Your enquiry form does not need a patient history

Begin with the purpose of the form

A general website enquiry usually needs enough information to route a question and reply. It does not automatically need a detailed account of someone’s health. Before adding a field, ask who will read it, what decision it supports and where the answer will be stored. This is a publishing and workflow exercise, not advice about what a clinician should collect during care.

Know that business size is not the whole privacy question

The Office of the Australian Information Commissioner explains that private health service providers holding health information can be covered by the Privacy Act regardless of turnover. A small practice should therefore avoid assuming that a small-business exemption settles its obligations. Use the OAIC’s current guidance and obtain advice appropriate to your practice when designing collection, storage and access arrangements.

Make the administrative route narrow

For an illustrative enquiry form, the useful fields might be a reply address, an optional name, a subject and a short message. Place an instruction beside the message field asking people not to include medical records or sensitive clinical details. Provide the practice’s approved route for those matters. Do not use a generic public form as a fallback merely because a clinical system is inconvenient.

Explain what happens after submission

Tell the visitor whether the message goes to reception, a practice manager or another administrative team. Use a response-time statement only if someone owns the commitment. Explain that a website enquiry is not an urgent-care channel and provide your practice’s appropriate urgent-contact guidance. Avoid a confirmation screen that implies a practitioner has reviewed the message when it has only been stored.

Audit the hidden copies

Map the message from browser to inbox or system: form provider, email notifications, exports, backups and staff access. Removing a field from the visible page does not remove old submissions from those places. Agree on retention and deletion procedures based on applicable requirements. Test with invented administrative data, never a real patient record. Review the form whenever you change vendors or staffing. This guide is general information and does not determine your legal obligations.

Sources & further reading

Primary sources used for this guide. Practical arrangements can change; follow the official source for current details.

• OAIC — small business and the Privacy Act
• OAIC — health and medical research privacy