Is Your Practice Website HIPAA-Compliant? What to Check

Most practice owners assume HIPAA lives inside the EMR and the front office, not on the marketing site. Then a patient uses the contact form to describe a symptom, or the “Book an appointment” button quietly sends data to an ad platform, and suddenly protected health information is flowing through pages nobody thought of as clinical. That’s the part that catches practices off guard: your website can create HIPAA obligations without a single chart ever being opened.

Here’s a clear-eyed look at what actually triggers HIPAA on a website, what to check, and the mistakes we see most often. One important note before we start.

This is general information, not legal advice. HIPAA is fact-specific, and the details of your practice matter. Use this as a checklist to guide a conversation with your own attorney or compliance advisor, not as a substitute for one.

What actually triggers HIPAA on a website

A brochure-style website that just lists your services, hours, and providers usually isn’t handling protected health information at all. HIPAA gets involved the moment your site starts collecting, transmitting, or exposing information that ties a person to their health, and there are three common places that happens.

The first is forms. A basic “contact us” form asking for a name and email is low-risk on its own. But add a field where a patient can describe why they’re reaching out, and people will tell you everything: the symptom, the diagnosis they’re worried about, the medication they need refilled. The moment identifying details meet health details, you’re likely holding PHI, and it needs to be collected and stored securely, not emailed around in plain text.

The second is live chat and chatbots. Patients treat a chat window like a private conversation with your office, so they volunteer sensitive things. If that transcript is stored, or if it’s powered by a third-party service, that vendor is now touching PHI on your behalf.

The third, and the one practices miss most, is analytics and tracking. Standard tools like Google Analytics and the Meta (Facebook) pixel are designed to watch what visitors do and phone that data home to build ad audiences. On a general business site that’s harmless. On a medical site, the page someone views, the “request an appointment for [condition]” button they click, or the appointment page they land on can reveal a health condition when it’s tied to their device or IP. Regulators have made clear that feeding that kind of information to ad platforms can be a HIPAA violation, and several large health systems have paid dearly for it.

The BAA question you can’t skip

Any outside company that handles PHI on your behalf is a “business associate,” and HIPAA requires a signed Business Associate Agreement (a BAA) with each one before they touch that data. On the website side, that can include your web host, your form or scheduling provider, your live-chat vendor, your email service, and in some configurations your analytics or tag manager.

The trap is that many popular, convenient tools simply will not sign a BAA. The free tier of a form builder, a consumer chat widget, the standard version of an analytics suite, plenty of these explicitly say they aren’t for PHI. If a vendor is touching protected data and won’t sign a BAA, that isn’t a paperwork gap you can wave off. It means that tool is the wrong tool for a medical practice, and you need a version or a competitor that will stand behind it in writing.

What to check on your own site

Start by walking your site the way a patient would and asking, at each step, “could someone hand me health information here, and where does it go?” Open every form and look at the free-text fields. Find out exactly where those submissions land: an inbox, a database, a third-party dashboard, and whether that path is encrypted. Check whether you have a live chat, what service runs it, and whether transcripts are stored.

Then look under the hood at what’s loading on the page. If you’re not sure what tracking scripts are running, that alone is a red flag worth resolving. Confirm the whole site runs over HTTPS, not just the homepage. And pull together your list of vendors and match it against your signed BAAs so you can see, in one place, who’s handling data and who’s actually under agreement.

A genuinely HIPAA-conscious practice website is built with these questions answered from the start, rather than bolted on after a form has been quietly leaking for a year.

The mistakes we see most often

The most common one is the innocent contact form that invites patients to “tell us what’s going on,” then emails the reply to a Gmail address in plain text. The intent is kind; the exposure is real. Close behind is the marketing pixel dropped on the appointment or “conditions we treat” pages to measure ad performance, sending condition-linked behavior straight to an ad platform with no BAA in sight.

We also see practices assume a compliant EMR or scheduling widget covers the whole site, when the marketing pages around it are wide open. And we see the “we’ll deal with it later” website, running on a consumer host with mismatched or missing agreements, humming along until an audit or a breach forces the issue. None of these come from carelessness. They come from treating the website as separate from compliance, when to a patient it’s the front door to your practice.

A few questions we hear

Getting this right isn’t about fear, it’s about building the front door of your practice so it protects patients the way the rest of your office already does. If you’d like a second set of eyes on your site, that’s the kind of thing we do every day, and in each area we take only two practices per specialty, so a competitor can’t hire us to outrank you.