HIPAA-Compliant Web Forms: Complete Guide
Web forms are one of the most common entry points for PHI on healthcare websites — and one of the most frequently misconfigured. Get it right from the start.
Why Standard Web Forms Are Not HIPAA Compliant
Most healthcare websites use generic contact forms — WordPress Contact Form 7, WPForms, or simple HTML forms that send email via PHP mail() or a shared SMTP service. These solutions are not HIPAA compliant because:
- Form data is transmitted to email inboxes without end-to-end encryption
- Email providers like Gmail or Outlook do not offer HIPAA BAAs for standard accounts
- Form submissions are often stored in CMS databases without column-level encryption
- Most form plugins send notification emails with full form content in the message body
- No audit trail is maintained for who accessed submitted data
The moment a patient types their name, date of birth, or health concern into a form on your website, that data becomes PHI and must be handled accordingly.
HIPAA-Compliant Form Architecture
A properly built HIPAA-compliant form has three protected segments: transmission, storage, and access.
Transmission: The form must submit over HTTPS to an endpoint covered by a BAA. The receiving server must not forward PHI via unencrypted email.
Storage: Submitted data must be stored encrypted at rest. Database columns containing PHI should use AES-256 encryption. Files uploaded via forms (intake documents, insurance cards) must be stored in encrypted object storage.
Access: Access to submitted form data must be role-controlled, logged, and audited. Not everyone in the office should be able to query all form submissions — access should be limited to those with a need to know.
HIPAA-Compliant Form Platforms
Several third-party form platforms are specifically designed for healthcare use and offer BAAs. These platforms handle encryption, secure storage, and access controls so you do not have to build compliance infrastructure from scratch.
- Formstack — offers HIPAA-compliant plans with BAA
- Cognito Forms — HIPAA plan available with encryption and BAA
- JotForm — HIPAA plan with encrypted storage and BAA
- Typeform — BAA available, review security configuration carefully
- Intakeq / SimplePractice — purpose-built for healthcare intake workflows
When evaluating any form platform, confirm that: they will sign a BAA, they encrypt submissions at rest, they provide access logs, and their data centers are US-based with SOC 2 Type II certification.
What Data You Can and Cannot Collect
Apply the minimum necessary standard to every form field. Only collect information you actually need to serve the patient or fulfill the form's purpose.
- Generally safe on a public contact form: Name, phone number, email, general inquiry topic
- Requires full HIPAA controls: Date of birth, insurance information, diagnosis, symptoms, medications, appointment type for specific conditions
- Avoid entirely unless specifically required: Social Security Number, detailed medical history, mental health information (subject to additional state protections)
Adding a "message" field to an appointment request form seems innocuous, but patients frequently include detailed health information in free-text fields. Design forms to minimize the opportunity for incidental PHI collection.
Form Notification and Workflow Security
After a patient submits a HIPAA-compliant form, the notification workflow must also be compliant. The most common mistake is configuring a HIPAA-compliant form platform to send a notification email with the full submission content to a staff inbox via standard email.
- Configure notifications to send a link to the secure portal rather than the form data itself
- Use a HIPAA-compliant email service with a BAA for any notifications that must include PHI
- Implement notification access controls — route sensitive forms only to staff with appropriate access
- Log all notification sends and accesses
- Train staff not to forward form submission emails to personal accounts or unsecured systems