Healthcare Data Protection: GDPR and Patient Data on Your Website

Healthcare data protection on a website comes down to one point. Much of what a patient types into a form and some of what your analytics records about their visit, can count as health data under UK law, which the law protects more closely than ordinary personal data. For providers investing in web design and marketing for healthcare providers, the website is now one of the main places patient data is collected, so the rules covering it deserve the same attention as the clinical systems behind it.

The core law is the UK GDPR, read alongside the Data Protection Act 2018, with the Privacy and Electronic Communications Regulations (PECR) governing cookies and similar technologies. The Data (Use and Access) Act 2025 amended all three. What follows is a practical overview for marketing, IT and information governance teams rather than legal advice and every provider should take legal advice on its own circumstances before acting on any single point.

What Healthcare Data Protection Means for Your Website

In practice, GDPR in healthcare asks a website to get six things right. Each one maps to a duty under the UK GDPR or PECR and the sections below take them in turn.

• Identify a lawful basis and an Article 9 condition for every form or tool that collects health information.
• Collect only the details a form needs and restrict who can see submissions once they arrive.
• Keep analytics, advertising pixels and other optional tracking switched off until a visitor agrees, apart from the few uses the law exempts.
• Publish a privacy notice that describes what your website collects, why and who receives it.
• Hold written contracts with every processor, from your host to your form and booking providers.
• Secure the website, plan for breaches and complete the Data Security and Protection Toolkit if you handle NHS patient data.

None of these is unusual for a well run website. The difference in healthcare is the threshold, since a mistake that would be minor on a retail website can expose information about someone’s health.

Why Health Data Counts as Special Category Data

Health data is special category data under Article 9 of the UK GDPR, so processing it is prohibited except under one of a short list of conditions. The text of Article 9 sets out that prohibition and the exceptions to it and the Data Protection Act 2018 adds the UK detail.

The definition is wider than many teams expect. The ICO’s guidance on what counts as special category data explains that health data covers past, current and future health status. It can include information gathered when someone registers for health services, appointment details that reveal something about their health and identifiers such as an NHS number when combined with health information. A referral to a memory clinic reveals something about the patient before any clinical notes exist.

The same guidance says that profiling which infers someone’s health status counts as processing special category data, whether or not the inference is correct. That point matters for websites. A visitor’s journey through pages about fertility treatment, addiction services or cancer screening can reveal health interests and any technology that records that journey against an identifiable person brings special category rules into play.

Choosing a Lawful Basis and an Article 9 Condition

Every processing activity on a healthcare website needs two things, an Article 6 lawful basis and a separate Article 9 condition. The ICO’s page on the rules on special category data is clear that the condition is an additional layer and does not replace the lawful basis. The same page says a data protection impact assessment (DPIA) is required for high risk processing, including special category data processed on a large scale.

For most patient forms, the relevant condition is Article 9(2)(h), which covers medical diagnosis, the provision of health care or treatment and the management of health services. In the UK it works through condition 2 of Schedule 1 to the Data Protection Act 2018 and the ICO’s guidance on conditions for processing notes that it applies only where the data is processed by, or under the responsibility of, a professional who owes a duty of confidentiality. Explicit consent under Article 9(2)(a) is the other common route and it needs a clear statement from the person rather than a ticked box beside a generic privacy policy link.

The table shows how these choices often play out for common website features. Your own answers may differ.

Treat the table as a starting point for a conversation with your data protection officer, not a ruling. The right combination turns on who you are and what happens to the data next, which is where legal advice earns its place.

Contact Forms, Booking Systems and Online Referrals

Forms are where most patient data enters a healthcare website, so they deserve the closest review. Data minimisation is the starting point and a callback request rarely needs a date of birth, NHS number or description of symptoms when a name, phone number and preferred time will do.

These are also the pages most likely to let patients down. Our 2026 study of 300 UK healthcare websites found contact pages averaged 50.6 broken elements per page against 32.4 on homepages and booking and appointment pages averaged 7.2 distinct accessibility violations per page against 4.5. The pages that collect patient details deserve the most care, both for data protection and for the people trying to use them.

What happens after submission matters as much as the form itself. Many WordPress form plugins save every entry in the website database by default, so anyone with an administrator login could read patient details. Email notifications are a second weak point, since copying a referral’s full contents into a shared inbox spreads health data across mail servers and devices the website team does not control.

The wording at the point of collection carries legal weight too. Patients should see what the form is for, who will read it and how long it is kept, right beside the fields rather than on a separate page. Our guide to healthcare web design covers how forms and booking journeys fit into a website built around patients.

Forms also need to work for every patient. A consent statement or required field that a screen reader cannot announce leaves some people unable to understand what they are agreeing to and our website accessibility services treat form testing against WCAG 2.2 AA as part of the same compliance picture.

