Educational · US · HIPAA
HIPAA Compliant Forms: What Your Consultation Request Form Is Really Collecting
A consultation request form that pairs a name with a procedure is collecting health information, and every hop after submit is another copy.
- Procedure dropdowns turn an inquiry into protected health information once it reaches your practice.
- Form tools, CRMs and automations that hold that data are business associates, and HHS says that holds even for encrypted data without a key.
- Encryption is addressable, not optional. Implement it or document a reasoned equivalent in your risk analysis.
- Most exposure sits after submit: email notifications, integrations, tracking tags and old submissions nobody deletes.
- Audit every form, retire what you no longer need and give each remaining form an owner.
Look at the consultation form on your website. It probably asks for a name, an email, a phone number and a dropdown for the procedure the person is interested in. Maybe a text box that says "Tell us about your goals."
Now think about where that submission goes. It might land in a form plugin's database, get emailed to three staff inboxes, sync into a CRM and trigger an automated follow up. Each of those hops is a copy of information that, once it reaches your practice, can be protected health information.
Most practices chose their form tool because it was easy to embed. A web designer picked it during the last rebuild, it matched the site's look and it sent submissions to the front desk inbox. Nobody asked where the data was stored. Few chose it because it could sign a business associate agreement. That gap is what this article is about.
When does a website form collect protected health information?
More often than practices assume. HIPAA protects individually identifiable health information held by a covered entity, and a plastic surgery practice is a covered entity for the care it provides. A form that pairs a person's name or contact details with the procedure they want, a health condition, their medical history or a photo is collecting information about their health.
The dropdown is the part that catches people out. "Jane Smith, jane@email.com, interested in breast augmentation" is not a generic inquiry. It links an identifiable person to a specific medical procedure. Intake questionnaires go further, with medications, previous surgeries, allergies and body measurements.
A newsletter signup that only asks for an email address carries far less risk. The test is simple: could someone reading the submission learn something about this person's health or the care they are seeking? If yes, treat the form as a clinical intake channel, not a marketing widget.
Does your form vendor need to sign a business associate agreement?
If the vendor stores, processes or transmits that information for you, yes.
HHS set this out plainly in its guidance on cloud services. When a covered entity uses a cloud provider to create, receive, maintain or transmit electronic protected health information, the provider is a business associate, and HHS says this holds even when the provider only stores encrypted data and has no decryption key. Lacking the key does not remove the obligation.
Form builders, survey tools and the CRMs they feed are cloud services in exactly this sense. If a vendor will not sign a business associate agreement, the safe assumption is that it is not a suitable home for patient intake data, however polished the form looks.
Check the plan, too. Several well known form and CRM providers only sign a business associate agreement on higher tier plans, and only for features configured a particular way. A practice on the wrong plan can have a vendor that is capable of compliance and still not be covered.
Is encryption required for HIPAA compliant forms?
Under the current Security Rule, encryption is an addressable safeguard, both for data at rest and for data moving across a network. The technical safeguards at 45 CFR 164.312 list encryption and decryption, and transmission encryption, as addressable implementation specifications.
Addressable does not mean optional. It means you assess whether the safeguard is reasonable and appropriate for your practice, implement it if it is, and document an equivalent alternative if it is not. The documentation is not a formality. If OCR ever investigates a complaint or a breach, your risk analysis is the record that shows you thought about the question and made a reasoned decision.
For a web form collecting procedure interest and medical history, it is hard to argue that encryption in transit and at rest is unreasonable. Serving the page over HTTPS and choosing a vendor that encrypts stored submissions is the baseline, not the gold standard.
There is also a change on the horizon. In January 2025 HHS published a proposed Security Rule update in the Federal Register that would strengthen cybersecurity requirements for electronic protected health information. It is a proposal, and the rules in force today are the existing ones. If your forms are already encrypted end to end, you will not be scrambling if the final rule tightens the requirement.
What happens to the data after someone clicks submit?
This is where most exposure hides. The form itself might be fine. The workflow around it often is not.
Email notifications
Many form tools send the full submission to a staff inbox by default. That creates an unencrypted copy of patient information in email, sometimes forwarded to personal accounts or read on unmanaged phones. Switch notifications to a simple alert ("New consultation request received") with a link to log in and view the details in the secure system.
Integrations
No code automations, spreadsheet syncs and marketing platform connections each create another copy with another vendor. Every tool in that chain needs to be covered by a business associate agreement, or the data should not reach it.
