Health quizzes, risk calculators and symptom checkers on a practice website: privacy, FDA and wording rules

A short quiz on a practice website looks like a simple marketing tool: a few questions about sleep, joint pain, mood or skin, a score at the end, and a button to book a visit. Underneath, it is a form that collects health information, it may carry tracking code that sends what visitors click to other companies, and the result screen can read like a diagnosis. Each of those parts has its own rules, and they come from different places: HIPAA, state consumer health data laws, the Food and Drug Administration (FDA) and federal advertising law.

This guide is for owners and managers of independent practices, dental offices, med spas, chiropractic and integrative clinics who want to add a health quiz, a risk calculator or a symptom checker to their website, or who already have one and want to check it. It covers what the answers are under the law, tracking on quiz pages, how FDA looks at software that gives patients health recommendations, how to word results, and what to show visitors who may be in crisis. For the tracking question in depth, see our guide to tracking pixels and Google Analytics on a practice website. If you are weighing a chat tool instead of a quiz, see AI chatbots on practice websites, and for the Washington law that covers health data outside HIPAA, see our guide to the Washington My Health My Data Act. When a quiz is used to collect leads, the email, text and consent rules for the follow-up are in our guide to lead magnets and gated content.

The short version

• Quiz answers are health information. When a HIPAA covered practice collects answers that can be tied to a person, such as an email address entered to see results, those answers can be protected health information (PHI) under 45 CFR 160.103.
• Tracking code on a symptom tool is a named risk. The HHS Office for Civil Rights (OCR) bulletin says tracking on a public page where people use a symptom checker may collect PHI, such as the symptoms someone enters, and that sending it to a tracking vendor is a disclosure of PHI.
• State law can reach what HIPAA does not. Washington’s My Health My Data Act defines consumer health data to include symptoms and data inferred from other information, and requires consent before collection and separate consent before sharing, unless the data is needed to provide what the person asked for.
• FDA treats patient-facing recommendation software as a device. Its January 2026 guidance says software that gives recommendations to patients or caregivers meets the definition of a device. FDA’s separate policy lists symptom checklists and screening recommendations as lower risk functions it does not intend to enforce against at this time.
• Results should inform, not diagnose. Say what the tool is, where the questions come from, and what the result means and does not mean, then offer a visit. Do not tell a visitor they have a condition, or that they do not need care.
• Show 911 and 988 where it matters. A mood, substance use or eating quiz should tell visitors how to reach help now, on the first screen and on the results screen, without asking for an email first.

What this guide covers

Three kinds of tools come up on practice websites, and the rules below apply to each in a slightly different way:

• Quizzes and self-assessments: a set of questions with a score or a category at the end, such as a sleep questionnaire, a joint pain quiz or a skin type quiz.
• Risk calculators: a tool that takes numbers such as age, height, weight or blood pressure and returns an estimate or a risk band.
• Symptom checkers: a tool where a visitor enters or selects symptoms and gets back a list of possible conditions, a suggested level of care, or advice on whether to book a visit.

The same tool can be built in-house, embedded from a vendor, or run inside a landing page for an ad campaign. Where it runs and who receives the answers matter as much as the questions themselves.

Are quiz answers protected health information?

Start with the definitions. Under 45 CFR 160.103, health information is information created or received by a health care provider (among others) that relates to the past, present or future physical or mental health or condition of an individual, the provision of health care, or payment for it. Individually identifiable health information is the subset, including demographic information collected from an individual, that identifies the person or where there is a reasonable basis to believe it can be used to identify them. Protected health information is individually identifiable health information transmitted or maintained in any form or medium, with narrow exclusions such as employment records a covered entity holds as an employer.

Apply that to a quiz run by a covered practice. Answers about symptoms, sleep, mood or pain relate to a person’s health. Once they sit next to a name, an email address, a phone number or an appointment request, they identify the person. At that point the practice should treat the quiz record as PHI, with the same care as a contact form that asks for the reason for a visit. Our guide to website contact and appointment forms under HIPAA covers where a form submission goes and what the systems that store it need.

Two practical consequences follow:

• A company that receives the answers needs a basis to receive them. Under 45 CFR 164.502(a), a covered entity may not use or disclose PHI except as the Privacy Rule permits or requires. A quiz vendor, form builder or email platform that stores or sends identifiable answers for the practice is acting for the practice, and the practice should confirm in writing what the agreement with that vendor covers before answers flow through it.
• An anonymous quiz is a different design. A tool that shows a result on screen without asking for any contact details, and does not send the answers to anyone, collects far less. If the practice wants the answers, it can ask for them after the visitor chooses to book, on a form built for that purpose.

