Behind most behavioral health contact forms is a tool somebody picked years ago, collecting fields nobody remembers choosing, and sending submissions to places the owner has never checked. Every practice owner should be able to answer three questions about their own form: who collects the data, what gets collected, and where it goes. In behavioral health there’s a fourth question that sits on top of all three: is every step of that HIPAA compliant?

This is the last piece in a month that started with January coming whether your system is ready or not, moved through the tracking code on your website, and landed on the leads nobody calls back. All three run through the same front door. Before anyone gets a callback, before anything gets measured, somebody types into a form.

Why is the contact form the most sensitive page on a practice’s website?

The contact form is where a visitor stops reading and starts telling you who they are. A name, a phone number, an email address, and often a sentence or two about what’s going on. On a behavioral health website, that sentence can be the first time a person has put their situation into words.

Think about the kinds of sentences that land in those boxes. “I’ve been drinking more since my divorce.” “My daughter stopped eating after Christmas.” “I need someone who takes my insurance and can see me soon.” People are remarkably honest with a form, maybe because it doesn’t look back at them.

Regulators see it the same way. The HHS Office for Civil Rights, in its guidance on online tracking, describes a tracking tag collecting a person’s “reason for seeking health care” when they book an appointment, and treats that as a disclosure of protected health information.

Earlier this month I wrote about what the tracking tags on your pages can see. The form is a step past that. It’s the moment the visitor hands you the information directly and trusts you to take care of it.

“Your contact form is where a visitor stops browsing and starts trusting you. Everything that happens after they hit submit is your responsibility.”

What’s behind the contact forms on Beacon’s client websites?

Curve builds the contact forms on every website Beacon hosts. It’s a HIPAA-focused tracking and forms platform. There isn’t a dramatic story behind that. Our hosting partner specializes in this field and helps us stay HIPAA compliant. They let us know our clients needed a more secure HIPAA form tool, and Curve had just added one to its platform. It was an easy decision to put it on every site we host.

We also gave clients a choice. If a practice preferred its own secure system, something like JotForm, they could keep it. They sent us the code and we installed it on their site.

Curve is the same platform we already used for our paid advertising clients. We chose them for their level of security. Curve states that every plan includes a signed business associate agreement and US-hosted infrastructure, that it holds a SOC 2 Type II report, and that its servers handle the data processing so that “PHI never reaches ad platforms.” Those are Curve’s published claims about its platform, and they’re why we trust it with our clients’ forms.

Here’s the part I find interesting. Our clients use Curve every week. The form a prospective patient fills out on their site is built in Curve. The reporting dashboard they open to see how their marketing is doing is Curve. Most of them couldn’t tell you the name, and honestly, they shouldn’t have to.

It reminds me of painting a room. Everybody notices the color. Nobody notices the patching, the sanding, or the tape along the trim. Skip the prep, though, and you’ll notice fast, usually about the time the paint starts peeling.

“The best compliance is the kind your clients use every week without having to think about it.”

Who collects the data from a practice’s contact form?

Whoever built the form collects the data first. That’s a vendor, even if the form came bundled with the website, and in this field the vendor needs a signed business associate agreement before it touches protected health information.

HHS is direct about this. Its tracking guidance says a vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.” Skipping the agreement leaves the vendor’s role exactly where it was and takes away the protections the agreement is supposed to provide.

Vendors matter more than most owners assume. In HHS’s report to Congress on breaches in calendar year 2024, business associates filed only 16 percent of large breach reports, yet those breaches affected 85 percent of all the individuals affected that year. Across all reports, 534 of the 663 large breaches, or 81 percent, were hacking or IT incidents.

So ask two things. Which company runs our form, and do we have a signed BAA with them? And who at our agency can see the submissions, under what login? The HIPAA Security Rule lists unique user identification as a required specification at 45 CFR 164.312(a)(2)(i): “Assign a unique name and/or number for identifying and tracking user identity.” An owner should always be able to see who did what. We wrote up the full list of vendor questions in How Should a Practice Vet a Marketing Vendor for HIPAA Compliance?

What should a practice’s contact form actually collect?

Only what the practice needs to respond well, with every field earning its place. That decision belongs to the owner, because what the form collects shapes how carefully everything downstream has to be handled.

