What Makes a Website HIPAA Compliant? A Requirements ChecklistNine requirements, each tied to an HHS source, that a practice can check this week.

A website is HIPAA compliant when every system that touches patient information is covered by a Business Associate Agreement (BAA) and meets the HIPAA Security Rule safeguards. No certificate or badge proves it. The checklist below has nine requirements. Each one cites the HHS page it comes from.

HIPAA compliant websites at a glance

• HIPAA applies to a website when it creates, receives, stores, or sends patient information.
• A host, form tool, chat tool, or scheduler that handles that information is a business associate and needs a BAA.
• HHS does not endorse or recognize any private HIPAA certification.
• A covered entity must prominently post its Notice of Privacy Practices on any website it maintains.

When does HIPAA apply to a website?

HIPAA applies when a covered entity's website handles electronic protected health information (ePHI). HHS defines ePHI as "protected health information that is maintained in or transmitted by electronic media." A brochure page with office hours handles none. These features do:

• Appointment request and intake forms
• Online scheduling
• Live chat and chatbots
• Patient portals and login areas
• Online bill payment

What are the requirements for a HIPAA compliant website?

There are nine requirements. Check each one against your own site.

Which vendors need a BAA?

Every vendor that stores or handles patient information for the practice needs a BAA. HHS says the HIPAA Rules generally require a written contract with each business associate. The hosting company is included. HHS cloud guidance says a cloud provider that stores ePHI is a business associate even when the data is encrypted and the provider holds no key. HHS states that using such a provider without a BAA "is in violation of the HIPAA Rules."

What technical safeguards does the Security Rule require?

The Security Rule requires five technical safeguards. HHS summarizes them this way.

• Access control

  "Allow only authorized persons to access ePHI."

• Audit controls

  "Record and examine activity" in systems that handle ePHI.

• Integrity

  Ensure ePHI "is not improperly altered or destroyed."

• Authentication

  Verify that a person seeking access "is who they say they are."

• Transmission security

  "Guard against unauthorized access to ePHI that is being transmitted."

Some specifications in the rule are labeled "addressable." HHS is clear about that word: "The 'addressable' designation does not mean that an implementation specification is optional." A practice must adopt the measure or document why an alternative is reasonable.

Can a medical website use Google Analytics or ad pixels?

Not on pages where the tracker can reach patient information, unless the vendor signs a BAA. HHS guidance states: "Regulated entities must ensure that all tracking technology vendors have signed a BAA." Google says it does not offer a BAA for Google Analytics. A federal court vacated one part of the HHS guidance in June 2024. That part concerned IP addresses on certain public pages. The rest still stands. Our guide to HIPAA compliant website tracking shows how to check your pages.

Is there a HIPAA certification for websites?

No. HHS states: "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule." HHS adds that such certifications "do not absolve covered entities of their legal obligations."

How do you check your own website?

1. 1

   List every feature that collects data

   Write down each form, chat window, scheduler, and login on the site.

2. 2

   Name the vendor behind each one

   Include the hosting company and the email service that delivers form notifications.

3. 3

   Find the BAA for each vendor

   Mark each vendor as signed, available, or not offered. Replace any vendor that does not offer one.

4. 4

   Scan the pages for trackers

   Check every page with a form or login for ad pixels and analytics scripts.

5. 5

   Confirm the privacy notice link

   Make sure the Notice of Privacy Practices is linked from every page, usually in the footer.

6. 6

   Write it down

   Record the findings in the practice's risk analysis with the date.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want your site checked against this list, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.