HIPAA-compliant forms on a healthcare website

A form is not HIPAA compliant on its own. The HIPAA technical safeguards are written as duties that “a covered entity or business associate must” meet (45 CFR 164.312). So the real question is whether your organization, and every vendor that handles a submission, meets those duties for the information the form collects. Decide what the form collects before you choose a form tool. A general inquiry form, an appointment request and a clinical intake carry different obligations and need very different build scopes.

We recommend working through four steps in this order:

1. Decide what the form collects
2. Map every place a submission travels
3. Confirm business associate agreements
4. Get review from your own counsel

This guide is for healthcare companies and care providers. It separates what the regulation text says from our recommendations, and it is not legal advice. Health Site Works does not guarantee compliance outcomes, and nothing here replaces review by your counsel or privacy officer.

What the regulation covers

Three definitions in 45 CFR 160.103 shape most form decisions:

• Covered entity means a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a covered transaction.
• Protected health information is individually identifiable health information that is transmitted or maintained in electronic media or any other form, with listed exclusions. Individually identifiable health information includes demographic information collected from an individual that is created or received by a provider, plan, employer or clearinghouse, relates to health, the provision of care or payment for care, and identifies the person or could reasonably be used to identify them.
• Business associate covers a person who, on behalf of a covered entity and other than as a workforce member, “creates, receives, maintains, or transmits protected health information” for a regulated function. It also includes a subcontractor doing the same on behalf of a business associate.

Those four verbs map neatly onto a website form. Under 45 CFR 164.504, a business associate contract must establish permitted uses and disclosures, require appropriate safeguards, require reporting of uses or disclosures the contract does not allow, require subcontractors to agree to the same restrictions, and provide for return or destruction of the information at termination if feasible. The security rule adds that the contract must state the business associate will comply with the applicable requirements, flow them down to subcontractors and report security incidents it becomes aware of (45 CFR 164.314).

The technical safeguards section lists standards for access control (including unique user identification, marked required, and encryption and decryption, marked addressable), audit controls, integrity, person or entity authentication, and transmission security, which includes an addressable encryption specification (45 CFR 164.312). In our view, a padlock in the browser speaks to only the transmission part of that list.

Not every healthcare company is a covered entity. The FTC’s Health Breach Notification Rule applies to vendors of personal health records, PHR related entities and third party service providers, and it does not apply to HIPAA-covered entities or to an entity acting as a business associate of one (16 CFR 318.1). Its definitions of personal health record and related terms are specific (16 CFR 318.2), so whether it reaches your product is a question for counsel.

Three kinds of website forms

Sort each form on your site into one of these groups before choosing any tool.

Inquiry form with no health details

Contact forms, demo requests from hospital buyers, partnership inquiries and job applications usually need a name, organization, email and a short message. We recommend designing them so they do not invite health details: no box asking visitors to describe a condition, a short note above any free-text field asking people not to include medical information, and a clear link to the right channel for patients. A note reduces the chance someone types health details anyway, but it cannot prevent it, so the vendor questions below still matter if the submitter could be a patient.

Appointment request form

For a provider, a request that pairs a name and phone number with a reason for visit, preferred clinician or insurance plan can fall within the definitions above, because it is received by a health care provider and relates to the provision of care to an identifiable person (45 CFR 160.103). We recommend treating these as potentially carrying protected health information unless your counsel concludes otherwise, and keeping fields to the minimum your front desk needs to call the person back.

Sensitive intake in a dedicated system

Medical history, symptoms, medication lists, insurance card uploads and consent forms belong in a system chosen for that job, ideally one your practice management or clinical team already uses. The website’s role is to explain the step and link to it clearly. Health Site Works treats clinical systems, patient portals and sensitive intake as separate scope that needs provider review, rather than something folded into a marketing build.

Every place a submission travels

A form is a chain of services. We recommend drawing that chain for each form before signing anything, because each link may create, receive, maintain or transmit what the visitor typed.

1. The form tool that receives the submission: a hosted form builder, the website platform’s own form, or a plugin.
2. Where submissions are stored: the vendor dashboard, your website database, a spreadsheet or a CRM. Ask how long entries are kept and who can export them.
3. Notification emails and connected tools: if each submission is emailed to a shared inbox, that inbox and its email provider join the chain. The same goes for automations that push entries into scheduling, marketing or messaging tools. We recommend notifications that say only that a new submission arrived.
4. Scripts running on the page: analytics, advertising, chat and session tools loaded on a form page. Ask each script’s vendor what it collects from that page, and remove anything you cannot account for from pages that collect health information.

Because the business associate definition includes subcontractors (45 CFR 160.103), ask each vendor which other companies handle your submissions behind its product.

Questions to ask a form vendor

These are our recommended questions. They follow the provisions cited above, but a yes to every one is not a compliance determination.

• Will you sign a business associate agreement, and on which plans? Get the answer from the vendor’s own terms, in writing.
• Does each staff member get a separate login? The safeguards list unique user identification as required (45 CFR 164.312).
• Is there an activity record showing who viewed or exported entries? The same section includes an audit controls standard.
• How are submissions encrypted in transit and in storage, and does the agreement cover both?
• Can email notifications exclude field contents?
• Which subprocessors handle submissions?
• What happens to entries when we cancel? Contract terms must address return or destruction at termination if feasible (45 CFR 164.504).
• Can entries be deleted automatically after a period we choose?

