The original SolvaraCare site had this article because practices keep pasting intake into Wix. The rule has not changed. A contact form is not a chart. If the field would belong in an EHR, it does not belong on a public marketing page.
What a marketing form may ask
- Your name, work email, and callback number.
- Practice or company name, and the public website URL.
- What you want help with — in business language, not a diagnosis.
- Preferred time for a call.
What it must not ask
- Patient names, dates of birth, Social Security or insurance IDs.
- Symptoms, medications, photos of conditions, or visit notes.
- Anything you would not shout across a waiting room.
If someone pastes PHI into a marketing form anyway, we delete it and ask them to use a clinical channel. That is the policy on this site. It is also how you keep a form from becoming a HIPAA incident you did not budget for.
Intake still happens — just not here
Appointment requests can live on a practice site. Full medical intake belongs in the system that already has a Business Associate Agreement: Phreesia, Weave, NexHealth, Jane, the EHR portal. We wire a booking widget or a short request form. We will not put a homemade ‘patient portal’ on an unsecured stack and call it HIPAA-compliant.
What ‘HIPAA-aware’ means on a SolvaraCare build
- Visible copy states not to send PHI.
- Fields are labelled, keyboard-reachable, and short — WCAG and conversion, not a compliance sticker.
- Hosting and form vendors are chosen so a BAA is possible when the practice actually needs one.
- Analytics events do not capture health answers. Assistants quote what is on the page; do not put a patient’s story in a testimonial without a real release.
- The studio phone and the contact form are a marketing front desk. Same rule: no patient identifiers.
This is not legal advice and not a substitute for counsel on a health system. It is the floor we build to so a clinic can get found without turning the website into a medical record.