A form that asks for a name and a phone number is one thing. A form that asks for a presenting concern, an insurance carrier, a date of birth, or a child’s name is carrying a lot more. Both can be the right choice for a practice. The second one simply has to be handled with more care.

This is why I can’t give you a one-size answer about how form data should travel. It varies from practice to practice, because the forms vary. When we set up a client’s form, what it asks is the first conversation we have, because it decides everything after it.

If you haven’t looked at your own form in a while, open it today and read every field as if you were the one filling it out. Then ask whether you’d want each of those answers sitting in someone’s inbox.

“Every field on your contact form is a decision about someone else’s privacy. Make it on purpose.”

Where does form data go after someone hits submit?

Form data usually goes one of three places: an email notification to the practice, the form tool’s own built-in CRM, or the practice’s CRM. Each one is a separate place that information lives, and each one needs the same care as the form itself.

On the sites Beacon hosts, it works like this. A practice without a CRM gets submissions by email. A practice can also keep them in Curve’s basic CRM, or have them sent to the CRM it already uses.

Email deserves a closer look, because it’s the destination owners think about least. HHS guidance says the Security Rule “does not expressly prohibit the use of email for sending e-PHI,” but it requires covered entities to protect it in transit and decide, in writing, how they’ll do that. How much protection an email needs depends on what’s in it, which brings you right back to what your form collects.

Paula M. Stannard, Director of the HHS Office for Civil Rights, put it simply in an August 2025 settlement announcement: “A HIPAA risk analysis is essential for identifying where ePHI is stored and what security measures are needed to protect it.” Your form’s inbox, your CRM, and your form tool all belong in that analysis.

What about the tracking on the rest of the website?

For practices running paid ads, Curve handles that too. Instead of a pixel in the browser reporting straight to Meta or Google, each conversion is processed on a server first. Names, contact details, conditions, page addresses, and form content come off. What reaches the ad platform is a generic event, like an appointment request, plus the visitor’s IP address in hashed form.

Hashing is one layer of protection, and I want to be precise about it, because it gets oversold. The FTC’s Office of Technology wrote in July 2024 that hashing “still creates a unique signature that can track a person or device over time.” That’s why the larger protection is everything that never gets sent at all. We don’t send names, emails, or phone numbers in any form, and we never upload patient lists as ad audiences.

The ad platforms have closed most of the other doors themselves. Google bars advertiser-curated audiences when promoting mental health services, and Meta began restricting custom conversions that suggest specific health conditions in September 2025. If your practice treats substance use, Google and Meta also require LegitScript certification before you can advertise addiction treatment, which we cover in Keep It Legit With LegitScript.

More on what to expect from any agency here is in What Should a Practice Expect From Its Marketing Agency on HIPAA? and why most health advertisers can’t run compliant retargeting.

What does compliant form handling cost a practice?

For Beacon clients, HIPAA compliance shows up as its own line item. Hosting clients see it in their hosting fees, and paid advertising clients see it on their ad management invoice. I won’t pretend it’s free, and we’re upfront about it.

What we can do is hold the agreement with Curve ourselves. Because Beacon holds that agreement, our clients get it at a significant discount compared with buying it on their own. And a practice that would rather use its own secure tool still can.

I’d rather it be a line our clients can see than a risk they can’t. In behavioral health, the cost of getting this wrong lands on the practice and on the people the practice serves. Nobody calls to say thank you for the breach that didn’t happen. The work still has to get done.

If you’re not sure what’s behind your own forms, our website and hosting team can look at it with you.

Why does the contact form matter so much going into January?

It’s the busiest door into the practice during the busiest month of the year. For most of the practices we work with, January brings more new clients than any other month, and every one of them started by trusting you with something.

That’s the thread through this whole month. January demand is predictable. The system that absorbs it has to be built in October. The leads you don’t call back cost you whether you notice or not. And the form where it all starts has to be something you can stand behind, legally and ethically, when someone asks where their information went.

Picture the February meeting where you look back at January. How many people reached out. Which campaigns brought them. How fast someone called them back. Every one of those answers starts with a form, and every one of them is knowable without sending an ad platform a name, a phone number, or the reason someone reached out.

