HIPAA compliance is one of the most misunderstood topics in healthcare website design. We've talked to practice owners who were told they can't have a contact form. Others who were sold expensive "HIPAA-compliant hosting" they didn't need. And many who are unknowingly violating HIPAA through third-party tracking scripts they don't even know are on their site.
Let's cut through the confusion. Here's what your healthcare website actually needs for HIPAA compliance — and what's just FUD designed to sell you overpriced services.
First: What HIPAA Actually Requires for Websites
HIPAA protects Protected Health Information (PHI) — individually identifiable health information. For your website, this means any place where a patient might submit health-related information alongside identifying information (name, email, phone number).
The key principle: your website must protect any PHI that passes through it. It doesn't need to be a fortress — it needs to be responsible with patient data in the specific places where patient data exists.
What Your Website Must Have
SSL/HTTPS Encryption
This is non-negotiable. Every page of your website must be served over HTTPS, not just the pages with forms. SSL encrypts data in transit — meaning anything a patient submits through your website is encrypted between their browser and your server.
In 2026, this should already be the case. Google Chrome marks HTTP sites as "Not Secure," and SSL certificates are free through Let's Encrypt. If your site isn't on HTTPS, fix it today — this is both a compliance issue and a trust issue.
HIPAA Notice of Privacy Practices
You're required to make your Notice of Privacy Practices (NPP) accessible to patients. On your website, this means:
- A dedicated page with your full NPP text
- A link in your footer accessible from every page
- Written in plain language (as much as possible — legal requirements make this challenging)
Privacy Policy
Separate from your HIPAA notice, your website needs a standard privacy policy covering:
- What data your website collects (form submissions, cookies, analytics)
- How that data is stored and used
- What third parties receive data
- How patients can request data deletion
Secure Contact Forms
Contact forms must transmit data over HTTPS (covered by your SSL certificate). But there's an important nuance: your contact forms should NOT ask for detailed medical information.
A HIPAA-safe contact form collects:
- Name
- Phone number
- Email address
- Preferred appointment time
- Brief reason for visit ("dental cleaning," "new patient exam" — not detailed symptoms)
A form that asks "Describe your medical condition in detail" combined with name and contact information is collecting PHI through your website — which means every system that touches that form data needs to be HIPAA-compliant, including your email server.
The simplest approach: keep forms general. Collect enough to schedule a callback, and gather detailed health information through your HIPAA-compliant patient intake system, not your website.
The Third-Party Tracking Problem
This is where most healthcare websites unknowingly violate HIPAA. In 2024, the HHS Office for Civil Rights issued guidance stating that tracking technologies on healthcare websites may constitute a HIPAA violation if they transmit PHI to third parties.
Common tracking scripts that may be problematic:
- Google Analytics: Captures IP addresses and page URLs. If your URLs contain health information (e.g.,
/conditions/diabetes-treatment), GA may be transmitting PHI to Google - Facebook Pixel: Sends page visit data to Meta, potentially including health-related page URLs
- Session recording tools: Hotjar, FullStory, etc. may capture form inputs, including health information
- Chat widgets: If patients share health information through a chat widget, that data flows to the chat provider
The safest approach:
- Use privacy-focused analytics (Plausible, Fathom) instead of Google Analytics, or configure GA4 with IP anonymization and restricted data collection
- Remove Facebook Pixel unless you have a BAA with Meta (you don't — Meta doesn't sign BAAs)
- If using session recording, configure it to mask all form fields
- Ensure any chat provider will sign a BAA
What You Don't Need
Let's debunk the common myths:
"You need HIPAA-compliant hosting"
Your website hosting only needs to be HIPAA-compliant if your website stores PHI. If your contact forms send data to your email (and you're not storing submissions on the web server), standard hosting is fine. You DO need HIPAA-compliant hosting for patient portals or any system that stores patient records.
"Every form needs a BAA with the form provider"
Only if the form collects PHI. A "Request an Appointment" form that collects name, phone, and preferred time isn't collecting PHI. A "Describe Your Symptoms" form with patient identifiers is. Design your forms to avoid collecting PHI, and this requirement disappears.
"You can't use any third-party services"
You can use third-party services — you just need BAAs with any service that may handle PHI. Your scheduling tool, patient portal, and email service (if receiving health information) need BAAs. Your font provider and image CDN don't.
"You need a HIPAA compliance badge"
There's no official HIPAA certification or badge. Any "HIPAA Certified" badge you see is from a private company selling their own certification. It's not required and it's not from HHS.
A Practical Compliance Checklist
- SSL/HTTPS on all pages
- HIPAA Notice of Privacy Practices page with footer link
- Website privacy policy
- Contact forms that don't collect detailed health information
- Remove or configure tracking scripts to avoid PHI transmission
- BAAs with any third-party service that handles PHI
- No Facebook Pixel (unless you enjoy regulatory risk)
- Secure email handling for form submissions
This checklist covers 95% of healthcare websites. If you're running a patient portal or storing health records on your web server, you have additional requirements — but that's a different system from your marketing website.
For the complete picture of what your practice website needs, see our 2026 medical practice website checklist.
Need a website that's compliant without being complicated? See our medical practice solution or our dental practice solution — HIPAA compliance is built into every site we build. Contact us with any compliance questions.