DATA PRIVACY DAY What Imaging Centers Overlook on Their Websites

Today is Data Privacy Day, and for diagnostic imaging centers, it’s a useful moment to pause and look at where patient data actually enters your system.

Most people associate HIPAA compliance with PACS, EMRs, or internal workflows. But in reality, one of the most common exposure points sits much earlier in the patient journey: the website.

Every form on your site that connects patient identity with the type of scan: MRI, CT, ultrasound, is handling protected health information (PHI). Under HIPAA, that data should be encrypted and properly secured.

Here’s what we see in practice:

When we review imaging center websites, 9 out of 10 are built on generic templates with contact or referral forms that were never designed to handle PHI. They look professional, they function well — but they are not HIPAA compliant.

Why this matters goes beyond compliance:

Referring physicians and professional partners trust imaging centers to treat patient data with the same care they apply in their own practices. That trust doesn’t stop at the scanner, it starts the moment a patient or referral is submitted online.

This week, during a workshop with imaging centers, we offered participants a free review of their website forms and a practical fix to make those forms HIPAA compliant. In almost every case, small changes closed meaningful gaps.

A practical step you can take today:

• Review your contact and referral forms
• Talk to your IT provider or webmaster
• Ask one clear question: Are these forms HIPAA compliant, and how is PHI protected?

Catching this early can prevent unnecessary risk later and protect the trust your referral network places in you. If this is on your radar, always happy to compare notes.