Behind most behavioral health contact forms is a tool somebody picked years ago, collecting fields nobody remembers choosing, and sending submissions to places the owner has never checked. Every practice owner should be able to answer three questions about their own form: who collects the data, what gets collected, and where it goes. In behavioral health there’s a fourth question that sits on top of all three: is every step of that HIPAA compliant?
This is the last piece in a month that started with January coming whether your system is ready or not, moved through the tracking code on your website, and landed on the leads nobody calls back. All three run through the same front door. Before anyone gets a callback, before anything gets measured, somebody types into a form.
Why is the contact form the most sensitive page on a practice’s website?
The contact form is where a visitor stops reading and starts telling you who they are. A name, a phone number, an email address, and often a sentence or two about what’s going on. On a behavioral health website, that sentence can be the first time a person has put their situation into words.
Think about the kinds of sentences that land in those boxes. “I’ve been drinking more since my divorce.” “My daughter stopped eating after Christmas.” “I need someone who takes my insurance and can see me soon.” People are remarkably honest with a form, maybe because it doesn’t look back at them.
Regulators see it the same way. The HHS Office for Civil Rights, in its guidance on online tracking, describes a tracking tag collecting a person’s “reason for seeking health care” when they book an appointment, and treats that as a disclosure of protected health information.
Earlier this month I wrote about what the tracking tags on your pages can see. The form is a step past that. It’s the moment the visitor hands you the information directly and trusts you to take care of it.
“Your contact form is where a visitor stops browsing and starts trusting you. Everything that happens after they hit submit is your responsibility.”
Curve builds the contact forms on every website Beacon hosts. It’s a HIPAA-focused tracking and forms platform. There isn’t a dramatic story behind that. Our hosting partner specializes in this field and helps us stay HIPAA compliant. They let us know our clients needed a more secure HIPAA form tool, and Curve had just added one to its platform. It was an easy decision to put it on every site we host.
We also gave clients a choice. If a practice preferred its own secure system, something like JotForm, they could keep it. They sent us the code and we installed it on their site.
Curve is the same platform we already used for our paid advertising clients. We chose them for their level of security. Curve states that every plan includes a signed business associate agreement and US-hosted infrastructure, that it holds a SOC 2 Type II report, and that its servers handle the data processing so that “PHI never reaches ad platforms.” Those are Curve’s published claims about its platform, and they’re why we trust it with our clients’ forms.
Here’s the part I find interesting. Our clients use Curve every week. The form a prospective patient fills out on their site is built in Curve. The reporting dashboard they open to see how their marketing is doing is Curve. Most of them couldn’t tell you the name, and honestly, they shouldn’t have to.
It reminds me of painting a room. Everybody notices the color. Nobody notices the patching, the sanding, or the tape along the trim. Skip the prep, though, and you’ll notice fast, usually about the time the paint starts peeling.
“The best compliance is the kind your clients use every week without having to think about it.”
Whoever built the form collects the data first. That’s a vendor, even if the form came bundled with the website, and in this field the vendor needs a signed business associate agreement before it touches protected health information.
HHS is direct about this. Its tracking guidance says a vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.” Skipping the agreement leaves the vendor’s role exactly where it was and takes away the protections the agreement is supposed to provide.
Vendors matter more than most owners assume. In HHS’s report to Congress on breaches in calendar year 2024, business associates filed only 16 percent of large breach reports, yet those breaches affected 85 percent of all the individuals affected that year. Across all reports, 534 of the 663 large breaches, or 81 percent, were hacking or IT incidents.
So ask two things. Which company runs our form, and do we have a signed BAA with them? And who at our agency can see the submissions, under what login? The HIPAA Security Rule lists unique user identification as a required specification at 45 CFR 164.312(a)(2)(i): “Assign a unique name and/or number for identifying and tracking user identity.” An owner should always be able to see who did what. We wrote up the full list of vendor questions in How Should a Practice Vet a Marketing Vendor for HIPAA Compliance?
Only what the practice needs to respond well, with every field earning its place. That decision belongs to the owner, because what the form collects shapes how carefully everything downstream has to be handled.
A form that asks for a name and a phone number is one thing. A form that asks for a presenting concern, an insurance carrier, a date of birth, or a child’s name is carrying a lot more. Both can be the right choice for a practice. The second one simply has to be handled with more care.
This is why I can’t give you a one-size answer about how form data should travel. It varies from practice to practice, because the forms vary. When we set up a client’s form, what it asks is the first conversation we have, because it decides everything after it.
If you haven’t looked at your own form in a while, open it today and read every field as if you were the one filling it out. Then ask whether you’d want each of those answers sitting in someone’s inbox.
“Every field on your contact form is a decision about someone else’s privacy. Make it on purpose.”
