Where websites touch protected health information
This isn’t legal or compliance advice. Your HIPAA obligations are a question for your compliance adviser or attorney. What follows is the technical side we see on practice websites.
- Appointment requests that ask for symptoms or the reason for the visit.
- Intake and new-patient forms.
- Patient portals and online bill pay.
- Email and text sent from the website’s forms.
- Tracking pixels and analytics on pages patients use.
Vendors and agreements
If a vendor receives or stores health information for you, such as a form service, hosting provider, email provider or portal, HIPAA generally expects a business associate agreement with them. Many popular form builders and website platforms won’t sign one on standard plans. Check before you collect anything sensitive through them.
Tracking technologies
HHS has issued guidance warning that tracking pixels and analytics on health care websites can disclose protected health information to the companies that run them. A federal court set aside part of that guidance in 2024, but tracking on patient portals, appointment pages and forms remains a real compliance question. Decide deliberately what runs on those pages, with your adviser.
Technical basics
- HTTPS on every page, security headers on.
- Forms that store entries encrypted behind a sign-in, not emailed around the office. See contact form security.
- Two-step sign-in for everyone with access.
- Access logs and a way to remove people the day they leave.
- A privacy notice that matches what the site actually collects.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.