HIPAA and Your Website Forms: Where PHI Leaks Online

A practice website feels harmless, but it can quietly send patients' health information to third parties that should never have it, through tools most practices never think about. The leaks are usually invisible, unintentional, and entirely preventable, once you know where they are. This is not legal advice, but it will show you the common gaps and how to close them.

Where PHI actually leaks

Protected health information escapes a website through a handful of predictable channels, and the biggest is the one practices notice least. Tracking pixels and analytics on pages that collect health information: a Meta Pixel or analytics script on your appointment-request or intake page can capture what the patient enters and transmit it to a third party, which is the classic leak. Unsecured web forms: a contact or intake form that collects health details and sends them by plain email or to a backend without proper safeguards. Third-party embeds: chat widgets, scheduling tools, and other embedded services that receive patient information without a business associate agreement in place. And trackers on authenticated pages: analytics or pixels running on patient-portal or logged-in pages, where the data is clearly tied to an individual. The common thread across all four is the same: identifiable health information reaching a company that has no right to it and no agreement to protect it. That is the leak, and it usually happens by default, not by decision.

What the current rules say

The regulatory picture shifted recently, and getting it right matters, so here is the accurate version. In December 2022, HHS guidance warned that online tracking technologies on healthcare sites could result in impermissible PHI disclosures HHS online tracking. Then in June 2024, a federal court vacated part of that guidance, specifically the position that an IP address combined with a visit to an unauthenticated public webpage about a health condition or provider automatically counts as protected health information, and HHS did not appeal. The court's point was that identity plus a page visit does not, by itself, prove a person has a condition. So the broad theory that any tracking on a general health-information page is a HIPAA problem no longer holds. That is genuine relief for passive analytics on public, informational pages. But, and this is the part that matters, the ruling was narrow, and it left the real risks fully intact, which is the next section.

What is still risky

The 2024 ruling narrowed one theory; it did not give a green light. Several things remain clearly risky. Trackers that capture form submissions: if a pixel or analytics tool captures the health information a patient actually enters into a form, that is a disclosure of PHI, untouched by the ruling. Trackers on authenticated pages: analytics on patient-portal or logged-in pages, where data is tied to a known individual, remain a clear exposure. Third-party tools without a BAA: any vendor whose tool receives PHI still needs a business associate agreement. And crucially, other laws apply regardless of the HIPAA analysis: the FTC enforces against sharing identifiable health information through tracking tools without consent, and has taken real action doing so, while state privacy laws add their own requirements. So even where the HIPAA question is now murkier, the FTC and state law can still reach the same conduct. The honest summary: the ruling reduced one specific risk on public info pages, but the core danger, PHI reaching third parties through forms, portals, and embeds, is unchanged, and the safe posture is unchanged too.

How to close the gaps

Closing the leaks is concrete work, not a mystery. Audit what trackers run, and where: inventory every pixel, analytics tag, and third-party script on your site and note which pages they run on, because you cannot fix what you have not found. Keep trackers off the pages that collect health information and off authenticated portal pages, which removes the highest-risk exposures directly. Get a business associate agreement from any vendor whose tool touches PHI, your form provider, scheduling tool, chat widget, hosting where applicable, and do not use tools that will not sign one. Use HIPAA-compliant form and scheduling tools designed to handle PHI properly, rather than generic ones that send data to plain email or non-compliant backends. And keep PHI out of third-party trackers as the governing rule: if a tool that has not signed a BAA could receive identifiable health information, that is the leak to close. This is the same chart-numbers-only, PHI-aware discipline the whole practice should run on, applied to the website, and it is covered for your internal tools in the HIPAA-safe project management guide. Because the law here is evolving and varies by state, confirm your specifics with a qualified healthcare attorney; this guide points you at the gaps, not at legal conclusions.

The 10-minute tracker check

You do not need a consultant to find the most common leaks; a quick self-check surfaces most of them. First, list your key pages, especially any with a form, your appointment request, contact, intake, and patient portal. Then, on each, find out what third-party scripts are running. A free browser-based tracker-detection extension will list the pixels and analytics on a page in seconds, or a developer can check the page source and network activity. Pay special attention to the form and portal pages: any advertising pixel or general analytics tool running there is your highest-priority concern. Next, list your third-party tools, the form provider, scheduling widget, chat tool, and hosting, and for each ask whether it could receive patient information and whether you have a business associate agreement with that vendor. Anywhere a tool that could see PHI has no BAA is a gap to close. This check takes about ten minutes for a small site and tells you most of what you need: which trackers run where, and which vendors touch data they should not. It will not replace a formal review by counsel, but it will catch the obvious leaks, which are the ones most likely to be open right now.

Why this is a trust issue

Beyond compliance, this is about the trust a practice runs on. A patient who fills out your form or uses your portal is handing you sensitive information on the assumption that you will protect it, and a website that leaks that information to advertisers or unvetted third parties breaks that assumption, whether or not it triggers a penalty. Getting this right is therefore part of being the kind of practice patients can trust, not just avoiding a fine. It is also, frankly, where most template and agency-built medical sites fall short, because they bolt on the usual pixels and widgets without thinking about PHI, which is one reason a website built with compliance in mind, a real front door rather than a generic template, is worth the difference. The standard is not complicated: know what runs on your site, keep patient health information out of third-party hands, and get agreements from the vendors that legitimately need access. Do that, and your website stops being a quiet liability and becomes what it should be, a front door that protects the people who walk through it. The broader website work sits in the website audit and the AI search guide.

Where to go next

• HIPAA, ClickUp, Monday and Asana: The PHI-Safe Setup (Chart Numbers Only) live

  Run ClickUp, Monday, or Asana in a HIPAA-safe way: keep PHI out with the chart-numbers-only.

• 75% Never Book: Run the 15-Minute Website Leak Audit live

  A 15-minute medical website leak audit: find the booking, mobile, speed, and clarity leaks.

• ChatGPT Is Recommending Doctors Now. Is Your Practice Visible? live

  AI search for medical practices: how ChatGPT recommends doctors, what AEO is, and how to.

Frequently asked questions

Sources

1. HHS online tracking. hhs.gov