The message box on a public website feels convenient because it is already open. That does not make it the right place for a medication list, an imaging report, or a detailed account of new symptoms.
Use the route that matches the information.
A public form is for office logistics
A standard contact form works well for questions that do not require a clinical record. Examples include:
- Where is the Suite B entrance?
- Is the office accessible without stairs?
- Which weekday appointment times are available?
- Who should I call about an invoice?
- Is the website form working correctly?
Keep the message limited to what the office needs to answer that practical question. Do not attach records or add health history “just in case.”
The patient portal is for clinical information
A secure portal can require authentication and place the conversation inside the system used for patient information. HHS guidance notes that portals may support access to protected health information when suitable authentication and safeguards are in place.
Use the portal when the office asks you to provide symptoms, diagnoses, medications, treatment history, records, or patient-specific clinical questions. The office may use a separate intake system for a first appointment; follow the link supplied by staff rather than searching for a generic form online.
Our public contact page deliberately tells visitors not to submit protected health information.
A phone call can settle routing questions
You may not know whether a question counts as clinical. Call the office and ask where it belongs. You can describe the type of information without reciting the private details: “I have a question about a new symptom” is enough for staff to direct you to the proper channel.
Phone calls also make sense for urgent scheduling changes and insurance verification. Have the card nearby, but wait until staff confirms how they want to receive the information.
Email requires judgment
HHS explains that health care providers may use email with reasonable safeguards, though open email can present privacy risks. A practice may limit email to reminders and office administration or ask patients to move clinical details into a portal.
Do not assume that an address printed on a website accepts medical records. Ask first.
What not to put in a public message
Leave out Social Security numbers, full insurance identifiers, photographs of insurance cards, dates of birth paired with medical details, medication lists, diagnoses, imaging, and symptom histories. If you already sent sensitive information through the wrong route, call the office rather than sending a second message that repeats it.
Use a simple routing rule
Parking, hours, accessibility, and general billing questions can use the public form. Health history and clinical details belong in the secure system. If the distinction is unclear, call.
Privacy often depends on an ordinary decision made before pressing Send.
Source notes
References and limits
- 01 HHS: Individuals' right to access health information
- 02 HHS: Email communication and the HIPAA Privacy Rule
General privacy guidance, not legal advice. Follow the communication instructions provided by your health care office.