A practice that is not a covered entity, such as a cash-only med spa or wellness business that does not bill health plans electronically, may fall outside HIPAA. That does not make quiz answers unregulated. The state law and FTC sections below are written for that situation.

Tracking code on quiz and symptom pages

The OCR bulletin “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” names symptom tools directly. It says tracking technologies on a public page that lets people schedule appointments or use a symptom-checker tool without logging in may have access to PHI in certain circumstances. Its example: tracking technology might collect a person’s email address, or the reason for seeking care that they typed or selected, when they enter symptoms in an online tool to obtain a health analysis. In that example, OCR says, the practice is disclosing PHI to the tracking technology vendor and the HIPAA Rules apply.

In June 2024, a federal court in American Hospital Association v. Becerra vacated one part of the bulletin: the idea that HIPAA is triggered when tracking connects an IP address with a visit to a public page about a health condition or a provider. The HHS page now carries a note describing that vacated portion. The symptom-checker passage is about information a person enters, not about a page visit alone, and it remains on the page. Our tracking pixels guide explains the ruling and its limits in full.

For a quiz page, that points to a short list of decisions:

• Keep advertising pixels and session recording tools off quiz, calculator and symptom pages, and off the results screen.
• Do not send individual answers, scores or result categories to an analytics or ad platform as events, parameters or URL text. A results page address such as “/results?score=high-risk” can carry the answer into any tool that logs page addresses.
• If you need to measure the tool, count completions without the content of the answers, and check what each tag actually sends before launch.
• A cookie banner does not fix this. The OCR bulletin says a banner where visitors accept or reject cookies is not a valid HIPAA authorization. See our guide to cookie consent banners on a medical website for what a banner can and cannot do.

Session recording and chat tools raise separate questions under state wiretap laws, covered in our guide to chat, session replay and wiretap laws.

State consumer health data laws

Washington’s My Health My Data Act is the clearest example of a state law built for this kind of data. RCW 19.373.010 defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies their past, present or future physical or mental health status. The list of what counts includes individual health conditions, treatment, diseases or diagnosis, and bodily functions, vital signs, symptoms or measurements. It also covers information derived or extrapolated from non-health information, including inferred data, by any means, including algorithms or machine learning. A quiz result that sorts a visitor into a risk band is the kind of inferred data the definition describes.

Under RCW 19.373.030, a regulated entity may collect consumer health data only with the consumer’s consent for a specified purpose, or to the extent necessary to provide a product or service the consumer requested. Sharing needs consent that is separate and distinct from the consent to collect, unless it is necessary to provide what the consumer requested. Consent must be obtained before collection or sharing, and the request must clearly and conspicuously disclose the categories of data, the purpose and specific uses, the categories of entities it is shared with, and how to withdraw consent.

RCW 19.373.100 says the chapter does not apply to information that meets the definition of PHI under HIPAA, among other exemptions. For a covered practice, that means identifiable quiz answers handled as PHI fall under HIPAA rather than this Act, while a non-covered business, or data that is not PHI, can fall under the Act. Whether the Act reaches your business at all depends on its scope rules, which our Washington guide walks through.

Washington is not the only state. Nevada and Connecticut have their own consumer health data provisions, covered in our guide to consumer health data privacy laws beyond Washington, and comprehensive state privacy laws treat health data as sensitive data, with HIPAA exemptions that differ from state to state, as set out in state privacy laws and the HIPAA exemption. Check the states where your visitors live, not only the state where your office is.

For businesses outside HIPAA there is also a federal rule. The FTC Health Breach Notification Rule at 16 CFR 318.1 applies to vendors of personal health records, PHR related entities and third party service providers, and does not apply to HIPAA covered entities or to activities as a business associate. A wellness business that keeps quiz results in an account or app for its users should check whether it falls within that rule. Our guide to health app and telehealth startup marketing summarizes the FTC cases in this area.

Is a symptom checker a medical device?

The answer depends on what the tool does and what the practice says it does. The starting point is the law. The Federal Food, Drug, and Cosmetic Act defines a device in section 201(h), and section 520(o), added by the 21st Century Cures Act, excludes certain software functions from that definition. Two of the exclusions matter here:

• Section 520(o)(1)(B): software intended for maintaining or encouraging a healthy lifestyle that is unrelated to the diagnosis, cure, mitigation, prevention or treatment of a disease or condition.
• Section 520(o)(1)(E): certain clinical decision support software that supports or provides recommendations to a health care professional and enables that professional to independently review the basis for the recommendations, among other criteria.