WordPress, Webflow and Framer

Below, documented platform features come first, followed by our recommendations. None of the cited documentation says whether a platform signs business associate agreements, so ask each vendor directly about the plan you intend to use.

WordPress

Documented: WordPress uses roles so a site owner can control what users can do, ships with six predefined roles, and gives an Administrator access to all administration features within a single site. The documentation advises granting only the capabilities a role needs, and warns that unfiltered_html lets a user post HTML or JavaScript and that enabling it for untrusted users may result in malicious or poorly formatted code (WordPress roles and capabilities).

Our recommendation: if a form plugin stores entries in the WordPress database, confirm which roles can view them, keep Administrator accounts few, and avoid giving editors script-level access on pages that host forms. Sending sensitive forms to an external service under a business associate agreement, and storing nothing in WordPress, is often simpler to govern.

Webflow

Documented: Webflow describes a CMS Collection as a database where you store content to reference throughout your site, such as blog posts, and notes that site managers on Enterprise plans or partners can limit which members can edit a Collection (Webflow Help Center).

Our recommendation: keep personal submissions out of CMS Collections, which are built for publishable content, and route sensitive forms to a dedicated tool.

Framer

Documented: Framer states that plugins can read and write to the Framer CMS, that any kind of Collection can be read from, and that Managed Collections are controlled by plugins to sync data with a third party (Framer Developers).

Our recommendation: do not store form submissions in Collections, and review installed plugins on any project with health-related forms.

We match the platform to the organization, its audiences and its publishing needs, and treat sensitive form handling as its own decision. Our services page describes the build work across all three platforms.

Who is responsible for what

This is our recommended split, not a legal allocation.

Party	Responsibilities
Your organization	Determine whether you are a covered entity or business associate, choose and sign vendor agreements, approve form fields, set staff access and train the people who read submissions.
Form or intake vendor	Operate its service under the agreement it signs and answer questions on storage, access records, subprocessors and deletion.
Website designer and developer	Build the pages, embed or link the chosen tool, keep unneeded scripts off form pages and document the data path.
Counsel or privacy officer	Review form classification, agreements and the final setup before launch.

Whether a web designer is a business associate depends on whether it creates, receives, maintains or transmits protected health information on your behalf (45 CFR 160.103). We recommend builds where the designer never has access to submissions, and asking counsel to confirm.

Two hypothetical scenarios

Hypothetical one: a two-location outpatient practice wants a “book a consult” form that asks for the patient’s concern and a photo upload. Following our recommendations, the website form would collect name, phone, location and preferred time, carry a note asking visitors not to include medical details, and post to a vendor under a signed agreement with content-free notifications. The concern and photo would move to the practice’s dedicated intake system, linked after the call. The tradeoff is one extra step for patients in exchange for a much shorter data path on the website.

Hypothetical two: a company selling scheduling software to clinics wants a demo request form. The submitters are clinic managers, so the form asks only for business contact details and clinic size, with no health fields. Tool choice and marketing integrations are lighter here, but we would still keep a note on the free-text field and ask counsel whether any customer data flows through the website.

Forms during a redesign or migration

Redesigns often replace old form pages. Google recommends mapping old URLs to new ones, using server side permanent redirects, and not redirecting many old URLs to one irrelevant destination such as the home page; it also says to expect temporary ranking fluctuation during significant changes (Google Search Central). We cannot promise rankings stay unchanged.

We recommend inventorying every form, including those on forgotten landing pages, redirecting each retired form page to its true replacement, and closing old vendor accounts only after entries are returned or deleted under the contract terms.

Scope tradeoffs

• Inquiry-only site with links to existing systems: the smallest scope and the shortest data path, with patients sent to tools you already run.
• Site with an appointment request form: more design and review work, plus a vendor agreement your organization signs and owns.
• Sensitive intake or portal work: separate scope with provider review, planned apart from the marketing build.

Pricing is set case by case after scoping, with no public rate card; see how pricing works. Submitting our contact form starts an inquiry, not a booking. More planning guides are in Insights.

FAQs

Does an SSL certificate make a form HIPAA compliant?

No single setting does. Transmission security is one standard among several in 45 CFR 164.312, alongside access control, audit controls, integrity and authentication, and contracts are a separate requirement.

Can we use our website builder’s built-in form?

Ask the platform whether it signs a business associate agreement for your plan and how submissions are stored. If the answer is unclear and the form may carry health information, we recommend a dedicated tool.

Does our web designer need to sign a business associate agreement?

That depends on whether the designer handles protected health information on your behalf. Ask counsel, and prefer setups where the designer has no access to submissions.

We are a health tech company, not a provider. Does HIPAA apply?

It depends on whether you are a covered entity or a business associate. If neither, other rules such as the FTC’s Health Breach Notification Rule may apply depending on its definitions (16 CFR 318.1).

Will Health Site Works certify our forms as compliant?

No. We design and build the website and help plan where forms live, but we do not guarantee compliance outcomes. Final review belongs with your counsel or privacy officer.