1. Map where patient information can enter
List every form: contact, appointment request, intake, prescription refill, bill pay, careers
A general contact form becomes a PHI risk as soon as people describe symptoms or conditions in it, which they do.
List every embedded tool: scheduling, chat, patient portal link, telehealth, reviews widget, payment
List every script and pixel: analytics, ad pixels (Meta, Google Ads, TikTok), heatmaps, session recording, tag manager
For each, note where the data goes and which vendor receives it
2. Business Associate Agreements
BAA signed with the form or intake provider that stores submissions
BAA signed with the scheduling, chat and telehealth vendors that receive patient details
BAA signed with the hosting provider if submissions are stored on your web server or database
BAA signed with the email service that delivers or stores form notifications containing patient information
Your web agency or developer signs a BAA if they can access submissions, backups or the database
Tools that will not sign a BAA are removed from any page or flow that can carry patient information
3. Forms
Forms submit over HTTPS only
Submissions are stored in a HIPAA-eligible system, not sent in full by regular email
A safer pattern: the notification says 'new request received' and staff log in to the secure system to read it.
General contact forms ask people not to include medical details, and route clinical questions to the portal or phone
Only the fields you actually need are collected
Access to submissions limited to staff who need it, with individual logins and 2FA
Retention period defined, and old submissions deleted on schedule
4. Tracking technologies
HHS Office for Civil Rights issued guidance on online tracking technologies in December 2022 and updated it in March 2024. In June 2024 a federal court (American Hospital Association v. Becerra, N.D. Tex.) vacated the part of that guidance covering unauthenticated public pages. The rules for authenticated pages, and for any tracking that does capture PHI, still apply.
No third-party ad or analytics pixels on patient portal, logged-in, intake or appointment pages
This is the highest-risk area. Hospital systems have settled class actions over pixels on pages like these, and the FTC has brought cases against health companies for sharing health data with ad platforms.
Tag manager rules reviewed so pixels cannot fire on those pages by accident
Form field contents are never sent to analytics or ad platforms (check for 'enhanced conversions' or automatic form capture)
Conversion tracking on appointment flows uses a HIPAA-eligible analytics vendor with a BAA, or server-side tracking that strips identifiers
Session recording and heatmap tools excluded from pages with forms or portals
Tracking decisions for public pages reviewed with counsel, given the unsettled legal position
5. Hosting, security and access
Valid SSL on every page, with HTTP redirected to HTTPS
CMS, plugins and themes updated on a schedule; unused plugins removed
Admin accounts are individual (no shared logins), with strong passwords and 2FA
Backups encrypted, and backup storage covered by a BAA if backups contain submissions
Web application firewall and malware scanning in place
Access removed promptly when staff or vendors leave
6. Policies and patient-facing pages
Notice of Privacy Practices published and linked in the footer
Website privacy policy accurately describes the tools actually installed
Accessibility: forms and booking flows usable with a keyboard and screen reader (WCAG 2.2 AA)
Documented review of this checklist, with date and reviewer, repeated at least yearly and after any website change