Tracking
Some websites fire marketing tags when a form is submitted, and those tags can pass details about the page or the submission to advertising platforms. Tracking is a large topic of its own, so the short version here is this: check what your tags send on form pages and confirmation pages, and remove anything that could carry patient details.
Retention
Form submissions tend to live forever in a plugin database nobody remembers. Decide how long intake data is kept, where the master record lives and when copies are deleted. A consultation request from three years ago that never became a patient is still personal health information sitting on a server, and it is still your responsibility.
The pattern across all four is the same. Each extra copy is another place the data can leak, and another vendor you need to cover. Fewer hops means fewer problems.
How should a plastic surgery practice audit its forms?
Work through it in this order, because each step narrows the next.
- List every form on your website and landing pages, including popups and chat widgets that collect contact details.
- For each form, note whether it asks about procedures, conditions, history or photos. Those are your intake forms.
- Identify every vendor that receives the submission: the form tool, email provider, CRM, automation platform and any analytics or advertising tags on the page.
- Confirm a signed business associate agreement is in place with each vendor that handles intake data, and that your plan level is covered.
- Change email notifications to alerts with no patient detail.
- Confirm the page loads over HTTPS and that the vendor encrypts stored data.
- Record the decisions in your risk analysis, including any addressable safeguard you chose not to implement and why.
Expect the audit to turn up at least one surprise. In our experience it is usually an old landing page from a past campaign, still live, still collecting inquiries and still sending them to an inbox nobody monitors. Retire anything you no longer need. A form that does not exist cannot leak, and every page you remove is one less thing to maintain, patch and cover with an agreement. Once the list is clean, assign an owner for each remaining form so someone is accountable when a vendor changes its terms or a campaign adds a new page.
The NIST implementation guide for the HIPAA Security Rule is a useful companion for step seven if your practice has never documented a risk analysis in detail.
Not sure whether your consultation forms would stand up to a review? Talk to our team and we will walk through it with you.
Frequently asked questions
Can we just remove the procedure dropdown to avoid the problem?
It reduces risk but rarely removes it. People describe their goals in free text boxes, and the page URL itself may name the procedure. Treat any form on a procedure page as a potential intake channel.
Are WordPress form plugins HIPAA compliant?
The plugin is only one part. Submissions usually sit in your website database and hosting environment, so your host would also need to support HIPAA workloads and sign an agreement. Most standard hosting plans do not.
Do we need patient consent before collecting information through a form?
HIPAA governs how you protect and use the information once you hold it. What you need to tell people at collection is covered by your Notice of Privacy Practices and any state privacy law that applies, so link to your privacy notice beside the form.
What if a patient emails us medical details instead of using the form?
HHS has said providers can generally assume email is acceptable to a patient who initiates contact that way. Move the details into your secure system and avoid replying with more clinical detail than necessary.
How often should we review our forms?
Review them whenever you add a vendor, change your website platform or launch a new campaign landing page, and at least once a year as part of your security risk analysis.
This article is general information only and is not legal or regulatory advice. It summarises the HIPAA Security Rule, HHS guidance on cloud computing and the January 2025 proposed Security Rule update, which is a proposal only, as published at the time of writing. It does not address state privacy law or platform policies, which can impose further requirements. Regulatory guidance changes, and how it applies depends on your circumstances. Confirm your obligations with a qualified adviser before relying on any of it.
References
- National Institute of Standards and Technology. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST SP 800-66r2). csrc.nist.gov
- Security Standards: Technical Safeguards, 45 C.F.R. § 164.312. ecfr.gov
- U.S. Department of Health and Human Services. (2025, January 6). HIPAA Security Rule to strengthen the cybersecurity of electronic protected health information (Proposed rule). Federal Register, 90(3), 898. govinfo.gov
- U.S. Department of Health and Human Services, Office for Civil Rights. (n.d.). Guidance on HIPAA and cloud computing. hhs.gov
About the author
Dr Sandy Adel · Content Strategist, ContentClicks
Sandy is a practising dentist with a Bachelor of Dentistry from Alexandria University and over eight years of clinical experience in general dentistry. She brings that firsthand clinical knowledge directly to her writing, so the content she produces for dental and medical audiences is accurate at the clinical level before it is optimised for anything else.
Before joining ContentClicks she spent more than four years writing dental copy for practices across the Australian, US and UK markets, including two years as a dental copywriter at one of Australia's specialist healthcare marketing agencies. She writes about ethical marketing, realistic patient expectations, and the gap between what clinics promise and what biology can guarantee. More from Sandy.
