A dental website form becomes a HIPAA problem when it collects health information for your practice and passes it to a vendor that hasn't signed a business associate agreement (BAA). Keep general contact forms free of clinical details, run appointment requests and intake only through vendors that sign a BAA, and keep ad pixels and Google Analytics off patient portals, booking flows and any page where patients enter health information.
The rules shifted in 2024. A federal court struck down part of the Department of Health and Human Services' (HHS) guidance on tracking technologies, and many dental marketing articles still quote the original 2022 bulletin as if nothing happened. This guide explains what changed and what didn't, and adds the Connecticut consumer-health-data rules that matter for some Fairfield County and Westchester practices. It's practical guidance, not legal advice; your compliance advisor has the final say.
When does a website form collect PHI?
HIPAA protects individually identifiable health information held by covered entities and their business associates. A dentist is a covered entity if the practice transmits health information electronically in connection with standard transactions, such as electronic insurance claims or eligibility checks (45 CFR 160.103). Most practices that bill insurance electronically qualify, and once they do, the rules apply to all of the practice's health information, not only claims.
So a form that asks a new patient for a name, a phone number and "reason for visit: cracked molar, a lot of pain" is very likely collecting PHI the moment your practice receives it. The same is true of insurance details, medical history and anything a patient types into a free-text box. Every vendor that receives, stores or transmits that submission on your behalf is a business associate.
Contact form vs appointment request vs intake form
Not every form carries the same risk. Sort yours into three types and treat each accordingly:
| Form | Typical fields | Risk | What to do |
|---|---|---|---|
| General contact | Name, email, short message | Lower, but free text can still capture health details | Tell visitors not to include medical information, and still route submissions through a vendor that signs a BAA if patients use it for clinical questions |
| Appointment request | Name, phone, reason for visit, insurance, preferred time | Likely PHI | Use a form or scheduling tool whose vendor signs a BAA; no ad pixels or analytics tags on the page |
| New-patient intake | Medical history, medications, allergies, insurance ID | PHI | Keep it inside your practice-management or intake software, behind a login, under a signed BAA |
Which website vendors need a BAA?
Any vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate and needs a signed BAA before it touches patient data. On a typical practice website, check each of these:
Form builders and scheduling tools
The obvious ones. Use the vendor's healthcare plan and get the BAA in writing; a standard terms-of-service page isn't one.
Your website host or CMS
If form submissions are stored in the site's database, the host holds PHI. The simpler fix is often to not store submissions on the web server at all.
Email delivery
Notification emails that include the full submission put PHI in inboxes and email providers. Send "New request received, log in to view" instead.
Chat widgets, call tracking and CRMs
Chat transcripts, recorded calls and CRM records of patients are PHI once they include health details.
Analytics
Google states that it makes no representation that Google Analytics satisfies HIPAA, doesn't offer BAAs for it, and tells customers not to place Analytics tags on authenticated pages or on HIPAA-covered pages related to providing care.
Tracking pixels after AHA v. Becerra
In December 2022, HHS's Office for Civil Rights issued a bulletin on online tracking technologies. One part said that an IP address combined with a visit to a public, unauthenticated page about specific health conditions or providers could be PHI. On June 20, 2024, the U.S. District Court for the Northern District of Texas, in American Hospital Association v. Becerra, held that HHS exceeded its authority and vacated that part, which the court called the "Proscribed Combination." HHS withdrew its appeal on August 29, 2024, so the ruling stands.
What that changed: a public page about dental implants carrying an analytics tag is no longer treated as disclosing PHI merely because a visitor's IP address was recorded there. What it didn't change: tracking on authenticated pages such as patient portals, and on pages where patients submit health information, such as appointment requests and intake, remains squarely within HIPAA. Legal commentators have also noted open questions about pages like online scheduling, so the conservative line is the one Google's own guidance draws: no tags where care is requested or delivered.
