Accessibility and privacy
What Is a HIPAA Compliant Website?
HIPAA compliant website stands for Health Insurance Portability and Accountability Act.
A HIPAA compliant website is a site run by a healthcare provider, health plan or one of their vendors that protects any patient health information it collects, such as appointment requests or portal logins, as the HIPAA Privacy and Security Rules require.
What a HIPAA compliant website means in plain English
HIPAA, the Health Insurance Portability and Accountability Act, applies to covered entities: health plans, health care clearinghouses and health care providers that transmit health information electronically for standard transactions. It also reaches business associates, the vendors that create, receive, maintain or transmit protected health information (PHI) for them. A website is in scope when it handles PHI for one of these organizations.
Not every page is in scope. HHS says tracking tools on many public pages, such as visiting hours or job listings, have no access to PHI. A page is in scope when a visitor types or selects health details, for example booking an appointment, using a symptom checker or logging in to a patient portal. This page is a general explanation, not legal advice.
Why HIPAA compliance matters for a healthcare website
Healthcare sites collect sensitive details almost by default: names, contact details, reasons for a visit and insurance information. HHS guidance warns that analytics and advertising tools on those pages can pass that information to technology vendors. The Security Rule also requires administrative, physical and technical safeguards for electronic PHI, so a careless form or plugin can put the whole practice out of line.
A HIPAA compliant website example
A dental group adds an online booking form that asks for the patient's name, email and reason for the visit. Under HHS guidance, an advertising pixel on that page could disclose PHI to the pixel's vendor. The group removes ad tags from the booking flow, sends form data over HTTPS to a booking vendor that signs a business associate agreement, limits staff access and records its risk analysis.
Common HIPAA website mistakes
- Running advertising or analytics pixels on appointment, symptom checker or portal pages without checking what data they send.
- Using a form, hosting or email vendor that handles PHI but has not signed a business associate agreement.
- Trusting a HIPAA certified badge, when HHS says it does not endorse or recognize private certifications.
- Asking for more health detail in a general contact form than staff need to reply.
- Skipping the risk analysis the Security Rule requires before adding new forms, tools or vendors.
Which website vendors need a business associate agreement
| Vendor or tool | Handles PHI? | BAA needed? |
|---|---|---|
| Host or cloud storage that keeps form submissions | Yes, it stores them | Yes, even if the data is encrypted and the host holds no key |
| Online booking or form builder | Yes, it receives patient details | Yes |
| Email service that sends form notices with health details | Yes | Yes, or keep health details out of the email |
| Internet provider that only carries traffic | Passes it through | No, under the narrow conduit exception |
| Analytics or ad pixel on booking or portal pages | It can receive PHI | Yes, or remove the tag from those pages |
| Analytics on public pages such as visiting hours | Generally no | Generally no |
How to see what your booking page sends to other companies
- Open your appointment or contact page in Chrome, press F12 and choose the Network panel.
- Tick Preserve log, then fill in the form with made-up test details and submit it.
- Right-click any column header and add the Domain column, then sort by it and list every domain that is not your own.
- Mark the advertising, social media and analytics domains that fired on that page.
- Check each domain against your list of vendors with a signed business associate agreement; any without one should not receive form data.
What good looks like: Booking, symptom checker and portal pages send data only to your own site and to vendors with a signed BAA, and every request uses HTTPS.
Free tool: HHS: Use of online tracking technologies
Questions to ask your web developer
“Which vendors on this site will receive patient information, and do we have a BAA with each?”
A good answer: A named list covering hosting, forms or booking, email delivery and analytics, each with a signed BAA or a clear reason it receives no PHI.
“How are form submissions stored, and who can see them?”
A good answer: Encrypted in transit and at rest with a BAA-covered vendor, not sent in full by ordinary email, with access limited to named staff and logged.
“Which tags run on our appointment and patient portal pages?”
A good answer: Only those the BAA-covered vendors need. Ad and social media pixels are kept off those pages, and the tag setup is documented.
HIPAA compliant website: common questions
Is there an official HIPAA certification for websites?
No. HHS says no standard requires a covered entity to certify compliance, and it does not endorse or recognize private organizations' HIPAA certifications. A vendor's badge or certificate does not remove the practice's own legal duties, and HHS can still find a violation after a private certification has been issued.
Does my website need to be HIPAA compliant?
Only if HIPAA applies to your organization and the site handles protected health information. Covered entities and their business associates must protect PHI collected through forms, portals or tracking tools. A wellness blog that collects no patient data may sit outside HIPAA, though other privacy laws can still apply, so check your situation with a qualified lawyer.
Can healthcare websites use tracking pixels?
HHS guidance says tracking technologies may only use and disclose PHI as the Privacy Rule permits, and a tracking vendor that receives PHI generally needs a business associate agreement. On June 20, 2024, a federal court vacated part of that guidance about IP addresses on public pages, so review the current HHS page before adding tracking.
Sources
- HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
- HHS: Covered Entities and Business Associates
- HHS: Business Associates guidance
- HHS: Summary of the HIPAA Security Rule
- HHS FAQ: Are we required to certify our organization's compliance with the standards of the Security Rule?
- HHS: Guidance on HIPAA and cloud computing
Want a website that gets this right?
Every Billion Web Studio build includes technical SEO, schema and speed work as standard, with a fixed quote within 1 business day.