FDA’s Clinical Decision Support Software guidance, issued January 29, 2026, says that software functions that support or provide recommendations to patients or caregivers, not health care professionals, meet the definition of a device. In other words, a patient-facing symptom checker does not get the clinical decision support exclusion, because that exclusion is for tools used by clinicians. The guidance adds that FDA intends to stay consistent with its existing digital health policies for these tools.

One of those policies, FDA’s Policy for Device Software Functions and Mobile Medical Applications (September 2022), lists examples of software that may meet the definition of a device but for which FDA intends to exercise enforcement discretion, meaning it does not intend to enforce device requirements at this time, because the software poses lower risk. The list includes:

• software that uses patient characteristics such as age, sex and behavioral risk factors to provide patient-specific screening, counseling and preventive recommendations from well-known and established authorities;
• software that uses a checklist of signs and symptoms to provide a list of possible medical conditions and advice on when to consult a health care professional; and
• software that guides a user through a questionnaire of signs and symptoms to recommend the type of health care facility suited to their needs.

FDA’s General Wellness guidance, updated January 6, 2026, covers products whose intended use relates to a general state of health, such as weight management, sleep management or stress management, or relates healthy lifestyle choices to reducing the risk or impact of certain chronic diseases where that link is well understood and accepted. It also lists claims outside that policy, such as a claim that a product will treat or diagnose obesity, or help treat an anxiety disorder.

What this means for a practice website, stated carefully: a quiz that encourages healthy habits, or a symptom checklist that suggests possible conditions and when to see a clinician, sits close to the examples FDA has described as lower risk or wellness. A tool that tells a visitor they have a specific condition, analyzes photos or device readings, or recommends a specific treatment is further from those examples. FDA guidance is nonbinding and describes FDA’s current thinking, and the line depends on the intended use, which includes what your marketing says the tool does. If a vendor or developer is building a tool with diagnostic language or image analysis, ask them in writing how they have assessed its regulatory status, and involve regulatory counsel. Our guide to medical device marketing claims covers how claims shape a product’s status.

Wording results so they inform without diagnosing

A quiz result is advertising for the practice as well as health information for the visitor. Section 5 of the FTC Act, 15 U.S.C. 45, declares unfair or deceptive acts or practices in or affecting commerce unlawful, so a result screen that overstates what the tool can tell, or that is rigged so each visitor scores “high risk” and is pushed to book, creates a deception problem on top of the clinical one.

Five habits keep results honest:

• Say what the tool is before the first question. For example: “This quiz is for general information. It cannot diagnose a condition and it does not replace a visit.”
• Say where the questions come from. If the quiz is based on a published screening questionnaire, name the source and check its terms of use. If the practice wrote the questions, say so.
• Describe the result, not the person. “Your answers match symptoms that are worth discussing with a clinician” is a description. “You have sleep apnea” is a diagnosis the tool cannot make.
• Avoid false reassurance. A low score should not say the visitor does not need care. Say that the quiz cannot rule anything out and that new or worsening symptoms deserve a visit.
• Score each visitor the same way. The scoring should follow the questions, not the practice’s booking targets. Keep a copy of the scoring logic and the result text with the date it went live.

For the wider question of disclaimers and what they can and cannot do, see our guide to medical website disclaimers and terms of use.

Crisis-adjacent quizzes: 911 and 988

A quiz about mood, anxiety, substance use, eating or self-harm can reach a visitor on a bad day. The tool is not monitored in real time, so it should tell visitors how to get help now. SAMHSA describes 988 as free, confidential support around the clock for mental health, substance use and more, by call, text or chat. A short notice such as “If you are in crisis, call or text 988. If you are in danger or need emergency care, call 911” belongs on the first screen and on the results screen.

• Do not put the crisis notice behind an email gate or at the end of the quiz.
• If a question asks about thoughts of self-harm, the next screen should show the 988 and 911 notice, whatever the answer.
• Do not promise a call back about a quiz answer unless someone will actually review answers and has a plan for urgent ones.

The same approach applies to chat tools, as set out in our guide to AI chatbots on practice websites.

