“Is our website HIPAA compliant?” is one of the most common questions practices ask, and one of the most misunderstood. There’s no HIPAA certification for websites. What matters is whether your website collects, stores or shares protected health information (PHI), and if it does, whether that happens with the right safeguards and agreements in place. Here’s what that means in practice.
Most of your website is not PHI
Pages about your services, doctors, location and hours don’t involve PHI. HIPAA questions start where a patient enters information about themselves: contact forms, appointment requests, intake forms, patient portals, chat widgets and online payments.
Forms: collect less, and use the right tools
- Keep general contact forms to a name, contact details and a preferred time. Don’t ask for symptoms or medical history there.
- If you need online intake or anything that collects health information, use a form or portal provider that will sign a business associate agreement (BAA) with you.
- Make sure form submissions aren’t emailed in plain text to a general inbox.
Hosting and vendors
If PHI is stored on or passes through your website’s systems, the vendors involved, such as hosting, form tools or chat providers, generally need to sign a BAA. Many standard website hosts won’t, which is why most practices keep PHI in a dedicated portal or practice management system and keep the marketing website free of it.
Tracking pixels and analytics
Advertising and analytics tags can send data about visitors to third parties. A 2024 court decision struck down part of HHS’s guidance on tracking technologies on public web pages, but the rules still apply where PHI is involved, such as patient portals and booking flows. The conservative approach: no advertising pixels on pages where patients enter health information or log in, and count conversions without sending names or conditions.
HTTPS and security basics
Every page should load over HTTPS, forms should be protected against spam and abuse, and software should be kept up to date. These are basics rather than HIPAA-specific rules, but a breach starts with them.
A quick checklist
- Does any form collect health information? If so, is the vendor under a BAA?
- Are advertising pixels kept off portals, intake and booking pages?
- Are form submissions secure, not plain-text email?
- Is the whole site on HTTPS?
- Do you have a privacy notice that explains what the site collects?
If you’re planning a new site, see our medical website design service, which builds these safeguards in from the start.
This article is general information, not legal advice. Talk to your compliance advisor or attorney about your practice’s HIPAA obligations.