Privacy and contact forms for health practices

When we take over a health practice website, one of the first things we check is the contact form. More often than not, it has a big open “Tell us about your condition” box, sends every submission as a plain email to a shared reception inbox, and keeps a copy of every message in the WordPress database going back years. Nobody set it up that way on purpose. It’s just the default.

That’s a problem, because health information is treated as sensitive information under the Privacy Act, and the small business exemption doesn’t help you. The OAIC is clear that an organisation providing a health service and holding health information is covered, even if it’s a small business. That includes allied health, complementary therapists and anyone else collecting health details. The fix is to collect only what you need to reply, tell people not to type health details into the form, send it to as few inboxes as possible, and move detailed intake into your practice software.

What follows is general information about how this plays out on websites, not legal advice. Your indemnity insurer, professional association or a privacy lawyer can advise on your specific situation.

Follow the data: where a form submission goes

Picture a patient filling in your website’s contact form and mentioning their diagnosis. That message can end up in more places than most practices realise:

1. The website database. Most WordPress form tools, including Elementor Forms, can save every submission in the site. If nobody turned that off or set up deletion, it’s all still there.
2. The email itself. The form emails the submission to you. Email travels between servers and isn’t designed for sensitive information.
3. Every inbox it’s sent to. Often reception, the practice manager and the owner. Sometimes a former staff member’s address that was never removed.
4. Every device those inboxes sync to. Including personal phones.
5. Third-party services. Spam filters, email marketing integrations, CRM connections or automation tools that someone connected once.
6. Backups. Website backups and email backups keep copies even after you delete the original.

Each one is a place that information can leak from, and each one is your responsibility. The goal is to shrink that list.

What your website form should collect

For a general enquiry or booking request form, ask for what you need to reply and no more:

• Name
• Phone and/or email
• Preferred contact method, and whether it’s OK to leave a message
• Which practitioner or service they’re interested in (a dropdown, not free text)
• An optional short message

Then add a line directly above the message box, something like:

Please don’t include detailed health information here. We’ll go through that with you privately by phone or at your appointment.

Some people will still type in their medical history. You can’t stop that entirely, but in our experience the note helps, and it shows you’ve thought about it.

Things to keep off a plain website form: diagnoses, medications, Medicare numbers, health fund details, uploaded referral letters, scans, and anything about mental health history, sexual health, pregnancy or children’s health. Those belong in a secure system. Our general guide to contact forms people actually finish covers the usability side, and shorter forms tend to get finished more often anyway.

Where the detailed information should go

If you need detailed intake information before an appointment, use a system built for it:

• Your practice management software’s intake forms. Most practice systems used in Australian allied health include patient forms that store responses against the patient’s record, behind a login. This is usually the best option because the data goes straight where it belongs.
• Secure referral channels. For GP referrals, secure messaging or your software’s referral intake, rather than a website upload field.
• A dedicated secure form service, if your practice software doesn’t cover it. Check where the data is stored, whether it’s encrypted, who can access it and whether it’s held in Australia.

The flow then becomes: website form for “I’d like to book”, a reply from you, then the secure intake form sent from your practice system.

Tightening up the form you already have

Some quick changes your web developer can make in an afternoon:

• Turn off storing submissions on the website, or set them to be deleted automatically after a short period, once you’re confident emails are arriving reliably.
• Send submissions to as few addresses as possible. One monitored inbox is better than four.
• Use a proper email service with multi-factor authentication on every account that receives form submissions. Microsoft 365 or Google Workspace with MFA switched on is a good baseline, and it’s part of the business email and IT setup we do. A free webmail address is not.
• Check for old integrations. Mailchimp, Zapier and CRM connections are often still running from a past campaign.
• Make sure the site uses HTTPS everywhere and that the form only submits over HTTPS.
• Keep WordPress, Elementor and plugins updated, with good hosting and backups. A hacked site with years of stored submissions is a far worse breach than a hacked site with none.

Your privacy policy

A privacy policy on a health practice website should be written for your practice, not copied from a template for an online shop. Under the Australian Privacy Principles it needs to explain, in plain language:

• What kinds of personal and health information you collect, and how (website, phone, forms, referrals)
• Why you collect it and how you use it
• Who you might share it with (referrers, GPs, health funds, Medicare, other treating practitioners)
• How you store and protect it
• How patients can access or correct their information
• How to make a privacy complaint, and that they can go to the OAIC if unhappy with your response
• Whether information is likely to be sent overseas, for example through cloud software, and to which countries if practical

Also cover the website specifically: what analytics and cookies you use, what your forms collect, and what happens to submissions. If you use advertising pixels from Meta or Google, say so. Better still, think carefully about whether you need them on a health site at all.

Privacy law reform has been rolling out in stages, so review your policy at least once a year and check the OAIC for current obligations.

If something goes wrong

Under the Notifiable Data Breaches scheme, if a breach is likely to result in serious harm to the people involved, you have to notify them and the OAIC. A compromised inbox full of patient enquiries can easily meet that bar.

Decide now who you’d call if the website or email was compromised. That’s usually your web developer, your email or IT provider, and your indemnity insurer. Write the numbers down somewhere other than the inbox that might be locked.

A checklist for this week

• Read your contact form as a patient would. Does it invite health details?
• Add the “please don’t include health information” note
• Check whether submissions are stored on the website, and how many there are
• List every address that receives form emails and remove any that shouldn’t
• Confirm MFA is on for those accounts
• Read your privacy policy and check it describes how your practice really works

The same rules apply to unregistered practitioners, which we touch on in our article on naturopath and wellness websites. Forms, hosting and email are the sort of thing we tidy up routinely when we build or take over a practice website, and if the checklist above turned up gaps, get in touch to have yours looked at.