HIPAA-Compliant Website: What Your Practice Needs

A HIPAA-compliant website protects any patient information it collects, stores, or transmits with encryption, access controls, and vendors that have signed a business associate agreement (BAA).

HIPAA does not certify websites, and no badge or plugin makes a site compliant. A page that only lists your hours and services collects no patient information. The risk starts when the site handles protected health information (PHI) through forms, chat, scheduling, or tracking scripts.

Does my practice website have to be HIPAA compliant?

Yes, if your practice is a covered entity and the site handles PHI. Not sure where your practice stands? Read who must follow HIPAA. If the answer is yes, the next question is which parts of your site touch patient data.

These website features commonly put PHI in play:

Contact or appointment request forms that ask about symptoms or conditions
New patient intake forms embedded on a page
Live chat widgets and chatbots
Online scheduling tools
Patient portals and login pages
Call tracking and email sign-ups tied to a health inquiry

Treat any form that links an identifiable person to a health concern as PHI. That rule is simple and keeps you on the safe side.

What makes a website HIPAA compliant?

Four controls matter most. They map to the safeguards in the HHS HIPAA Security Rule.

1. Encryption in transit

Serve every page over HTTPS with a current TLS version. Redirect all HTTP traffic to HTTPS. Mixed content, such as a form posting to an insecure address, breaks the protection.

2. Secure storage and hosting

Never leave form submissions in plain-text email or in your website database. If your host stores PHI, it needs to sign a BAA and encrypt data at rest. If your host stores only public pages, keep PHI off it entirely.

3. Access controls and audit logs

Give each staff member a unique login. Turn on multi-factor authentication. Remove access the day someone leaves. Keep logs of who viewed or exported submissions.

4. A BAA with every vendor that touches PHI

If a vendor creates, receives, stores, or transmits PHI for you, you need a signed BAA first. Here is what to verify in the agreement: HIPAA and the BAA. If a vendor refuses to sign, do not send it PHI.

Can I use Google Analytics or a Meta Pixel on my practice website?

Only with care. HHS Office for Civil Rights published a bulletin on online tracking technologies saying HIPAA-regulated entities cannot disclose PHI to tracking vendors without a permitted basis. Where a vendor handles PHI for you, a BAA is required. A federal court later vacated part of the bulletin, which narrowed how it applies to public pages. Ask your compliance advisor how the current rules apply to your site.

A practical policy that holds up either way:

Remove ad pixels and session-replay scripts from forms, scheduling, and login pages.
Keep analytics to public pages, or configure it to exclude identifiers.
Never pass form answers in URLs, page titles, or analytics events.
Review every script in your tag manager each quarter and delete the ones nobody owns.

How do I make website forms HIPAA compliant?

Forms are where most practice sites handle PHI. The simplest fix is to stop collecting PHI in your website's own form plugin. Use a form tool built for healthcare and embed it or link to it.

Follow this process:

List every form, chat widget, and scheduler on your site.
Mark each one that could collect health information.
Replace those with a form tool that signs a BAA and encrypts data in transit and at rest.
Embed the secure form or link to it from the page. Keep health questions out of the general contact form.
Submit a test entry. Confirm where it lands and who can open it.

Zentake delivers intake forms by SMS, email, in-office tablet, or an embedded web form, and it is built for HIPAA workflows with encryption and BAAs. For a buying checklist, see what to look for in a HIPAA-compliant form builder.

What should a safe general contact form ask?

Use a contact form for non-clinical questions only. Good fields:

Name and preferred contact method
Topic dropdown: new patient, scheduling, billing, records request, other
A message box with this note above it: "Do not include medical details. We will send a secure form if we need them."

Leave out symptoms, dates of birth, Social Security numbers, and insurance IDs. Collect those only in the secure form.

What about chat, email, and text on the website?

Standard website chat widgets and form-to-email plugins often transmit data in ways you cannot control. Use a chat vendor only if it signs a BAA. Do not forward form submissions to a regular inbox.

For text messages, send the patient a link to a secure form instead of asking for health details by reply. The same applies to email.

HIPAA-compliant website checklist

HTTPS on every page, with HTTP redirected
Inventory of every form, widget, and script
Signed BAA with each vendor that touches PHI
No PHI in plain-text email, URLs, or page titles
No ad pixels or session replay on forms, scheduling, or login pages
Unique logins and multi-factor authentication for staff
Software, plugins, and themes updated on a schedule
Privacy notice linked in the site footer
Website review written into your annual security risk assessment

The bottom line

A HIPAA-compliant website keeps PHI off systems that cannot protect it. Encrypt every page, sign BAAs with vendors that handle PHI, remove tracking from patient-facing forms, and move health questions into a secure form tool. See Zentake pricing to compare options for your practice.

Frequently asked questions

Is there a HIPAA certification for websites?

No. HHS does not certify or endorse websites, hosting providers, or software. A website is HIPAA-compliant when the way it handles protected health information meets the Privacy and Security Rules. That means encryption, access controls, signed BAAs with vendors, and safe handling of forms and tracking scripts.

Does a practice website need a BAA?

A practice needs a business associate agreement with any vendor that creates, receives, stores, or transmits protected health information for the practice. That can include form tools, hosting that stores submissions, chat tools, and email providers. A vendor serving only public pages that never touch PHI generally does not need one.

Can I use Google Analytics on a medical practice website?

Analytics on public pages that never collect patient information carries less risk than on forms, scheduling, or login pages. Keep analytics and ad pixels off any page where a patient enters health details, and do not send form values to analytics. Have your compliance advisor review your setup, since the legal guidance on tracking has changed.

Is a contact form on my website HIPAA-compliant?

A basic contact form is not HIPAA-compliant if it collects health details and emails them unencrypted or stores them with a vendor that has no BAA. Limit contact forms to non-clinical questions. Send anything involving symptoms, conditions, or medical history through a secure form tool that signs a BAA and encrypts data in transit and at rest.