In short
- A website itself is not “HIPAA certified.” What matters is how it collects, stores and transmits anything that could identify a patient.
- Any form that asks about health, appointments or insurance is collecting protected health information and needs a secure path and a vendor with a business associate agreement.
- Analytics and advertising pixels on pages where patients enter information are the current enforcement focus. Audit them.
Where PHI shows up on a website
Contact forms (“reason for visit”), appointment requests, new-patient registration, prescription refill requests, telehealth links, chat widgets, review widgets that quote patients, and any page where a logged-in patient sees their own information. If an identifier (name, email, IP address) is combined with anything about health care sought or received, you are handling PHI.
The checklist
Forms
- Submitted over HTTPS, stored encrypted, and delivered to staff through a secure inbox or portal, not plain email.
- Form vendor signs a business associate agreement. Many popular form and email tools will not; choose one that will, or keep clinical questions off the form and collect them by phone or portal.
- Collect the minimum: name, phone, preferred time and “new or existing patient” is enough to book a call.
- Retention and deletion schedule for submissions.
Email and messaging
- No PHI in unencrypted outbound email, including appointment confirmations that name the service.
- Patient-facing messaging through the EHR portal or a secure messaging vendor under a BAA.
- Chat widgets: either no health questions, or a HIPAA-eligible vendor with a BAA.
Tracking technologies
- Inventory every script: analytics, ad pixels, session recording, heat maps, embedded maps and videos.
- Remove tracking from pages where patients enter information and from any authenticated area.
- Regulators have treated the combination of an identifier and a health-related page visit as PHI in some circumstances; the legal position has shifted, but the practical rule is to keep advertising pixels away from patient actions and to have a BAA with any analytics vendor that will sign one.
Hosting and transport
- HTTPS everywhere with a valid certificate and HSTS.
- Hosting under a BAA if the site stores any PHI; a brochure site that stores nothing needs secure hosting but not a BAA.
- Software kept updated (WordPress core, theme, plugins), with admin accounts limited and protected by two-factor authentication.
- Backups, and a plan for who restores them.
Policies and accessibility
- A Notice of Privacy Practices available on the site, and a website privacy policy that describes what the site collects.
- Accessibility to WCAG standards: alt text, contrast, keyboard navigation, captions. Practices receive accessibility complaints about websites regularly.
- Staff access to form submissions and the website back end reviewed when people leave.
Vendors
- Web developer, host, form tool, chat vendor, email marketing platform, review platform: each one either handles PHI (and signs a BAA) or is kept away from it by design.
Mistakes we fix most often
- A contact form with a “describe your symptoms” field delivered to a shared Gmail inbox.
- Advertising pixels firing on the appointment request confirmation page.
- Patient testimonials with full names and conditions, posted without written authorization.
- A patient portal link that opens an outdated vendor page with no HTTPS.
- Staff photos and bios fine; patient photos from the waiting room, not fine.
Compliance and conversion are not in conflict
A short, secure form converts better than a long one. A page that loads fast because it is not carrying six tracking scripts ranks better. Core MB’s website development service builds practice sites with these rules in from the start, and ties the forms to the practice’s workflow so a request becomes a booked appointment rather than an email nobody saw.