Cookies, Analytics and Tracking Pixels on Health Websites

Cookies and similar technologies are governed by PECR, with the UK GDPR applying to any personal data they collect. The basic rule is that you need consent to store or access information on a visitor’s device, subject to a small number of exceptions. The ICO finalised its guidance on storage and access technologies in April 2026, covering cookies, tracking pixels, web storage, fingerprinting and scripts.

The Data (Use and Access) Act 2025 added new exceptions, including one for analytics used only to produce statistical information that helps you improve your website. The ICO’s explanation of the statistical purposes exception says you must give visitors clear information and a simple, free way to object. Any third party provider can only use the data to help you and the exception does not cover tracking individual visitors or anything connected to advertising.

For a healthcare provider this exception is narrower than it first appears. An analytics set up that feeds advertising platforms, records individual sessions or links visits to a user ID falls outside it and still needs consent before it loads. Assess each tool on its own merits and write down why you believe it qualifies.

Consent itself has to meet the UK GDPR standard of being freely given, specific, informed and unambiguous. Boxes ticked in advance, banners that treat scrolling as agreement and reject options hidden behind extra clicks all fall short and the banner must be usable by keyboard and screen reader users for their choice to count.

Privacy Notices, Processors and Hosting

A privacy notice for a healthcare website has to describe what that website does, not the organisation in general terms. The ICO’s guidance on the right to be informed says you must explain your purposes, retention periods and who the data is shared with at the point you collect it, in clear and plain language and review that information regularly.

Template notices tend to miss the detail that matters online. Each form, the booking system, every cookie or pixel and each external service that receives data should appear, along with the lawful basis and Article 9 condition you rely on. The Data (Use and Access) Act now requires organisations to help people make data protection complaints and to acknowledge them within 30 days, as the ICO’s summary of the Act explains, so the notice should say how to complain.

Most healthcare websites rely on several processors, from the host and the form or booking provider to email services and analytics tools. Article 28 of the UK GDPR requires a contract with each one and the ICO’s guidance on when a controller and processor contract is needed confirms that sub-processors must be bound by equivalent protections. Ask every supplier where data is stored, who can access it and which sub-processors they use.

Hosting location and certification are fair questions for any supplier. Priority Pixels provides managed WordPress hosting from a UK data centre independently certified to ISO 27001 and the team is Cyber Essentials certified, which gives information governance leads independent evidence to review.

Security, Breach Reporting and the NHS Toolkit

The UK GDPR requires appropriate technical and organisational measures and for special category data the bar for appropriate sits higher. The ICO’s guide to data security points to encryption where appropriate, regular testing, reliable backups and basic controls such as those in Cyber Essentials.

For a WordPress website that means current TLS on every page, timely updates to core, themes and plugins, strong authentication for administrator accounts, tested backups and logs that show who accessed what. Our WordPress maintenance and security services cover monthly security updates, plugin maintenance and performance monitoring for healthcare clients.

If personal data is lost, altered or exposed, the clock starts once you become aware of it. The ICO’s page on reporting a personal data breach says reportable breaches must be notified as soon as possible and, where feasible, within 72 hours, even if the full picture is not yet clear. Agree in advance who decides whether a breach is reportable and how your web supplier tells you about an incident.

Organisations with access to NHS patient data and systems must use the Data Security and Protection Toolkit, a self-assessment against the National Data Guardian’s 10 data security standards. Private providers that do not hold NHS data sit outside its scope, but its standards still make a useful benchmark when you review your website suppliers.

A Healthcare Data Protection Checklist for Your Website

A structured review of your website is the quickest way to find gaps and most fixes do not need a rebuild. Work through the points below with your data protection officer and your website team.

Priority Pixels has worked with NHS Trusts and private healthcare providers since 2016 and our healthcare projects identify who handles information governance during discovery. Bringing those people in early stops data protection questions holding up a launch.

• Map every form, booking tool and integration and record what data each collects and where it goes.
• Confirm the Article 6 basis and Article 9 condition for each and complete a DPIA where the risk calls for one.
• Remove fields you do not need and restrict access to stored submissions.
• Stop health details being copied into notification emails.
• Audit every cookie, pixel and script and block any that need consent until it is given.
• Remove advertising pixels from clinical and condition pages until you have a clear legal position.
• Rewrite the privacy notice so it matches the website, including how to make a complaint.
• Check contracts with your host, form, booking and analytics providers.
• Test backups, patching and administrator access and rehearse your breach response.

Repeat the review whenever you add a form, a booking tool or a new marketing platform, since each one changes how patient data moves through the website. Recording what you checked and changed gives you the accountability evidence the UK GDPR expects.