Your website and patient privacy: a checklist for practices

Most privacy problems on a practice website do not come from a break-in. They come from ordinary tools doing what they were built to do: a form that emails its contents, a tracking script that reports page visits, a chat widget that stores transcripts. This checklist covers where patient information tends to leak and what to ask about each. It is general guidance and not legal advice. Your compliance counsel should confirm how the rules apply to your practice.

Start with an inventory of every place information enters or leaves

You cannot review what you have not listed. Before judging any single tool, write down everything on the site that collects, sends or stores information.

• Every form, including appointment requests, contact forms, newsletter signups and intake paperwork
• Every third-party script, such as analytics, ad pixels, heat maps, session recording and embedded video or maps
• Every messaging channel, including chat, texting and email
• Every place the data ends up, such as inboxes, the website database, spreadsheets, plugins and backups

For each item, note which vendor is involved and whether that vendor will sign a business associate agreement. Whether one is required in a given case is a question for your counsel, but a vendor that refuses to sign one tells you something useful.

Contact and intake forms

A form that asks for a name and a reason for the visit is collecting health information tied to an identifiable person. The common weak points are behind the form, not on it.

• Where submissions go. Many forms send the full contents to a standard email inbox and also save a copy in the website database. Both locations need to be handled with HIPAA requirements in mind.
• What you ask for. Collect only what you need to schedule or respond. A free-text box labeled with a prompt to describe symptoms invites more detail than a callback requires.
• Who can see it. Check which staff, former staff and outside contractors have logins to the website or the form tool.
• How long it stays. Old submissions sitting in a website database are a risk with no benefit. Set a retention practice and follow it.

Full intake paperwork usually belongs in your patient portal or your electronic health record vendor's tools, not in a general website form plugin.

Tracking pixels and analytics

This is the area that has drawn the most regulatory attention in recent years, and it is the one practices most often overlook. Analytics and advertising scripts can send a visitor's page address, device details and IP address to a third party. On a page about a specific condition or treatment, or on an appointment request page, that combination may reveal something about a person's health.

• Ask your web team for a list of every script that loads on the site, and on which pages.
• Pay closest attention to appointment pages, forms, patient portal login pages and pages for sensitive services such as hormone therapy or weight loss.
• Check whether advertising pixels fire on form confirmation pages, where they can report that a specific visitor submitted a request.
• Ask whether session recording or heat map tools capture what people type into forms.
• Remove scripts nobody is using. Old pixels from past campaigns often stay in place long after the campaign ends.

Federal guidance on tracking technologies has changed over time and has been challenged in court, so this is a point to review with your counsel and not to settle on your own.

Chat, texting and email

Patients will share health details in whatever channel is open to them, whether or not you intended it for that purpose.

• Chat tools. Find out where transcripts are stored, who can read them and whether the vendor uses them for its own purposes. If the chat uses AI, it should handle scheduling and general questions only. AI agents should never give medical advice, and a person should review how the tool responds.
• Texting. Appointment reminders and two-way texting should run through a platform chosen with HIPAA requirements in mind, not staff personal phones. Keep message content minimal and document patient consent as your counsel advises.
• Email. Confirm whether your email service is set up for health information and whether auto-replies or form notifications repeat what the patient wrote.

Review replies and testimonials

A patient may describe their visit in a public review. The practice may not confirm it. Even a warm reply such as thanking someone for coming in acknowledges that the reviewer is a patient.

• Keep replies general. Speak about practice policies, not about the individual.
• Move any specific complaint offline by inviting the reviewer to call the office.
• Never correct the clinical record in public, even when a review is inaccurate.
• Get written authorization before publishing testimonials, photos or before-and-after images, and keep it on file.

Backups, old copies and access

Website backups contain everything the site contains, including stored form submissions. So do staging sites, old hosting accounts and exported spreadsheets.

• Know where backups are kept, whether they are encrypted and who can download them.
• Shut down old versions of the site and former hosting accounts after a redesign.
• Remove logins when staff or vendors leave, and require individual accounts with two-factor authentication.
• Keep plugins and the site platform updated, since outdated software is a common entry point.

Repeat this review on a regular schedule and whenever you add a tool, change vendors or launch a new campaign. At Rx Medical Web, we build and review practice websites with HIPAA requirements in mind, and we still advise every practice to have its own counsel or compliance contact confirm the final setup.

This article is general information for medical practices. It is not legal or medical advice.