Asking for an email to see results

Gating results behind an email address is the quickest way a quiz turns into identifiable health information. Before you add a gate, look at what follows from it:

• Under HIPAA, a covered practice that holds the email and the answers holds PHI, and each system that stores or sends that pair needs to be one the practice has confirmed in writing can handle PHI.
• Your own follow-up is one thing, a third party’s is another. The HIPAA marketing definition in 45 CFR 164.501 excludes communications that describe a health-related service provided by the covered entity making the communication, unless the practice receives financial remuneration from a third party for making it. Uploading quiz emails to an ad platform to build an audience is a disclosure to that platform, and the tracking guidance above applies.
• Under Washington’s law, where it applies, the consent request must come before collection and must say what is collected, why, who it is shared with and how to withdraw consent.
• Texts are a separate rule set. If results or follow-up go by text message, see our guide to text message appointment reminders.

A simpler design shows the result on screen, offers a booking link, and asks for contact details only on the booking form, where the practice already handles PHI.

Questions to ask before you launch a quiz

• Does the tool ask for a name, email, phone number or date of birth, and if so, why does it need them?
• Where are answers stored, who can see them, and what does our written agreement with each vendor say about health information?
• Which tags, pixels and scripts load on the quiz pages and the results page, and what does each one send?
• Do results page addresses or events carry answers or scores?
• Which states do our visitors live in, and do consumer health data or privacy laws in those states require consent before collection?
• Does any result tell a visitor they have, or do not have, a condition?
• Where do the questions and scoring come from, and is that stated on the page?
• Does a crisis-adjacent quiz show 911 and 988 on the first screen and the results screen?
• Has the vendor or developer told us in writing how they assessed the tool’s FDA status, if it goes beyond the lower risk examples FDA lists?

Use and avoid

• Use: “This quiz is for general information and cannot diagnose a condition.” Avoid: “Find out if you have [condition] in two minutes.”
• Use: “Your answers match symptoms worth discussing with a clinician.” Avoid: “You are high risk for [condition].” unless the tool uses a published method that supports that statement, named on the page.
• Use: “This quiz cannot rule anything out. If symptoms are new or getting worse, book a visit.” Avoid: “Good news: you do not need to see a doctor.”
• Use: “See your result now. Book a visit if you would like to talk it through.” Avoid: “Enter your email to unlock your results.” on a page with ad pixels.
• Use: “If you are in crisis, call or text 988. In an emergency, call 911.” Avoid: “We will reach out about your answers.” when nobody reviews them.

An illustration

This example is invented. [Practice name], a sleep and ENT practice, adds a ten-question sleep quiz to its website. The first version asks for an email address to show results, runs on a page that also carries an ad pixel and a session recording script, and ends with “You may have sleep apnea. Book now.” The results page address includes the score.

On review, the practice removes the pixel and the recording script from the quiz and results pages, changes the results address so it carries no score, and shows the result on screen without an email gate. The result now reads: “Your answers include signs that are worth discussing with a clinician. This quiz cannot diagnose sleep apnea or rule it out.” A booking button follows. The practice names the source of its questions, keeps a dated copy of the scoring and result text, and asks its attorney to confirm the Washington consent wording for its booking form, because it sees patients from across the state line.

Checklist

• Quiz, calculator and results pages carry no advertising pixels or session recording tools.
• No answers, scores or result categories appear in page addresses, events or parameters sent to analytics or ad platforms.
• Contact details are asked for only where needed, and each system holding them has a written agreement that covers health information.
• Consent wording is in place for states whose laws require it before collection or sharing.
• The page says what the tool is, where the questions come from, and that it cannot diagnose.
• Results describe answers, not conditions, and never tell a visitor they do not need care.
• Crisis-adjacent quizzes show 911 and 988 on the first screen and the results screen.
• Any tool with diagnostic language, image analysis or treatment recommendations has a written regulatory assessment.
• A dated copy of questions, scoring and result text is kept.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For quizzes and symptom tools, we can build a result-on-screen quiz with clear wording and crisis notices, keep tracking off the quiz and results pages, and document what each tag sends. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules on healthcare advertising, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (health information, individually identifiable health information, protected health information)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• RCW 19.373.010: Definitions (consumer health data)
• RCW 19.373.030: Collection and sharing of consumer health data, consent
• RCW 19.373.100: Exemptions
• 16 CFR 318.1: Health Breach Notification Rule, purpose and scope
• 21 U.S.C. 360j(o): Regulation of medical and certain decision support software
• FDA: Clinical Decision Support Software (January 2026)
• FDA: Policy for Device Software Functions and Mobile Medical Applications (September 2022)
• FDA: General Wellness: Policy for Low Risk Devices (January 2026)
• 15 U.S.C. 45: Unfair methods of competition unlawful; prevention by Commission
• SAMHSA: 988 Suicide and Crisis Lifeline

More in Practice websites, privacy and tracking