“If someone asks where their information went after they filled out your form, you should be able to answer in one sentence.”

Great marketing creates connection. Connection builds trust. Trust earns the right clients. And trust starts with what happens after someone types the hardest sentence of their week into a box on your website.

So here’s my question as we head toward the end of the year: Could you tell me today, without checking, exactly where your contact form sends what people type into it?

Frequently asked questions

Does a behavioral health practice need a HIPAA-compliant contact form?

A behavioral health practice that is a HIPAA covered entity should treat its contact form as handling protected health information, because people often share their reason for seeking care in it. That means a form vendor with a signed business associate agreement, secure handling of every submission, and a clear record of where the data goes.

Is it safe to receive contact form submissions by email?

HHS guidance says the Security Rule does not prohibit email for electronic protected health information, but it requires covered entities to protect it in transit and document how they do that. How much protection a form email needs depends on what the form collects, which varies from practice to practice.

What questions should a practice ask about its contact form?

Ask who collects the data and whether that vendor has signed a business associate agreement, what fields the form collects and why, and where submissions go, whether that’s an inbox, the form tool’s CRM, or the practice’s CRM. Then confirm each step is handled in a HIPAA-compliant way.

Do Beacon clients pay for HIPAA-compliant forms and tracking?

Yes. HIPAA compliance appears as its own line item in Beacon clients’ hosting fees and paid advertising invoices. Because Beacon holds the agreement with Curve directly, clients get it at a significant discount compared with buying it on their own, and practices can choose their own secure form tool instead.

This article is general information about website forms, tracking, and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

The tracking code on a behavioral health practice’s website is a legal decision because it controls what information about people seeking care leaves the practice and who receives it. Regulators and plaintiffs’ attorneys have increasingly treated that flow as the practice’s responsibility, even when someone else installed the code. Leaving a default in place is still a choice, and the owner is the one who carries it.

I know how most owners hear that. The Meta pixel and the Google tag feel like marketing settings, something a web developer or an agency switched on years ago so the ads would work. Nobody sat in a meeting and voted to send appointment data to Facebook.

That’s exactly the problem. Nobody decided. It happened by default, and a default is still a decision.

How did a marketing setting turn into a legal decision?

It comes down to what tracking code can see on a behavioral health website. A tag installed to measure ads also reports which pages a visitor viewed, what they clicked, and identifiers tied to their device. On a site about anxiety treatment or substance use care, that combination can describe a person looking for help.

Here’s how it usually happens. A practice launches a website, and the developer adds Google Analytics because every site has it. An agency comes in to run ads and adds the Meta pixel, because that’s how the platform measures results, and the ad platform’s own setup screens walk you right into it. Years go by. Two vendors later, nobody remembers who put what where.

It’s like a pothole on the road out of town. You hit it once, then you start steering around it without thinking, and after a while you don’t see it at all. It takes someone driving that road for the first time to say, “Whoa, what is that?”

This is common, and it’s been common for a long time. A study published in PNAS Nexus in December 2025 followed 1,201 U.S. hospitals from 2012 through 2023 and found that 66 percent of the sample used pixel tracking. The same researchers linked pixel use to a higher chance of a data breach, a 46 percent relative increase.

Those are hospitals with legal departments and compliance officers. If it happened to them, it can happen to a 20-person group practice that has neither.

“If your website sends patient data to an ad platform, odds are nobody at your practice decided it should. It happened by default, and a default is still a decision the owner carries.”

What does a tracking pixel actually send from a behavioral health website?

More than most owners would guess: the address of each page a visitor views, the buttons they click, activity on forms, and identifiers like IP address and browser cookies that connect one visit to the next. A page address like /eating-disorder-treatment/ tells the receiving platform what the visitor was reading about, and a submitted form can tie that to a name.

The U.S. Department of Health and Human Services spelled this out in its guidance on online tracking. The HHS Office for Civil Rights bulletin states that “tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI,” meaning protected health information. That covers patient portals, logged-in scheduling, and anything else behind a password.

Public pages are a more contested question, and I want to be straight with you about that. In June 2024, a federal court in Texas vacated part of that HHS guidance, the part treating an IP address plus a visit to a public page about a health condition as enough on its own to trigger HIPAA. HHS notes the ruling on the bulletin itself. The rest of the guidance is still posted, and the ruling didn’t address the FTC or state privacy laws.

