Free HIPAA Website Check for Clinics
For medical, dental, behavioral health, med spa and chiropractic practices. See what your website shows the world about patient privacy: your privacy notice, patient forms, tracking tools and email security. Plain-English results, with the official source for every finding.
Enter your clinic's website
Checking your website
Starting the check
- Notice of Privacy PracticesWaiting
- Patient forms, chat and bookingWaiting
- Tracking toolsWaiting
- Email spoofing protectionWaiting
- EncryptionWaiting
- Outdated softwareWaiting
We only read public pages. We never log in or fill in forms.
HIPAA may not apply to your practice, but don't rely on this alone. We didn't see signs on your website that you take insurance. That is only a rough signal, because many practices bill insurance without saying so online. Providers that submit HIPAA transactions electronically, like insurance claims, are covered by HIPAA (CMS, who is covered). If that is you, treat HIPAA as applying. Cash-only practices may not be covered, but other federal and state privacy laws can still apply. Confirm with a healthcare attorney before you rely on this result.
This site uses Google Tag Manager. A quick check can't see tools that load after the page opens. Ask whoever manages your website what Tag Manager loads on your booking and form pages.
This tool is an automated website checker. It reads only publicly visible information, can make mistakes, and can miss things. It is not a HIPAA compliance certification, audit, or legal or professional advice. For anything important, feel free to consult us or any compliance expert or healthcare attorney you trust.
Need help with what this found?
Our team can walk you through each finding and help you fix it, from your privacy notice to your forms and tracking tools.
Three steps, about 20 seconds
Type your address and agree to the Terms. No login and no patient information needed.
We look at your home page and the pages patients use to book or fill in forms, plus your email setup. We never fill in forms or log in.
Each finding says what we saw, why it matters, the official source, and what to do next.
Six things, explained
- Notice of Privacy PracticesPractices covered by HIPAA must post it on their website. We look for it. If your site mentions substance use services, we also look for the 2026 Part 2 update.
- Patient forms, chat and bookingWhich tools collect patient details, and whether you should confirm a Business Associate Agreement with them.
- Tracking toolsWhether Meta or Google tracking tools load on pages where patients book, fill out forms or log in.
- Email spoofing protectionWhether your email domain is set up to stop impostors (SPF and DMARC).
- EncryptionWhether your site loads securely and stays that way.
- Outdated softwareOnly what your site openly shows.
What the labels mean
Questions about the check
Short answers. For anything about your own practice, ask your compliance officer or a healthcare attorney.
No. No outside scan can. HIPAA compliance covers your whole practice. This shows public-facing risks worth checking.
HIPAA applies to health care providers that send health information electronically for things like insurance billing. Many cash-only med spas and wellness clinics are not covered, though other privacy laws may still apply. If you're not sure, ask a healthcare attorney.
Not automatically. A 2024 federal court ruling limited HHS's guidance for general public pages. The concern is tracking tools on pages where patients enter information, like booking or intake forms, or behind a patient login.
It depends on your Google plan and whether a BAA was accepted. For intake with medical history, many practices use a dedicated healthcare forms tool.
If you keep records covered by 42 CFR Part 2, your privacy notice needed updating by February 16, 2026. The check looks for Part 2 language when your site mentions those services.
We don't collect any patient data. We keep the check's findings for a short time so repeat checks are fast.
AtlantiX Labs, a healthcare technology partner for solo, small and mid-sized US clinics, founded in Florida.
A healthcare technology partner for clinics
We build practice operations systems, AI workflow automation, websites, booking and apps for solo, small and mid-sized US clinics, and we sign a Business Associate Agreement before we touch any patient information. This check is free and we run no advertising trackers on this page. If you want to talk through what it found, you can contact us or read how we handle security and compliance.