Form data usually goes one of three places: an email notification to the practice, the form tool’s own built-in CRM, or the practice’s CRM. Each one is a separate place that information lives, and each one needs the same care as the form itself.
On the sites Beacon hosts, it works like this. A practice without a CRM gets submissions by email. A practice can also keep them in Curve’s basic CRM, or have them sent to the CRM it already uses.
Email deserves a closer look, because it’s the destination owners think about least. HHS guidance says the Security Rule “does not expressly prohibit the use of email for sending e-PHI,” but it requires covered entities to protect it in transit and decide, in writing, how they’ll do that. How much protection an email needs depends on what’s in it, which brings you right back to what your form collects.
Paula M. Stannard, Director of the HHS Office for Civil Rights, put it simply in an August 2025 settlement announcement: “A HIPAA risk analysis is essential for identifying where ePHI is stored and what security measures are needed to protect it.” Your form’s inbox, your CRM, and your form tool all belong in that analysis.
What about the tracking on the rest of the website?
For practices running paid ads, Curve handles that too. Instead of a pixel in the browser reporting straight to Meta or Google, each conversion is processed on a server first. Names, contact details, conditions, page addresses, and form content come off. What reaches the ad platform is a generic event, like an appointment request, plus the visitor’s IP address in hashed form.
Hashing is one layer of protection, and I want to be precise about it, because it gets oversold. The FTC’s Office of Technology wrote in July 2024 that hashing “still creates a unique signature that can track a person or device over time.” That’s why the larger protection is everything that never gets sent at all. We don’t send names, emails, or phone numbers in any form, and we never upload patient lists as ad audiences.
The ad platforms have closed most of the other doors themselves. Google bars advertiser-curated audiences when promoting mental health services, and Meta began restricting custom conversions that suggest specific health conditions in September 2025. If your practice treats substance use, Google and Meta also require LegitScript certification before you can advertise addiction treatment, which we cover in Keep It Legit With LegitScript.
More on what to expect from any agency here is in What Should a Practice Expect From Its Marketing Agency on HIPAA? and why most health advertisers can’t run compliant retargeting.
For Beacon clients, HIPAA compliance shows up as its own line item. Hosting clients see it in their hosting fees, and paid advertising clients see it on their ad management invoice. I won’t pretend it’s free, and we’re upfront about it.
What we can do is hold the agreement with Curve ourselves. Because Beacon holds that agreement, our clients get it at a significant discount compared with buying it on their own. And a practice that would rather use its own secure tool still can.
I’d rather it be a line our clients can see than a risk they can’t. In behavioral health, the cost of getting this wrong lands on the practice and on the people the practice serves. Nobody calls to say thank you for the breach that didn’t happen. The work still has to get done.
If you’re not sure what’s behind your own forms, our website and hosting team can look at it with you.
It’s the busiest door into the practice during the busiest month of the year. For most of the practices we work with, January brings more new clients than any other month, and every one of them started by trusting you with something.
That’s the thread through this whole month. January demand is predictable. The system that absorbs it has to be built in October. The leads you don’t call back cost you whether you notice or not. And the form where it all starts has to be something you can stand behind, legally and ethically, when someone asks where their information went.
Picture the February meeting where you look back at January. How many people reached out. Which campaigns brought them. How fast someone called them back. Every one of those answers starts with a form, and every one of them is knowable without sending an ad platform a name, a phone number, or the reason someone reached out.
“If someone asks where their information went after they filled out your form, you should be able to answer in one sentence.”
Great marketing creates connection. Connection builds trust. Trust earns the right clients. And trust starts with what happens after someone types the hardest sentence of their week into a box on your website.
So here’s my question as we head toward the end of the year: Could you tell me today, without checking, exactly where your contact form sends what people type into it?
Frequently asked questions
A behavioral health practice that is a HIPAA covered entity should treat its contact form as handling protected health information, because people often share their reason for seeking care in it. That means a form vendor with a signed business associate agreement, secure handling of every submission, and a clear record of where the data goes.
HHS guidance says the Security Rule does not prohibit email for electronic protected health information, but it requires covered entities to protect it in transit and document how they do that. How much protection a form email needs depends on what the form collects, which varies from practice to practice.
Ask who collects the data and whether that vendor has signed a business associate agreement, what fields the form collects and why, and where submissions go, whether that’s an inbox, the form tool’s CRM, or the practice’s CRM. Then confirm each step is handled in a HIPAA-compliant way.
Yes. HIPAA compliance appears as its own line item in Beacon clients’ hosting fees and paid advertising invoices. Because Beacon holds the agreement with Curve directly, clients get it at a significant discount compared with buying it on their own, and practices can choose their own secure form tool instead.
This article is general information about website forms, tracking, and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Skip to content
