AI Web Center

// blog

What HIPAA Actually Asks of Your Practice Website

HIPAA doesn’t regulate your website as such. It regulates protected health information (PHI). The moment your site collects or shows information about a patient’s health, care or payment (an appointment request mentioning a condition, a patient portal, a message to the doctor), the systems handling it fall under HIPAA’s rules: vendors that touch it need a business associate agreement, the data needs safeguards, and access to it should be controlled and logged. A brochure site with your hours and services is a different story.

Last updated 3 min read

I’ve built software for clinical diagnostics and rebuilt a periodontal practice’s website with patient request forms, a staff back office, two-step sign-in and an audit log. These are the places where a practice website and HIPAA meet.

This is a practical overview, not legal advice. Your compliance officer or healthcare attorney should have the last word on your situation.

1. Forms that collect health information

An appointment request with “reason for visit: tooth pain since Tuesday” contains PHI. So does a new-patient form, an insurance form, or a “message your doctor” box.

What that means:

  • Every vendor that stores or transmits it needs a business associate agreement (BAA): your web host, your form service, your email provider, your database host. Many popular form builders and website platforms won’t sign one, or offer it only on specific plans.
  • Encrypt it in transit and at rest. HTTPS everywhere; encrypted storage and backups.
  • Collect only what you need. If the form only needs to book a slot, don’t ask for symptoms. Less data, less risk.

2. Email notifications

A classic leak: the website emails the full form submission (name, phone and the reason for the visit) to the front desk’s inbox, through a mail service with no BAA.

Better: send a notification that says “New appointment request #1042” with no health details, and have staff read the request in a secure, logged back office.

3. Patient portals and staff back offices

If patients sign in to see visits, results or messages, or staff sign in to manage requests:

  • Unique accounts for every person, and no shared logins at the front desk.
  • Strong authentication: two-step sign-in for staff at the very least.
  • Automatic sign-out after inactivity.
  • Audit logs: who viewed or changed which record, and when. HIPAA’s Security Rule expects audit controls, and when something goes wrong, the log is how you find out what happened.
  • Roles: a scheduler doesn’t need to see clinical notes.

4. Tracking pixels and analytics

This is where many practices got caught out. Marketing pixels and analytics scripts send data about each visit (often including the visitor’s IP address and the page they’re on) to third parties. HHS’s Office for Civil Rights issued guidance in 2022, updated in 2024, saying that this can be a disclosure of PHI, especially on pages like appointment scheduling or patient portals. In 2024 a federal court vacated part of that guidance, the part about purely public pages, but tracking on authenticated pages and anywhere a visitor reveals their health information still carries real risk, and there have been costly lawsuits and settlements over it.

Practical rule: no third-party tracking on forms, scheduling, portals or anything behind a login, and think hard about it everywhere else. Privacy-friendly, self-hosted analytics avoid most of the problem.

5. Hosting, backups and the boring parts

  • A host that signs a BAA, or your own server with proper controls.
  • Backups that are encrypted, tested and kept somewhere else.
  • Software updates on a schedule, not “when we remember”.
  • A written risk analysis. HIPAA requires one, and it doesn’t need to be long: what data you have, where it lives, what could go wrong, what you’ve done about it.

HHS has also proposed updating the Security Rule to make safeguards like encryption and multi-factor authentication explicit requirements rather than “addressable” ones. Wherever that ends up, building them in now is the safe direction.

6. Your privacy notice

Your website should link to your Notice of Privacy Practices, and your website privacy policy should honestly describe what the site collects, why, and who processes it.

A quick self-check

  • Does any form on your site collect health information? If yes, does every vendor in that path have a BAA?
  • Do notification emails contain health details?
  • Are there marketing pixels on your scheduling or portal pages?
  • Can you tell who looked at a patient’s request last Tuesday?
  • When did you last restore a backup?

If any answer made you hesitate, that’s your starting point.

The bottom line

A compliant practice website isn’t exotic. It’s careful: minimal data, vendors with BAAs, no trackers where patients reveal health information, real sign-in for staff, and a log of who did what.

I build healthcare websites and back offices with these safeguards designed in: secure request forms, staff portals with two-step sign-in, audit logs, and hosting under a BAA. If your practice site needs a rebuild or a review, let’s talk.

// keep reading