This article is general information, not legal advice. Check your own obligations with your compliance officer or counsel.
The short version
Use your website for public information. Use your EHR's patient portal, online scheduling and secure messaging for anything that involves a patient's health information. Connect the two with links or the embedded widgets your EHR vendor provides.
Why ordinary website forms are a problem
When a patient types their name and the reason for a visit into a standard website form, that is protected health information. A typical form stores the submission in the website's database and sends a copy by ordinary email. That puts patient information in your web host, your form plugin and your inbox, none of which were set up to hold it.
Under HIPAA, any vendor that handles protected health information on your behalf needs to sign a business associate agreement and apply appropriate safeguards. Most general web hosts, form tools, chat widgets and email services are not offered on those terms.
What your EHR already provides
Most EHR and practice management systems include patient-facing tools built for this purpose:
- Online scheduling and appointment requests
- A patient portal with secure messaging
- Digital intake and consent forms
- Appointment reminders
- Online bill pay
These run on the vendor's systems, under the agreement you already have with them, with access controls and audit logs.
How to connect them to your website
- Add clear buttons such as "Book an appointment" and "Patient portal" that link to the EHR's pages.
- Or embed the scheduling widget the vendor supplies, so the form is served by the vendor, not by your site.
- Keep the hand-off obvious, so patients know where to go for anything personal.
What the website should and shouldn't do
- Fine on the website: services, providers, locations, hours, insurance accepted, directions, general articles and a phone number.
- If you keep a general contact form: limit it to non-clinical questions and state plainly that patients should not include health information.
- Not on the website: symptom descriptions, appointment reasons, intake forms, document uploads or live chat about care, unless the tool is covered by a business associate agreement.
Analytics and tracking
Be careful with analytics and advertising pixels on any page where patients log in or enter information. Regulators have issued guidance on tracking technologies and health information, and it is an area that continues to change. Keep tracking off patient-facing tools and ask your compliance contact about the rest.
Where practices go wrong
- A "request an appointment" form that asks for the reason for the visit.
- A chat widget added by a marketing vendor.
- Staff replying to patient questions from a general inbox.
- A new plugin installed without anyone asking where the data goes.
We build practice websites that route scheduling and messaging to the EHR, and we keep them maintained. See website design, hosting and care.