If your practice's website books appointments, collects intake details, or runs ad tracking, knowing what makes a website HIPAA compliant is part of marketing your practice responsibly. No single plugin, badge, or hosting plan makes a site compliant on its own. HIPAA applies to organizations, and your website becomes part of your compliance picture once it starts handling patient information. What counts is how your site, the vendors behind it, and your team protect that information.
Healthcare website compliance is easier to manage when you know where to look. This guide walks through when HIPAA reaches your website, how the rules' requirements differ from good practice, and the features that deserve the closest attention: hosting, patient forms, security controls, and the analytics and ad tools that power your marketing.
When Does HIPAA Apply to Your Website?
HIPAA's privacy and security rules apply to covered entities: health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically, such as billing. They also apply to business associates, the vendors that handle protected health information on a covered entity's behalf. If you aren't sure where your practice stands, the U.S. Department of Health and Human Services (HHS) points providers to a CMS decision tool in its summary of the HIPAA Security Rule.
Not every page on a covered practice's website carries the same risk. Pages with general information, like your location, hours, or job openings, often don't involve patient information. The pages that deserve attention are the ones where people share details about themselves or their care:
- Appointment request and online scheduling pages, where visitors may enter contact details or a reason for their visit.
- Intake and contact forms that ask about symptoms, treatments, or health history.
- Patient portals and any other page that requires a login.
- Symptom checkers and similar interactive tools.
When HIPAA doesn't apply, other laws may, such as the FTC Act and the FTC's Health Breach Notification Rule.
HIPAA Website Requirements vs. Best Practices
The HIPAA Security Rule requires covered entities and business associates to put reasonable and appropriate administrative, physical, and technical safeguards in place for electronic patient information. It doesn't name specific products or technologies. It's designed to scale, so each organization can choose measures that fit its size, resources, and risks.
That flexibility is why it helps to separate three categories:
- Required. These must be in place. A key example is a risk analysis, which is an accurate and thorough assessment of the risks to the electronic patient information your organization handles.
- Addressable. These aren't optional. Based on your risk analysis, you decide whether each one is reasonable and appropriate for your organization. If it is, you implement it. If it isn't, you document why and implement an equivalent alternative measure, provided that alternative is reasonable and appropriate and achieves the purpose of the standard. If the standard can be met without either, you can choose not to implement either and document your rationale. Encryption falls into this category under the current rule.
- Best practice. These are steps worth considering because they reduce risk, even though HIPAA doesn't name them. Examples include multi-factor authentication for site logins and sending form submissions to a secure system instead of a regular inbox.
The Website Features That Deserve the Closest Look
The features that help your website bring in patients, like online booking, forms, and ad tracking, are often the same ones that handle patient information.
Here's what to review in each:
Hosting and Business Associate Agreements
If your website stores patient information, such as form submissions saved on the server, your hosting provider is handling that data on your behalf. Under HHS's cloud computing guidance, that makes the host a business associate, even if the data is encrypted and the host can't read it. You need a business associate agreement (BAA) in place, and storing patient information with a host that hasn't signed one is a HIPAA violation.
A BAA spells out how the vendor will protect the information, including following the Security Rule, holding its own subcontractors to the same standard, and reporting security incidents. When you compare options for HIPAA compliant web hosting, ask for the BAA early and read what it covers.
Appointment Requests and Intake Forms
Forms are where patients type in personal details, so they're worth mapping carefully. HIPAA doesn't ban sending patient information by email, but the information has to be adequately protected. In practice, that means knowing exactly where each submission goes after a patient clicks submit, who can see it, and how it's protected in transit and in storage. If patients book through a third-party scheduling platform, ask that vendor the same questions, including whether it will sign a BAA with your practice.
Hosting matters, but when Blackhawk reviews healthcare websites, the problems we find most often are forms that email patient details and ad pixels firing on patient actions.
