Resources
HIPAA-safe website forms: what healthcare practices get wrong
Marketing forms and clinical intake are not the same job. Here’s what practices get wrong — and how we keep public sites useful without dumping patient details into the wrong tools.
Marketing forms and clinical intake are not the same job. Practices get burned when a “Contact us” or “Request assessment” form on the public site asks for too much — and then pipes those answers into a generic inbox, CRM, or form tool that was never meant to hold patient details.
Short version: use the website to start the conversation. Keep detailed intake inside the systems your team already trusts for care.
What usually goes wrong
- The form asks like an intake packet. Diagnosis history, insurance member IDs, and clinical notes don’t belong on a marketing form “because it’s convenient.”
- The destination is unclear. Submissions land in a shared Gmail, a random SaaS form account, or a tool with no business associate agreement.
- Nobody owns the follow-up path. Leads sit while clinical staff treat the form like an EHR — or marketing staff treat PHI like a newsletter signup.
We’ve cleaned this up on ABA and telehealth sites where the public form was trying to do the whole admissions job. The fix is almost always the same: shorten the public form, clarify what happens next, and send real intake to the right system.
A practical checklist
- Collect only what you need to reply: name, email or phone, location or program interest, optional short note.
- Say on the form what not to include (no detailed medical history).
- Route marketing leads to the people who respond — not a black hole.
- Put clinical intake in CentralReach, SimplePractice, Jane, or whatever your team already uses under the right agreements.
- Review new tools before they touch patient data. Convenience is not a HIPAA strategy.
Takeaway
A site can still convert without becoming a shadow EHR. Clear CTAs and short forms get families and clients onto a real follow-up path. If you’re unsure whether your current forms are doing too much, send the URL — we’ll flag the risky fields as part of a free search review.
Quick answers
Can a marketing site collect any patient information?
Keep public forms to the minimum needed to follow up — name, email, phone, general reason for reaching out. Detailed clinical intake belongs in your practice tools.
Are third-party form builders automatically HIPAA-safe?
No. If a tool isn’t covered by your BAAs and workflow, don’t put PHI there. We configure marketing forms so they don’t become a clinical dump.
Austin · Founder, Cincinnati
Builds and looks after websites for healthcare, insurance, and ABA practices.
Want a clearer look at your search footprint?
Send your site. We’ll send back a free search review — what’s working, what to fix first, and whether a monthly plan even makes sense.