Notes
HIPAA-Compliant Forms: Builders, BAAs, and How to Keep the Click ID
An online form is HIPAA compliant when the vendor that stores submissions has signed a business associate agreement, the data is encrypted in transit and at rest, access is limited and logged, and the contents never travel through uncovered channels such as plain email or a page URL. A padlock icon on the builder's website proves none of that.
Key takeaways
- Any form where a person connects their identity to a health matter can collect PHI, including a simple "request a consultation" form with a procedure dropdown.
- The form vendor needs a BAA. So does every system the submission is copied to.
- Email notifications are the most common failure. The alert should contain a link, never the answers.
- Marketing needs one extra thing from the form: hidden fields for the ad click ID. It is not health data, and without it advertising can never be judged on patients.
- Iframe embeds often lose the click ID. Script embeds and native forms usually keep it.
Contents
- What makes an online form HIPAA compliant?
- Where a submission travels, and where it leaks
- Eight checks for any form builder
- Is Google Forms HIPAA compliant?
- The field everyone forgets: the ad click ID
- What goes wrong in real clinics
- What it costs, by route
- Fix your current forms, switch builder, or take PHI off the form
- How I set it up
- Submit your own form and follow it
Your website has a form. It asks for a name, a phone number and "what can we help you with?" Somebody picks "breast augmentation" or types three sentences about their symptoms. That submission lands in a form tool, an email inbox, a spreadsheet and perhaps a CRM. Four copies, and nobody can say which of those vendors has signed anything.
I am a marketing consultant and not a lawyer. This is a sourced map for your privacy officer, written by the person whose job is to make sure the form still tells the ad account which click it came from.
What makes an online form HIPAA compliant?
An online form is used in a HIPAA-compliant way when every vendor that receives the submission has a business associate agreement with you, the submission is encrypted in transit and at rest, only named people can open it, their access is logged, and nothing from the form leaks into email bodies, URLs or analytics events. HHS sets out the vendor requirement under business associates and its view of website tools in its online tracking guidance.
If you are a cash-pay practice that never bills insurance electronically, you may not be a covered entity. The FTC and state health-privacy laws still apply to what you collect and share, so the same design is the safe one.
Where a submission travels, and where it leaks
Follow one submission. The browser sends it to the form vendor. The vendor emails your front desk. A connector copies it to a spreadsheet or a CRM. The visitor is redirected to a thank-you page.
Each hop is a separate question. Does the form vendor have a BAA with you? Does your email provider, and is the message encrypted end to end, or is it a full copy of the answers sitting in a shared inbox? Does the connector have a BAA? Did the redirect put the answers in the thank-you URL, where your analytics and advertising tags can read them? That last one quietly undoes otherwise careful setups, as I describe in whether Google Analytics is HIPAA compliant.
Eight checks for any form builder
| # | Check | A pass looks like |
|---|---|---|
| 1 | BAA on the plan you are buying | Signed, or accepted in the admin console, before go-live |
| 2 | Encryption | In transit and at rest, stated in the vendor's security documentation |
| 3 | Notifications | An alert with a link to log in. No answers in the email body |
| 4 | Access control and audit log | Named users, roles, and a record of who opened what |
| 5 | Hidden fields | You can add gclid, gbraid and wbraid and fill them by script |
| 6 | Embed method | Script embed or native form that can read the page URL and cookies |
| 7 | Redirect | A clean thank-you URL with no answers in the query string |
| 8 | Retention | Submissions deleted from the form tool after they sync to the system of record |
I am not publishing a table of vendor logos. Several builders advertise HIPAA plans. I have not verified their terms, and their plans change. Use the eight checks on any of them and ask for the BAA before the demo.
Is Google Forms HIPAA compliant?
The free version is not. There is no BAA for consumer accounts. On a paid Google Workspace plan, Google Forms is part of Google Drive and appears on Google's list of HIPAA included functionality as of May 2026, which means it is covered once a super administrator has accepted Google's Business Associate Addendum in the admin console. Paying for Workspace does not switch that on by itself.
Coverage is not the same as suitability. Google Forms has no per-response audit trail, no field-level permissions, and its email notifications and linked Sheets need careful configuration. It also has no true hidden fields, only pre-filled links, which makes click ID capture awkward. For an internal staff form it can be acceptable. For a public enquiry form on a site that runs ads, it is rarely the right tool.
The field everyone forgets: the ad click ID
Compliance projects usually end with a form that is safe and blind. The new builder is locked down, embedded in an iframe, and the advertising click ID never reaches it. From that day no enquiry can be tied to the ad that produced it, and Google goes back to optimizing on form counts.
It does not have to be a trade. The click ID is a string Google attaches to the landing page URL. It says nothing about health. Three hidden fields, gclid, gbraid and wbraid, filled by a small script from a first-party cookie, carry it into the submission and on to the CRM. I explain the ID in what a GCLID is.
What matters is what happens next. The ID goes to your CRM with the record. Later, only the ID, a neutral stage name and a time go back to Google. The answers on the form never do. That design is set out in click-ID-only conversion feeds, and the CRM side in HIPAA-compliant CRM.
