Blog · 29 Oct 2026 · 5 min read

Clinic website compliance basics: HIPAA-safe forms in the US, PIPEDA in Canada

A clinic website collects more personal information than most owners realise. The contact form asks for a name and phone number, the booking widget asks what the appointment is for, and the analytics and advertising scripts quietly record which pages each visitor viewed. For a dental practice, physio clinic or medical spa, some of that is health information, and health information is treated differently by privacy law in every country we work in.

This article is a plain-language starting point, not legal advice. It covers the questions to ask about your own site, with links to the official guidance in the US, Canada, Australia and the UK. If your situation is complex, talk to a privacy lawyer or your professional body.

The three places clinic websites leak data

Forms. Contact, enquiry and "request an appointment" forms that ask for symptoms, conditions or the reason for a visit, then email it unencrypted or store it in a general-purpose form tool.
Booking widgets. Third-party scheduling tools embedded in your pages. Some are designed for healthcare and offer the agreements you need; many generic ones aren't.
Tracking scripts. Analytics tags, advertising pixels and session-replay tools that can capture page addresses, button clicks and sometimes form contents, and send them to the vendor.

United States: HIPAA and the tracking bulletin

If your practice is a HIPAA covered entity (most providers who bill insurance electronically are), information collected through your website can be protected health information (PHI). The US Department of Health and Human Services' Office for Civil Rights published a bulletin on the use of online tracking technologies by HIPAA covered entities. Its key points:

Tracking on logged-in pages such as patient portals generally has access to PHI and must comply with the HIPAA Rules.
On public pages, tracking that captures what someone types or selects when booking an appointment (for example their email address or the reason for the visit) can be a disclosure of PHI.
A tracking vendor that receives PHI is generally a business associate, which means you need a business associate agreement (BAA). Mentioning the vendor in your privacy policy isn't enough, and a cookie banner isn't a HIPAA authorization.

One important update: in June 2024 a federal court in Texas vacated part of that guidance, specifically the idea that an IP address combined with a visit to a public page about a health condition is enough on its own to trigger HIPAA. HHS notes this at the top of the bulletin. The rest of the guidance, including the points above about forms, booking and portals, still stands.

Practical steps for US clinics:

Don't ask for symptoms, conditions or insurance details in a general contact form. Ask for name, contact details and preferred time, and collect the rest in your HIPAA-covered practice system.
Use a booking or intake tool that will sign a BAA if it handles appointment reasons or patient data.
Remove advertising pixels from booking, intake and portal pages, or use a vendor that will sign a BAA.
Configure analytics so it never receives form contents. Google's guidance on avoiding personal information in Analytics is a useful baseline, though Google Analytics itself is not generally offered with a BAA.

Practices that aren't covered by HIPAA, such as some cash-pay med spas, may still fall under the FTC Act and state health-privacy laws, so the same habits are sensible.

Canada: PIPEDA and provincial health laws

Private-sector clinics in Canada are generally covered by the Personal Information Protection and Electronic Documents Act (PIPEDA), unless a provincial law that is substantially similar applies instead. Several provinces have health-specific laws; Ontario's PHIPA, for example, is overseen by the Information and Privacy Commissioner of Ontario.

PIPEDA is built on ten fair information principles. The ones that matter most for a website are:

Identifying purposes and consent: tell people why you're collecting each piece of information, and get meaningful consent, which should be express for sensitive information such as health details.
Limiting collection: only ask for what you need to book or reply.
Safeguards: protect information in line with its sensitivity, including in third-party tools.
Openness: have a clear, findable privacy policy.

The Privacy Commissioner treats health information as particularly sensitive; see its page on health, genetic and other body information. For a clinic website, that points to the same practical rule as in the US: keep health details out of generic forms and marketing tools.

Australia: the Privacy Act and the APPs

Health service providers in Australia are generally covered by the Privacy Act 1988 regardless of turnover, because health information is "sensitive information". The Australian Privacy Principles require a clearly expressed privacy policy, collection notices, consent for collecting sensitive information, and reasonable security. If you use overseas tools (many booking and analytics vendors are US-based), the cross-border disclosure principle applies too.

United Kingdom: UK GDPR special category data

In the UK, health data is "special category data" under the UK GDPR. You need a lawful basis and an additional condition to process it. The ICO's guidance on special category data explains the conditions. The cookie and tracking rules come from PECR: non-essential cookies, including most analytics and advertising tags, need consent before they're set.

A form design that works everywhere

Because the rules differ, the simplest approach is a website that collects as little sensitive information as possible:

Contact form: name, email or phone, preferred time, and a short optional message, with a line saying "Please don't include medical details".
Booking: a link or embed from a healthcare-grade booking system that offers the agreements your country needs (a BAA in the US, a data-processing agreement elsewhere).
Intake forms: inside your practice software, not on the public website.
Transport security: HTTPS everywhere, which any modern host provides free.
Tracking: analytics on informational pages only, set up to collect counts rather than personal details; no advertising pixels on booking or intake steps.
Privacy policy: written for your actual tools and country, linked from every form.
Accessibility: labelled fields and clear errors (see the W3C forms tutorial), which also helps patients complete the form.

Questions to ask your web developer

Which third-party scripts load on our booking and contact pages, and what do they send?
Where do form submissions go, and who can read them?
Does our booking tool sign a BAA or data-processing agreement?
Is any form field or page address sent to analytics or ad platforms?
Does our privacy policy match what the site actually does?

Every site we build for clinics starts from this minimal-collection approach. See our dental and medical clinic websites and chiropractor and physio websites, or read health advertising rules for website copy for the content side of compliance.

This article is general information, not legal advice. Rules change; check the linked official sources.

Get a free demo of your new site