How to make a HIPAA compliant website

Does HIPAA apply to your website?

HIPAA applies to you if you are a covered entity. HHS says every health care provider, regardless of size, that sends health information electronically in connection with certain transactions, such as claims and eligibility checks, is one. Using email alone does not make a provider a covered entity.

Most of your pages are not where the risk sits. HHS notes that tracking tools on many public pages, such as location, visiting hours, and job listings, do not have access to patient information. The risk starts where a patient types or selects something.

Where websites go wrong

• Appointment pages and forms. HHS gives an example: a patient visits a clinic's appointment page and enters an email address or a reason for seeking care. That information counts as individually identifiable health information.
• Tracking tools. HHS says regulated entities are not permitted to use tracking technologies in a way that results in impermissible disclosures of PHI to the tool vendor. A vendor that receives PHI on your behalf is a business associate. A federal court vacated one part of HHS's bulletin in June 2024, the part about connecting an IP address to a visit to a public page about a health condition or provider. HHS says it is evaluating next steps, and the appointment page example is still in the bulletin.
• Hosting and cloud services. A cloud provider that stores or processes electronic PHI for you is a business associate, even if the data is encrypted and the provider holds no key. You need a BAA with it.
• Email. HHS says providers may email patients if they use reasonable safeguards, such as limiting the type of information in an unencrypted message. If a patient asks for appointment reminders by email, HHS expects you to accommodate the request.

Can you use a website builder?

Often yes, for a site that only publishes information such as your services, hours, and location. If the site collects health details through forms, booking, or chat, the builder and every add-on that handles that information need to be covered by a BAA. Some builders do not sign one, so confirm before you collect anything. Ask each provider three things:

• Will you sign a BAA with our clinic?
• Which parts of your service store or process patient information?
• Which add-ons and plugins does the agreement cover?

A checklist for your site

1. List what the site collects, page by page. A contact form and a booking form are different from a services page
2. Keep advertising and analytics tools off booking, form, and portal pages
3. Get a signed BAA from every vendor that stores or processes patient information, including hosting, forms, and scheduling
4. Keep forms short, and use set choices for visit type instead of free text where you can
5. Limit reminder messages to the time, the place, and how to change the appointment
6. Do not call the site or a vendor "HIPAA certified." No one can certify it
7. Review the list whenever you add a tool, a plugin, or a form

What we do

We build clinic websites with these choices in mind, and we sign a BAA with the clinic before handling patient information. See HIPAA-aligned websites, or run our free HIPAA website check on your current site.

This guide is general information, not legal advice. Your compliance adviser can confirm what applies to your practice.