Senior living and home care: where a tour request becomes PHI

Search for HIPAA guidance on senior living websites and you get two kinds of result. Compliance vendors explaining risk analyses, business associate agreements and workforce training, which is correct and is about your organisation. Web agencies explaining that you should use an encrypted form, which is correct and is about six percent of the problem. Almost nobody addresses the question that actually determines your website: whether HIPAA applies to you at all.

Covered entity, or not

Skilled nursing facilities, home health agencies, hospices and rehabilitation providers are typically covered entities. Assisted living and residential care are the interesting case: they may be covered when they deliver healthcare and bill electronically, and otherwise they often act as business associates instead, handling protected health information on behalf of somebody who is covered.

That distinction is not a technicality and it is not the website's to decide. It is established by how the organisation operates and bills, and the answer arrives from the operator or their counsel rather than from the build. What the build needs is the answer before the intake flow is designed, because a covered entity and a business associate have different obligations and the form is where those obligations land.

Names, street addresses, phone numbers and email addresses are ordinary contact details and collecting them is unremarkable. They become protected health information when they are combined with something health-related: a condition, a health status or history, a care need, or payment for medical services. It is the combination that creates the obligation, not either half on its own.

Which is why the tour request is the problem

A senior living enquiry is almost never abstract. The person filling it in is arranging care for a parent, and the form asks a perfectly reasonable question: tell us a bit about your situation. What comes back is a diagnosis, a mobility level, a memory-care need and sometimes a prognosis, typed into a free-text box by somebody who has no idea they have just created a HIPAA obligation for you.

You do not have to ask for protected health information to receive it. An open text box on a care enquiry will collect it whether the form intended to or not.

There are two honest ways to build this, and picking one deliberately is the whole job.

• Keep the web form deliberately thin. Name, contact, preferred time, and a next step that moves the conversation to a channel built for it. No free-text box, or one labelled explicitly as not for medical details. The form stops being a PHI surface.
• Or treat it as PHI from the start: a form tool that will sign a BAA, encryption in transit and at rest, access control, and a retention rule. This is the right answer when the intake genuinely needs clinical detail to be useful.

What is not available is the middle, which is where most of these sites currently sit: a rich enquiry form on a standard marketing stack, collecting clinical detail into an inbox and a CRM that nobody has a BAA with. Encryption does not rescue that arrangement. Without a signed business associate agreement, a form tool is not HIPAA-compliant however good its security is, because the agreement is what makes the vendor share the obligation.

Decide it before the wireframe

This is a scoping question wearing a design question's clothes. Thin form and thick form produce different page layouts, different calls to action, different CRM plumbing and different vendor contracts. Choosing late means rebuilding the part of the site that generates the enquiries, which is the part you least want to rebuild. A therapist practice faces the narrower version of the same problem, covered in what a therapist contact form can collect.