So here’s the honest version. Some of this is settled, some of it is being argued in court, and none of it is a green light. We go deeper on the specifics in Is the Meta Pixel HIPAA Compliant? and Why Is Website Tracking a HIPAA Risk for Behavioral Health Practices?

Who is treating website tracking as a legal issue?

Two groups every practice owner should pay attention to: federal regulators and plaintiffs’ attorneys. HHS and the Federal Trade Commission have warned providers directly, the FTC has taken action against mental health companies over sharing data with advertising platforms, and class actions over tracking technology have ended in multimillion-dollar settlements.

In July 2023, the FTC and HHS sent a joint letter to roughly 130 hospital systems and telehealth providers warning them about tools like the Meta pixel and Google Analytics. Melanie Fontes Rainer, then Director of the HHS Office for Civil Rights, said in the announcement: “Although online tracking technologies can be used for beneficial purposes, patients and others should not have to sacrifice the privacy of their health information when using a hospital’s website.”

The FTC has also acted on companies in our corner of the world. In March 2023, it announced that BetterHelp would pay $7.8 million to settle FTC charges that it revealed consumers’ email addresses, IP addresses, and health questionnaire information to platforms including Facebook for advertising purposes. In April 2024, it announced a proposed order against Cerebral, charging that the company provided sensitive information of nearly 3.2 million consumers to third parties through tracking tools on its website and apps.

Then there are the private lawsuits. As reported, Advocate Aurora Health’s $12.225 million settlement in a pixel tracking case received final approval in 2024, and Novant Health settled a patient class action for $6.66 million that same year. Sutter Health’s $21.5 million settlement over alleged disclosures of patient information to third parties received final court approval in March 2026, according to the court-approved settlement notice.

You might be reading this thinking it’s a hospital problem. I’d push back on that. The tracking code works exactly the same way on a 15-clinician practice’s website. The only difference is who has a general counsel on speed dial.

“The tracking code on a 15-clinician practice’s website works exactly the way it works on a hospital’s. The difference is the hospital has a general counsel to call.”

Who is responsible for website tracking if an agency installed it?

You are. Even when an agency or developer installed the tracking, the responsibility sits with the practice. If the practice is a HIPAA covered entity, as practices that bill insurance electronically are, the obligation to protect patient information stays with the practice. Vendors that handle that information take on duties of their own as business associates, and those duties sit alongside the practice’s.

HHS is direct about this. Its bulletin says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.” Skipping the agreement leaves the relationship in place and the protections out.

I’ll be the first to admit this one is uncomfortable to write, because agencies like ours are the ones in that sentence. Agencies install tags. It’s part of the job. That’s exactly why we think an owner should know what’s on the site, in writing, and why we’d rather you ask us hard questions than assume we’ve got it handled.

We break down who carries which responsibility in Who Is Responsible if a Practice Website Leaks Patient Data?, and the basics of the paperwork in What Is a Business Associate Agreement and When Do You Need One?

How does website tracking connect to what ad platforms learn from your leads?

Tracking and lead quality both decide what an ad platform learns, which is why this month picks up right where September left off. In September I wrote about why your ads keep finding the wrong people when they learn from every form fill. The obvious next question from any owner is whether sending a better signal back creates a HIPAA problem. That depends entirely on what gets sent.

The line we hold at Beacon is simple. Your ads can learn from what you count. What you count should never carry a person’s name, how to reach them, or what they came looking for.

In practice, that comes down to three rules:

• Tracking stays off booking, intake, and patient portal pages. Those are the pages where a visitor is acting as a patient or a prospective patient.
• No names, email addresses, phone numbers, conditions, page addresses, or form content go to an ad platform. None of it, in any form.
• What the platform receives is a generic event. Something like “an appointment request happened.” The only other thing that travels with it is the visitor’s IP address, and it’s hashed before it leaves.

Hashing scrambles a piece of data into a string of characters before it leaves your site. It’s a real protection, and it’s one layer. The FTC’s own technology staff wrote in July 2024 that hashing on its own “still creates a unique signature that can track a person or device over time.” That’s why the bigger protection is everything that never gets sent at all. A hash should never be the reason someone feels comfortable sending a name or an email address.