What goes wrong in real clinics
| Cause | What actually happens | Hidden cost | What you see | Risk level |
|---|---|---|---|---|
| Full submission in the notification email | PHI sits in inboxes, phones and forwarded threads | The safest form builder is undone by its own alert | Staff reply to patients from the alert email | High |
| Free-text "tell us more" box | People write their medical history | PHI in places designed for contact details | Long paragraphs in a field meant for one line | High |
| Answers passed to the thank-you URL | Analytics and ad tags read them | Health details sent to vendors with no BAA | /thank-you?procedure=... in page reports | High |
| Connector copies submissions to a spreadsheet | A third vendor, often with no agreement | Exposure nobody remembers creating | An automation account nobody owns | High |
| Compliant form embedded in an iframe | Click ID never reaches the form | Advertising can no longer be tied to patients | Empty click ID field on every new lead | Medium |
| Old form left live on a forgotten page | Submissions go to an ex-employee's inbox | Lost patients and unmanaged PHI | Enquiries nobody answers | Medium |
| Spam protection that loads third-party scripts | Another vendor sees the page and the interaction | Usually minor, sometimes not | Unknown scripts on the form page | Low |
What it costs, by route
Market figures were checked in September 2026 for the US and Canada. They are ranges, not quotes. I do not list builder subscription prices because they change by plan and seat. Ask for the price of the plan that includes the BAA.
| Route | Typical cost | Time to a defensible setup | What it depends on |
|---|---|---|---|
| Reconfigure the forms you have | Staff time. If you hire by the hour, Upwork lists tag manager specialists at $20 to $49 (median $30); senior US consultants quote $85 to $175 | Days | Whether your current vendor offers a BAA on your plan |
| Move to a builder that signs a BAA | The subscription, plus a few hours to rebuild and test each form | Days to weeks | Number of forms, integrations, embed method |
| Take health questions off the public form | Almost nothing | Days | Whether intake can happen later, inside your clinical system |
| I audit forms, tags and click ID capture together | Audit at $500 per ad account, credited toward the first month. Fixes are a fixed quote from the audit | Scoped in the audit | Entry points, booking tool, call tracking |
| Leave it | Nothing today | Never | Every submission adds to the exposure |
Fix your current forms, switch builder, or take PHI off the form
| Option | Cost | Time to result | Risk | When it makes sense |
|---|---|---|---|---|
| Fix what you have | Low | Fast | Vendor may not offer a BAA at all | Your builder signs one on your plan |
| Switch builder | Medium | Medium | Click ID capture lost in the move | Your vendor will not sign |
| Minimal public form, intake later in the clinical system | Lowest | Fast | Fewer details for the first call | Most elective practices. Name, contact, service line, preferred time |
| Do nothing | None | None | Compounding | Never |
The third option deserves more attention than it gets. A public form that asks only for name, contact details, a broad service line and a preferred time collects far less, converts better because it is shorter, and leaves the clinical questions for a system built to hold them. Your IT or compliance partner is the right owner for the vendor paperwork. My part is the marketing side: what the form asks, where the data goes, and whether the click ID survives.
How I set it up
- I list every form on the site, including old landing pages, and submit a test entry to each with a hand-typed click ID.
- I follow each submission: form tool, email, connectors, CRM, thank-you URL. Anything that holds the contents goes on a list for BAA review.
- I cut the public form to what the first call needs and move clinical questions out.
- I add the three hidden click ID fields and the script that fills them, and replace iframe embeds where they block it.
- I change notifications to link-only alerts and clean the thank-you URL.
- I connect the form to the CRM so the record carries the ID, and set up the feed that later reports a neutral stage back to Google.
After 30 days every paid enquiry carries a click ID and no answers appear in email or URLs. After 90 you are judging campaigns on patients. That is the method behind the one result I quote: I inherited an underperforming account and rebuilt it; cost per acquisition came down by about 78% while spend grew.
The audit covers your ad account, the tracking and the path from enquiry to booked patient, and ends with a 90-day plan. It is credited toward the first month if you continue with me.
You work with me directly. There are no account managers and no juniors.
If you would like your forms traced end to end by someone who also runs the ad accounts, that is part of my HIPAA-compliant conversion tracking work. The audit is $500 per ad account, comes with a 90-day plan, and is credited toward the first month if you continue with me. You work with me directly. Book a call or write first.
Submit your own form and follow it
Fill in your own consultation form today with a test click ID and watch where it goes. If the answers arrive by email, if the thank-you URL repeats them, or if the CRM field is empty, you have found this week's work. Fix the leaks, shorten the form, keep the click ID. If you want it traced for you, start with the audit.
Frequently asked questions
Is a contact form PHI if it only asks for a name and phone number?
It can be, if you are a covered entity and the context shows the person is seeking care from you. A form on a surgical practice's consultation page is different from a newsletter sign-up. Ask your counsel, and design as if the answer is yes.
Is Google Forms HIPAA compliant?
Only on a paid Google Workspace plan after an administrator has accepted Google's Business Associate Addendum, and even then it lacks per-response audit logs and field-level permissions. The free version never is.
Can form submissions be sent by email?
An alert can. The contents should not, unless your email is covered by a BAA and encrypted appropriately. Link-only notifications are the simple fix.
What does a compliant form setup cost?
Mostly the builder plan that includes the BAA and a few hours per form to rebuild and test. For scale, specialist freelancers list this kind of work at $20 to $49 an hour on Upwork, and senior US consultants at $85 to $175. My audit is $500 per ad account and fixes are quoted from it.
Will a compliant form hurt my conversion rate?
Usually the opposite. The changes that reduce risk, fewer fields and no free-text medical history, are the same ones that raise completion rates.
Do I lose ad tracking if I switch to a secure form?
Only if the new form cannot take hidden fields or is embedded in a way that blocks the page URL. Test with a hand-typed click ID before and after the switch.
Who does the work?
I do the marketing side myself: the form audit, the click ID capture, the CRM connection and the feed. Vendor agreements belong to you and your compliance partner. Nothing I do is handed to a junior or subcontracted.
How do I verify it myself?
Submit your own form from a URL ending in ?gclid=TestABC123. Check four places: the email alert shows no answers, the thank-you URL is clean, the CRM record shows TestABC123 with capitals intact, and you can name the BAA for every tool that stored the submission.