Every clinic website has a form. "Request an appointment." "Free screening." "Tell us how we can help." Underneath the form is a line of configuration that says where the submission gets emailed. Almost nobody remembers setting it, because the person who built the site set it, once, years ago.

I find that line pointing at a personal Gmail address more often than you'd expect. A pediatric therapy practice, a chiropractor, a small dental office — the form asks for a child's name, a description of symptoms, a phone number, sometimes an insurance ID. Then it emails all of it to something like practicename@gmail.com.

Here's the thing that makes this different from the usual security lecture: nothing was hacked. Nobody did anything malicious. The form works exactly as built. It's just delivering protected health information into a mailbox that was never set up to hold it.

Why the mailbox matters, not just the message

Under HIPAA, if a vendor handles protected health information on your behalf, you need a Business Associate Agreement with them — a contract where they accept responsibility for protecting it. Google does offer one: it's made available to Google Workspace and Cloud Identity customers for electronic acceptance in the Admin console, under Account settings, and it covers a specific list of included services.

A free consumer Gmail account has no Admin console. There's no BAA to accept, and no list of covered services. So the free Gmail account isn't "less secure" in some vague way. It's outside the agreement structure the law assumes exists. If that data is ever breached, there's no contract, no accounting, and no argument that the practice did what was required.

Worth adding: a paid Workspace account with a signed BAA isn't automatically compliant either. The BAA covers the service. What you do inside it — who has access, whether two-factor is on, whether the account is shared, whether messages get forwarded to a personal phone — is still on you.

The same pattern, four other ways

Once you start looking at where form data goes, the same problem shows up in places nobody thinks of as IT. The shared front-desk mailbox that three people log into with one password, and that a former employee still knows. The fax-to-email service nobody has audited since it was set up. The scheduling widget from a vendor you've never signed anything with, collecting symptom details in its own database. Text messages to a personal cell, because it was faster than the portal.

None of these are attacks. They're conveniences that accumulated.

What to do about it

Find out where your form goes. Ask whoever built your site, or submit a test entry yourself and watch which inbox it lands in. Fifteen minutes.

If it's a personal or free account, move it to a paid mailbox on your own domain, with a signed BAA in place.

Ask each vendor that touches patient data for a signed BAA. Scheduling, forms, fax-to-email, backups, your website host if form submissions sit on their server. A vendor who can't answer that question quickly is the answer.

Decide what the form should even collect. The strongest fix is often to stop asking. A form that captures name, phone, and "best time to call" creates almost no exposure. One that asks for symptoms and insurance details creates a lot. Most practices don't need the second kind to book an appointment.

Write down where it all goes. One page. Which system holds what, who has access, who to call. That page is the thing nobody has and everybody needs during an incident.

That fourth point is the one practices skip, and it's the cheapest. You can't lose data you never collected.

The pattern underneath

It's the same as a lapsed domain registration. Nothing failed. Nothing got attacked. Somebody made a reasonable decision years ago, the practice grew around it, and no one has looked since.

This article is general information, not legal advice. For how these rules apply to your practice specifically, talk to a healthcare attorney.