Stephanie’s piece this Thursday walks through how server-side conversion tracking handles this, and why pulling the pixel out entirely creates a different problem.

What should a practice owner do about website tracking this week?

Start with one request to whoever manages your website: a written list of every tag on it, what each one sends, and which pages it fires on. That list answers most of the questions that matter, and it puts the decision back where it belongs, with the owner.

Here’s what I’d ask, in writing:

1. What tags are on our site right now, and who added each one? Every pixel, every analytics script, every chat widget.
2. What does each one send, and to whom? Page addresses, form activity, identifiers. Ask for specifics.
3. Do any of them fire on booking, intake, or portal pages? If yes, ask to have them removed.
4. What exactly reaches an ad platform from our site, and what gets hashed or stripped out before it goes?
5. Which of our vendors have signed business associate agreements? And which ones touch patient information without one?

You don’t need to understand the code to ask those questions. You need someone who can answer them plainly. If nobody can, that tells you something too.

One caution. Don’t rip everything out in a panic. Pull every tracking tag and you lose the ability to see which marketing is working, and you’re right back to guessing which marketing filled your schedule. There’s a way to measure that keeps names, contact details, and what someone was looking for out of the data, and we’ll get into what that looks like, and what it costs, later this month.

“You don’t need to understand the code. You need someone who can tell you, in writing, what your website sends and where it goes.”

Why does website tracking matter more in behavioral health?

A single page visit can reveal more on a behavioral health website than almost anywhere else. Someone reading about eating disorder treatment, addiction recovery, or a teen anxiety program at two in the morning is telling the website something deeply private, often before they’ve told anyone in their life. Every owner I know would protect that person in a session, and the website deserves the same standard.

Think about what it took for that person to land on your page. Weeks of wondering. Maybe a search they cleared from their history afterward. They’re trusting you before they’ve ever met you.

When the FTC announced its Cerebral order in April 2024, then FTC Chair Lina M. Khan described the company as “revealing their most sensitive mental health conditions across the Internet.” That’s the line that stays with me. Our field asks people to trust us with the hardest thing in their lives, and the first place they test that trust is the website.

“Our field asks people to trust us with the hardest thing in their lives. The first place they test that trust is the website.”

I’m not writing this to scare anybody. Every owner I know would want to see what their website sends. That’s the whole point. You can’t fix what nobody’s shown you, and once you’ve seen the pothole, you can’t unsee it.

Connection is what brings someone to your practice, and connection runs on trust. That trust starts long before the first phone call. It starts with what your website does with someone’s curiosity when they think nobody’s watching.

I’ll leave you with this one: When was the last time anyone at your practice looked at what your website sends out, and who did you ask?

Frequently asked questions

Is the Meta Pixel HIPAA compliant?

No practice should treat the Meta Pixel as HIPAA compliant. HIPAA compliance belongs to the practice, and the pixel’s exposure depends on which pages it fires on and what it sends. HHS guidance says tracking on logged-in pages generally has access to protected health information, which is why tracking belongs off booking, intake, and portal pages.

Did the 2024 court ruling make website tracking safe?

The June 2024 ruling in American Hospital Association v. Becerra vacated one part of HHS’s tracking guidance, covering IP addresses combined with visits to public pages about health conditions. The rest of the guidance remains posted, including its examples about patient portals and appointment booking, and the ruling did not address FTC rules or state privacy laws.

Does a cookie consent banner solve the tracking problem?

A cookie consent banner does not count as HIPAA authorization. The HHS tracking bulletin states that website banners asking visitors to accept or reject tracking technologies “do not constitute a valid HIPAA authorization.” State privacy laws set their own consent rules, and those rules vary from state to state.

Should a practice remove all tracking from its website?

Removing every tag protects privacy but also removes the practice’s ability to see which marketing produces clients. A more balanced approach keeps tracking off booking, intake, and portal pages and sends ad platforms only generic events with no names, contact details, conditions, or page addresses. Under Beacon’s standard, an ad platform receives a generic conversion event and a hashed IP address, and nothing else.

This article is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.