Security Controls Behind the Scenes
For a website, the Security Rule's technical safeguards come down to five things: limiting who can log in to the backend, keeping a record of activity in systems that hold patient information, making sure stored information isn't improperly changed or deleted, verifying users before they get access, and protecting information as it moves between a patient's browser, your site, and wherever submissions are stored.
Encryption helps protect patient information, but it isn't enough by itself. It doesn't keep information available during an emergency or protect it from being corrupted by malware, and it doesn't replace the risk analysis and physical safeguards the rule also requires.
Analytics, Ad Pixels, and Tracking Tools
Analytics and ad platforms rely on tracking code, and HHS has published guidance on how HIPAA applies to tracking tools on a covered practice's website.
Tracking tools on pages that require a login, such as a patient portal, generally have access to patient information. A tracking vendor that receives patient information while performing a service for your practice, such as analyzing site activity, is generally a business associate. Without patients' authorization, sharing patient information with that vendor requires both a signed BAA and a disclosure the Privacy Rule permits, and a vendor's promise to remove or de-identify the information once it arrives doesn't change that. If a vendor won't sign a BAA, patient information can't go to it without patients' HIPAA authorization. HHS describes one alternative: a vendor that signs a BAA de-identifies the data first, and only that de-identified information is passed along to tools that won't sign.
In June 2024, a federal court in Texas set aside one part of that guidance: the portion saying HIPAA applies when tracking code connects an IP address with a visit to a public page about health conditions or providers. The rest of the guidance, including the sections on logged-in pages and BAAs, is still posted.
For your marketing, a practical next step is a tag audit: a list of every pixel and analytics tool on your site, the pages it runs on, and the information it collects. Share that list with your web team, your marketing agency, and whoever handles compliance at your practice, so everyone knows which tools touch patient information.
Why Compliance Doesn't Stop at Launch
HIPAA compliance is an ongoing process. The Security Rule requires periodic reviews of your safeguards, and you're expected to consider a new review when your environment changes, such as when you adopt new technology. Required documentation has to be kept for six years.
For a marketing team, that matters every time the website changes. A new landing page, booking integration, form, or tracking tag can change where patient information flows, so it's worth folding a compliance check into your launch process. The HHS office that enforces HIPAA also runs an enforcement initiative focused on risk analysis.
How Blackhawk Supports Healthcare Websites
Blackhawk is a digital marketing agency that works with healthcare practices and clinics, and our web team hosts and manages healthcare websites. That work includes encryption for data in transit, controlled access to your site's backend with documented access history, encrypted daily backups, and ongoing maintenance such as plugin updates, security patches, and uptime monitoring.
We also offer a compliance review that looks at your forms, analytics, and hosting setup and identifies what needs to change.
Frequently Asked Questions
Is There Such a Thing as a HIPAA-Certified Website?
No. There's no official HIPAA certification for websites or vendors. HHS doesn't certify technology products, and it doesn't recognize private companies' "HIPAA certified" labels. Those labels also don't protect an organization if a violation is found later. When a vendor uses the term, ask what it covers and request the BAA.
Do Cookie Banners or Privacy Policies Cover Tracking Tools?
Not under HIPAA. A privacy policy that mentions tracking doesn't, by itself, allow you to share patient information with a tracking vendor, and a cookie banner asking visitors to accept or reject cookies isn't a valid HIPAA authorization.
Is the HIPAA Security Rule Changing?
HHS announced proposed updates to the Security Rule in December 2024 and published the proposal in the Federal Register in January 2025. As of this writing, those changes haven't been finalized, and the current rule remains in effect.
Make Your Website Part of Your Compliance Program
A HIPAA compliant website comes from several pieces working together: the right vendor agreements, safeguards that fit your risks, careful setup of forms and tracking tools, and regular reviews as your site changes. Your compliance advisor or attorney can confirm what applies to your practice, and your website team can put the technical pieces in place.
If you'd like a second look at your site's forms, analytics, and hosting, talk with our team. A real person reads every message and replies within one business day.
