Why your doctor's contact form shouldn't ask about your health

Many medical websites ask "reason for visit" on a contact form. That answer is protected health information, and contact forms usually deliver to ordinary email.

Where a contact form actually goes

A contact form looks official. It sits on the practice's own website, it has the practice's logo above it, and it says "submit." But behind the scenes, most forms simply turn your answers into an email and send it to a shared inbox at the front desk.

That inbox is rarely built to hold health information. Messages can sit there for years, get forwarded, show up on a personal phone or be read by anyone with the password. None of that is malicious. It's just what email is for, and email was never meant to be a medical record.

What counts as health information

It's easy to think only lab results and diagnoses are sensitive. In practice, plenty of everyday details can say something private about a person once they're tied to a name:

• The reason for a visit, even a vague one
• Symptoms, medications or past conditions
• Which provider or specialty someone wants to see
• Insurance details and dates of birth

A single line like "following up about my medication," sent along with a name and email address, is exactly the kind of information that deserves stronger protection than an inbox can give.

What our forms ask instead

Our forms ask only for a name and a way to reach you. Symptoms, records and questions about care go through the patient portal, a system covered by HIPAA safeguards and the vendor agreements that come with them. The form says so right above the fields, so nobody types their history in by accident.

The portal is designed for this. Messages are stored securely, access is controlled and logged, and only the people who need to see your information can. The contact form, by contrast, is for the practical things: "please call me back," "are you taking new patients," "what time do you open on Fridays."

A small choice with a big payoff

It's a small design choice that removes a whole category of risk. The practice never has to wonder what is sitting in the front-desk inbox, and patients never have to wonder where their words went.

It's also one of the first things Loam checks on a healthcare client's site. If a form asks for something it doesn't need, the field comes out, the form points to the portal and the reason is explained in plain language.

Loam & Key Family Health is fictional, and so is its front desk. Enid, its very thorough privacy officer, is invented too, but she would want you to know this much: if a website form asks about your health, it's fair to ask where that answer goes.