Is Wix, Squarespace or WordPress HIPAA Compliant?What each website builder's own terms say about patient data, checked October 9, 2026.
Wix signs a BAA on five plans. Squarespace bans patient data unless the account is HIPAA-enabled. WordPress depends on the host. Here are the details.
On this page
Wix signs a Business Associate Agreement (BAA) on five of its plans. Squarespace forbids patient data unless the account is HIPAA-enabled. WordPress has no vendor BAA, so compliance depends on the host. We read each company's own terms and help pages on October 9, 2026. The details for each builder are below.
Website builders and HIPAA at a glance
| BAA available | Where it applies | How to get it | |
|---|---|---|---|
| Wix | Yes | Business, Plus, Elite, Business Elite, and Enterprise plans | Activate PHI protection, then sign in the dashboard |
| Squarespace | Yes, for Acuity Scheduling | Acuity Premium or Powerhouse plan | Sign in Acuity settings |
| WordPress (self-hosted) | From the host, not from WordPress | Any host that signs a BAA | Sign with the hosting company |
| WordPress.com | None found in its terms | Not stated | Ask Automattic in writing |
When does a website builder need a BAA?
Is AI recommending you?
Webpatch can show you how your practice appears in ChatGPT, Google’s AI, and search — and what to fix first.
Check your visibility →A website builder needs a BAA when the site collects or stores patient information. HHS says a cloud provider that stores electronic protected health information is a business associate, even when the data is encrypted. A site with only office hours and directions collects none. A site with an intake form, a booking tool, or a chat window does.
Is Wix HIPAA compliant?
Wix supports HIPAA compliance on eligible plans. Its help center states: "HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans." The site owner completes two steps in the dashboard.
Open HIPAA Compliance
Go to Compliance, Privacy & Cookies in the site dashboard. Use a desktop browser. Wix does not allow activation from mobile.
Activate PHI protection
Review Wix's list of supported apps, then click Activate PHI Protection.
Sign the BAA
Click Sign Now next to Business Associate Agreement. Wix keeps a record of the signed agreement.
Wix advises owners not to collect or store patient information until both steps are complete. Activation changes the site in four ways:
- Apps. Wix hides unsupported apps from App Market searches. Third-party apps remain the owner's duty to verify.
- Inbox. Facebook and Instagram channels must be disconnected.
- Forms. Forms built with old Wix Forms must be deleted and rebuilt with new Wix Forms.
- Analytics. Wix hides visitor data that could identify a person.
Is Squarespace HIPAA compliant?
Not by default. Squarespace's Terms of Service, effective March 27, 2025, forbid using its services for protected health information unless the account "is designated as HIPAA-enabled and you enter into a separate business associate agreement with Squarespace."
Squarespace documents that HIPAA-enabled path for Acuity Scheduling, its booking product. An Acuity account on the Premium or Powerhouse plan can sign a BAA in its settings. We did not find a documented HIPAA path for forms on a standard Squarespace website plan. Ask Squarespace support in writing before any website form collects patient information.
Is WordPress HIPAA compliant?
WordPress is software, not a hosted service, so the answer depends on where it runs. WordPress.org describes it plainly: "WordPress is open source software." No company stores your site's data on your behalf by default. Two parties decide compliance.
The host
The hosting company stores the site and its database. It must sign a BAA if the site stores patient data.
The plugins
A form, chat, or booking plugin that sends data to its maker's servers makes that company a vendor too. It needs its own BAA.
WordPress.com is different. It is a hosted service run by Automattic. Its Terms of Service, last updated October 6, 2026, do not mention HIPAA or a business associate agreement. Treat a WordPress.com site as not covered unless Automattic confirms a BAA in writing.
Which builder should a medical practice choose?
Choose by what the website must do with patient data.
| Reasonable fit | |
|---|---|
| Information only, no forms that ask about health | Any of the three. No patient data is collected. |
| Forms and booking inside one builder | Wix on an eligible plan, with PHI protection active and the BAA signed |
| Booking only | Acuity Scheduling on Premium or Powerhouse, with the BAA signed |
| Custom features, portal, or integrations | WordPress or a custom build on a host that signs a BAA |
A BAA with the builder is one requirement of nine. Our HIPAA compliant website checklist covers the rest, including trackers, access, and the privacy notice.
How Webpatch helps
Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you are choosing a platform for a practice website, contact Webpatch.
This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.
Frequently asked questions
Does Wix sign a BAA?
Yes. Wix lets a site owner sign a BAA in the dashboard after activating PHI protection. Wix says HIPAA compliance is available with its Business, Plus, Elite, Business Elite, and Enterprise plans.
Can I use a Squarespace contact form for patient intake?
Not on a standard account. Squarespace's terms forbid protected health information unless the account is HIPAA-enabled and has a separate BAA with Squarespace.
Is Acuity Scheduling HIPAA compliant?
An Acuity account on the Premium or Powerhouse plan can sign a BAA with Squarespace in its settings. HIPAA-enabled accounts lose some features, including form answers in email notifications.
Does WordPress sign a BAA?
No. Self-hosted WordPress is open source software with no vendor that stores your data. The hosting company and any plugin vendor that handles patient data must each sign a BAA.
Is WordPress.com HIPAA compliant?
WordPress.com's Terms of Service, last updated October 6, 2026, do not mention HIPAA or a BAA. Treat it as not covered unless Automattic confirms a BAA in writing.
References
Related articles
More guides on getting found — and chosen.