Leaks that audits usually find
Thank-you pages whose URLs include form answers (for example "?service=implant"), which then flow into analytics; ad pixels firing on booking steps; session-recording tools capturing typed form fields; and conversion events that send the form's contents rather than a simple "form submitted" count. Each is fixable in an afternoon once someone looks.
Does Connecticut's consumer health data law apply to your practice?
Connecticut added consumer-health-data protections to its Data Privacy Act in 2023. Under C.G.S. § 42-526, any business doing business in the state, regardless of size, may not sell consumer health data without consent, may not use a geofence within 1,750 feet of a mental health or reproductive or sexual health facility to target people, and must bind staff, contractors and processors to confidentiality and data-processing terms.
The detail many summaries miss: HIPAA covered entities and business associates are exempt from those provisions (§ 42-526(b)) and from the broader Act (§ 42-517(a)), and protected health information is exempt data. So a dental practice that bills insurance electronically is governed by HIPAA, not by Connecticut's health-data rules. A cash-only cosmetic practice or a med spa that isn't a HIPAA covered entity is the opposite case: Connecticut's consumer-health-data rules apply to it whatever its size, and since July 1, 2026, the Act's general duties also reach any business that processes sensitive data (Public Act 25-113). If that's you, see our notes for med spa websites.
A compliant website stack for a small practice
Public pages
Fast, accessible service and team pages with privacy-conscious analytics, configured so nothing personal or health-related is collected.
Forms
A HIPAA-eligible form vendor under a signed BAA, or your practice-management system's own request form embedded on the site.
Scheduling
An online scheduling tool that integrates with your practice software and whose vendor signs a BAA.
Notifications
Alert emails without patient details; staff log in to the vendor to read submissions, with multi-factor authentication on.
Tag inventory
A written list of every script on the site and the pages it runs on, reviewed whenever a marketing tool is added.
Paperwork
Signed BAAs on file for every vendor that handles patient data, and a record of who reviewed the tag inventory and when.
Checklist: a 30-minute website HIPAA review
Open your site in a private browser window with your browser's developer tools on the Network tab, and walk through it as a new patient would. Note every third-party request on the booking and form pages. Submit a test request with dummy data and check where it lands: the vendor's dashboard, your inbox, the website database. Confirm a signed BAA exists for each of those destinations. Remove any ad pixel or analytics tag from booking, form and portal pages, and strip form answers out of thank-you URLs.
If the review turns up more than you want to fix in place, a rebuild can be the cleaner path. Our dental practice website and medical practice website services can set up forms and analytics this way from the start, with business websites starting at $2,500. Practices that need a patient portal or app should read our overview of healthcare and fintech app development; custom software starts at $10,000. And since HHS-funded practices face a separate accessibility deadline, see our guide to Section 504 web accessibility deadlines.
Frequently asked questions
Is a dental website contact form HIPAA-compliant by default?
No. Most website form tools and hosts don't sign business associate agreements by default. If patients can submit health details through a form, the vendor that receives and stores those submissions needs a signed BAA, and notification emails shouldn't contain the patient's details.
Can a dental practice use Google Analytics?
Only in a limited way. Google says it makes no representation that Google Analytics satisfies HIPAA and doesn't offer BAAs for it, and it tells HIPAA-regulated customers not to place Analytics tags on authenticated pages or on HIPAA-covered pages related to providing care. Keep it off booking, form and portal pages.
Did the 2024 AHA v. Becerra ruling make tracking pixels safe for dental websites?
Only partly. The court vacated HHS's position that an IP address plus a visit to a public, unauthenticated health page is protected health information, and HHS dropped its appeal in August 2024. Tracking on patient portals and on pages where patients submit health information is still covered by HIPAA.
Does the Connecticut Data Privacy Act apply to dentists?
Generally not to practices that are HIPAA covered entities; the Act and its consumer-health-data section exempt covered entities and business associates. A practice that isn't a covered entity, such as some cash-only cosmetic practices, is subject to Connecticut's consumer-health-data rules regardless of its size.
