Most healthcare organisations have their clinical systems under proper governance. The healthcare data risk sits elsewhere: in the website, the booking form, the feedback survey, the recruitment portal. Systems that were never intended to hold health information and quietly do.
How it happens
Nobody decides to collect health data on a website. It arrives through a free-text box.
An appointment form asks for the reason for the visit. A contact form has a message field and someone describes their condition in it. A feedback survey asks what could have gone better and the answer includes a diagnosis. A recruitment form asks about reasonable adjustments.
Every one of those is now a system holding data about someone’s health, which in most data protection regimes is a special category attracting stricter handling. The system was scoped as a marketing website.
The first question: do you need it at all
The cheapest way to protect sensitive data is not to hold it.
Does the online form need the reason for the appointment, or can that be captured at the appointment? Does the feedback survey need free text attached to an identifiable person, or would it serve its purpose anonymously?
Removing a field removes an entire category of obligation. That is usually a better trade than securing it, and it is rarely considered because the field was added by habit.
Where healthcare data goes once submitted
This is the part that surprises people. A form submission commonly ends up in more places than anyone realises:
- Stored in the website database, often indefinitely, because form plugins default to keeping submissions.
- Emailed, in plain text, to one or more inboxes.
- Sitting in those inboxes for years.
- Passing through a third-party mail relay.
- Included in website backups, which may sit with a hosting provider in another country.
- Occasionally, captured by analytics or session-recording tools that record form fields.
That last one deserves specific attention. Session recording and heatmap tools can capture keystrokes in form fields unless explicitly configured not to. On a healthcare site that is a serious problem, and it is invisible unless someone checks.
Practical measures that matter
Decide retention, then enforce it automatically. A stated retention period that nothing implements is worse than none, because it is a documented policy you are visibly breaching. If submissions should be deleted after twelve months, something should be deleting them.
Do not store what you have emailed. If the workflow is entirely email-based, turn off database storage. One copy in one place is far easier to manage than two.
Restrict who can read submissions. Website administrator accounts frequently have access to everything submitted. That access list is rarely reviewed and often includes an agency.
Exclude form fields from analytics and recording tools explicitly, and verify it rather than assuming the default.
Know where backups live. Including which country, because cross-border transfer has its own requirements.
Have a route for deletion requests. When someone asks for their data to be removed, you need to know every place it exists. If the answer includes “somewhere in an inbox”, you have a problem to solve before the request arrives.
Say what you actually do
Privacy notices written from a template describe a generic organisation. The one on a healthcare site should describe what really happens: what is collected, where it is stored, who can see it, how long it is kept and who processes it on your behalf.
Writing that accurately is also the most reliable audit available, because it forces someone to trace each field to its destinations, and that exercise usually finds at least one surprise.
We approach healthcare projects from that direction: mapping where data actually goes before designing what collects it.
Related reading
- Retail and CPG: getting one honest stock figure across channels — Selling in a shop, online and through a marketplace means three systems each confident about retail stock. How to get to one number everyone trusts.
- Manufacturing: getting shop-floor data into the office without a rewrite — Shop floor data usually lives on paper and in one person’s head. Getting it into the office rarely needs a new system, just one reliable capture point.
- WooCommerce or Shopify: choosing by how you actually operate — Choosing WooCommerce or Shopify is not about features. It is about who maintains the store and how unusual your operation is. A practical comparison.