to ask about implants” tells the office who the person is and what care they are asking about. Once a covered entity holds that, the safe reading is that it is PHI, and the form should be built that way.
Federal guidance on tracking technologies has shifted, which causes confusion. In June 2024 a Texas federal court vacated the part of the HHS bulletin that treated an IP address plus a visit to a public health page as PHI by itself, and HHS withdrew its appeal in August 2024. The same sources note that information users type into forms and appointment tools was not part of what the court removed, according to this 2026 summary of the case. Our reading: the ruling loosened the rules for passive browsing and left typed-in form data exactly where it was. A practice that relaxed its form setup after the headlines misread the decision.
Which five steps does form data pass through?
Every submission makes up to five hops. A BAA or a deliberate exclusion has to cover each one, and the weakest hop sets your real compliance level. Most checklists stop at hop two.
| Hop | What happens | Common failure |
|---|---|---|
| 1. The page | Visitor opens the form over HTTPS | Ad pixels, heatmaps or session recording load on the same page |
| 2. The form tool | A plugin or hosted builder receives the answers | Vendor refuses a BAA, or offers one only on a higher plan |
| 3. Storage | Entries sit in the site database or vendor dashboard | Hosting plan has no BAA; old entries are never deleted |
| 4. Notification | Staff get an alert for each submission | The email body repeats every answer in plain text |
| 5. Downstream | CRM, spreadsheet, automation or ad conversion receives a copy | A free automation tool forwards the data with no agreement in place |
The practical point is that fixing hop two does nothing for hops four and five. A practice can buy a compliant form builder and still leak the same answers through a notification email and a conversion event.
Which form tools will sign a BAA?
It depends on the tool and, more often than not, on the plan. A “HIPAA compliant” badge on a pricing page is not the same as a signed agreement, so get the BAA in writing before any trial. The table below comes from one vendor-published comparison of 21 form builders, with prices as listed in October 2026. The publisher, NexHealth, sells its own intake software, so treat it as a starting point and confirm each line with the vendor.
| Tool | BAA available on | Listed price |
|---|---|---|
| Jotform | Gold and Enterprise only | Gold $99/mo billed annually |
| Cognito Forms | Enterprise | $149/mo billed annually |
| Zoho Forms | Premium | $90/mo billed annually |
| Typeform | Enterprise only | By quote |
| Google Forms | Paid Workspace plan, after an admin accepts the BAA | Included with Workspace |
Two patterns stand out. First, the free and entry tiers of the popular builders are usually outside the BAA, so a practice using the free version of a well-known tool is likely not covered even though the vendor offers a BAA somewhere. Second, a tool that refuses a BAA outright cannot be the storage layer. Gravity Forms, a common WordPress plugin, states that because it does not host or store form data for customers it will not sign one, which Paubox’s review treats as non-compliant on its own. That does not make a WordPress site unusable. It moves the BAA question to your host and to every other service in the path.
Why do notification emails break an otherwise compliant setup?
Because the default alert copies the whole submission into an email. HIPAA does not ban email, but the data is now sitting in a mailbox, possibly on a phone, possibly forwarded. That is a storage location nobody planned for.
Our position: set the alert to say only that a new request arrived and where to read it, and keep the answers behind a login. It costs the front desk one extra click per submission. It also means a lost phone or a misdirected forward exposes nothing.
Do tracking pixels and ad conversions put a form at risk?
Yes, and this is where agency work and compliance collide. A conversion event that fires when the form is submitted can carry the page URL, a form ID or typed values to an ad platform. Per the same 2026 summary, Meta and Google do not sign BAAs for their pixel and standard analytics products. If your tracking sends form data there, the BAA chain breaks.
Practices commonly handle it by firing the conversion on a generic thank-you page that carries no identifiers, or by using a server-side setup through a vendor that will sign an agreement. Either route is worth running past counsel. Our full breakdown of the tracking side is in HIPAA compliant marketing tracking, and the way platform rules changed for ad accounts is covered in Meta ads restrictions for practices.
What should a front-door form ask for?
As little as possible. The riskiest field on most practice sites is the free-text box, because patients type diagnoses, medications and symptoms into it without being asked.
We recommend two tiers. The public form collects a name, a phone number or email, a preferred time and the type of visit from a dropdown. The full medical history, insurance details and consent signatures come later, through an intake step that sits behind a secure link after the appointment is booked. Collecting less at the front door shrinks what a tool failure can expose. The trade-off is a slightly longer path to a finished intake, which is cheaper than a breach.
A checklist for auditing your own forms
- List every form. Contact, appointment request, new patient, newsletter, review request and pop-ups all count.
- Trace each form through the five hops and write down which vendor touches the data at each one.
- Collect a signed BAA from every vendor on that list, and note which plan it covers.
- Remove ad pixels, heatmaps and session recording from form pages and confirmation pages.
- Rewrite notification emails so they carry no answers.
- Delete the free-text box unless you have a reason to keep it, and set a retention period for stored entries.
The HHS pages on business associates and the Security Rule are the primary sources for what an agreement and safeguards must cover. This guide is general information, not legal advice.
What mistakes come up most often?
The first is relying on HTTPS. It protects data in transit and says nothing about where the data ends up. The second is a form built by a web developer who has access to submissions but never signed a BAA, even though a vendor that can reach PHI on a practice’s behalf is generally a business associate. The third is a form that was compliant at launch and drifted: a marketing tool added a script, an old plugin kept collecting entries, or a free account replaced a paid one. Our advice is to re-run the checklist whenever the site or the ad stack changes. The ADA website compliance guide makes the same point about accessibility: a one-time fix decays.
Frequently asked questions
Is a contact form on my practice website HIPAA compliant by default?
No. Most contact forms send answers by plain email and store them in a database that no one has signed an agreement for. Compliance depends on the hosting, the form tool, the notification method and any connected services, not on the form alone.
Can I use Google Forms for patient intake?
Possibly. Google Forms is covered by the Workspace BAA once a paid account’s administrator accepts it, and only for the services the agreement lists. Free personal accounts cannot accept one. Responses to Google Sheets and any add-ons need the same check.
Does a form need a BAA if it only collects name and email?
If a prospective patient submits their name and email to a covered entity while asking about care, treat it as PHI. The safest approach is to put a BAA in place with whoever stores or relays the data rather than rely on a narrow reading.
Is SSL or HTTPS enough to make a form compliant?
No. HTTPS encrypts the connection between the visitor and the site. It does not cover storage, access controls, email alerts, vendor agreements or tracking scripts, which are where most violations originate.
Does my web agency need to sign a BAA?
If the agency can view or manage form submissions that contain PHI, it generally acts as a business associate and should sign one. An agency that never touches submissions and works only on design may not, but confirm with your compliance advisor.
A compliant form is one where you can name every vendor that sees a submission and show the agreement that covers it.
