First, does HIPAA reach your business at all
This is a checklist, not legal advice. It helps you sort the forms on your own site and write sharper questions for the companies behind them. Whether HIPAA applies to your med spa is a question for your attorney or compliance adviser.
Under the federal HIPAA rule, a health care provider is a covered entity when it sends health information electronically in connection with a transaction the rule covers. This post does not decide that for you. If you are not sure, ask before you change anything on this list.
The rule also has a name for the outside companies that handle that information. A business associate is someone outside your staff who creates, receives, maintains or transmits protected health information on behalf of a covered entity. The company behind a web form can be one when the form takes in health information for you. That is where the BAA, short for business associate agreement, comes in.
What counts as health information on a form
The rule says health information relates to a person's past, present or future physical or mental health, the care they receive, or payment for that care. That wording is broad. A question about medications, a past procedure or the treatment someone wants is worth checking against it, not only a question about a diagnosis.
The second half is who the answer belongs to. The rule's definition of individually identifiable health information includes demographic information collected from the person. So a name, phone number or email address sitting next to a health answer counts along with it.
You are not making a legal ruling on each field. You are marking which forms put a health question and an identifying detail in the same submission, so you know which tools to check.
Build the table: every form on your site
Open your site on your phone and tap everything that asks for something. Forms show up in more places than the contact page: the booking page, a consultation pop-up, the newsletter signup in the footer, a gift card page.
For each form, write one row. Note what it asks, which tool receives the answers, and whether you have a signed BAA with that tool. Here is the shape, with example fields:
| Form | What it asks | Health question? | Sent to | BAA on file? |
|---|---|---|---|---|
| Contact page | Name, phone, message box | Open box, people may write one | Fill in | Fill in |
| Consultation request | Name, phone, treatment you are interested in | Yes, treatment interest | Fill in | Fill in |
| Intake form | Name, email, medical conditions or medications | Yes | Fill in | Fill in |
| Newsletter | Email only | No | Fill in | Fill in |
Any row with a health question and a name, phone or email goes on the short list for the next two sections. Those are the forms where the tool behind it may be a business associate. Keep the message box rows on the list too, since people type whatever they like into an open box.
For the rest of what a med spa site needs, see websites for med spas.
Check the website builder behind each form
The builder's own form block is often the one on the contact page. Check the builder's help center, where the plan and BAA terms are spelled out, rather than its sales pages.
Squarespace
Squarespace says its contact form features, including the form block, can't be used as part of a HIPAA compliant setup. That is on its help page, Acuity Scheduling and HIPAA. Squarespace signs a BAA for Acuity Scheduling only on the Powerhouse or Premium plan. So a row in your table that runs through a Squarespace form block and asks a health question needs a different tool.
Wix
Wix offers HIPAA compliance on its Business, Plus, Elite, Business Elite and Enterprise plans. On one of those plans, you sign the BAA with the Sign Now button in the site dashboard. Wix recommends collecting no protected health information on the site until PHI protection is on and the BAA is signed. The steps are on Wix's page, HIPAA Compliance for Your Wix Site.
Check form tools and Google Forms
Jotform
Jotform offers its HIPAA features on the Gold plan and on Jotform Enterprise. You turn them on with the Enable HIPAA Compliance button on the Data page. Once they are on, you can sign the BAA from the Data section with the Sign BAA option, and the signed copy arrives by email. Menus move, so if a button is not where this says, open Jotform's page on enabling HIPAA compliance and follow what it shows today.
Google Forms
Google says Workspace customers who have not signed its BAA must not put protected health information in Workspace. Its list of covered services names Google Forms under Google Drive. So a Google Form with a health question belongs only in an account that has signed Google's BAA. Read Google's HIPAA page for Workspace and the covered services list on Google Cloud, then find out who in your office, if anyone, signed it.
Any other form tool
For Typeform or any tool not named here, skip the guessing and send the questions below. Put an answer in the BAA column only when you have it in writing.
Questions to send each vendor
Send these by email, so the reply is in writing and dated.
- Will you sign a BAA with my business, and on which plan?
- Does the BAA cover form submissions and the email notifications they send?
- Are connected apps or add-ons covered? Google's BAA, for one, does not cover them.
- Where are submissions stored, and can I turn off email copies?
- What do I turn on in my account before I collect health information? Wix, for example, recommends collecting none until PHI protection is on and the BAA is signed.
- How do I get the signed BAA? Jotform sends its signed copy by email.
A business associate is anyone outside your staff who creates, receives, maintains or transmits the information for you. So ask about every place an answer goes after someone taps submit, not only the form.
If intake needs a home of its own, another route is a client portal, where health questions sit behind a login instead of on a public page. The same questions apply to whatever tool runs it.
What to do
- Ask your attorney or compliance adviser whether your med spa is a covered entity, since the rule reaches a provider only under that condition.
- Walk your site on your phone this week and fill in one table row per form.
- Move any health question off a Squarespace form block, which Squarespace says can't be part of a HIPAA compliant setup.
- On Wix, check your plan against Wix's list, then press Sign Now before any form asks about health.
- On Jotform, confirm you are on Gold or Enterprise before you count on its HIPAA features.
- On Google Forms, find out whether your Workspace account has signed Google's BAA.
- Email the vendor questions to every other tool in your table and file the replies.
On sites we build, every form is proven end to end before launch.