01/20/2026
Does your website need to be HIPAA compliant?
I recently shared an article about a major website builder announcing that they’re now offering HIPAA compliant options in a private healthcare provider group.
The response surprised many people:
“I didn’t know my website needed to be HIPAA compliant.”
That reaction is actually very common.
According to the U.S. Department of Health & Human Services, the answer isn’t a simple yes or no.
It comes down to what your website does and what information flows through it.
Based on HHS guidance:
• If your website does not collect, transmit, or share patient information, HIPAA may not apply to the site itself
• If your website collects patient details (forms, appointment requests, symptom information, chat tools, etc.), HIPAA considerations come into play
• If tracking tools or analytics can link website activity to an identifiable patient, that matters
• If a third-party vendor helps collect or process that information, a Business Associate Agreement (BAA) may be required
• If you are a covered entity, your Notice of Privacy Practices should be posted and accessible
HIPAA doesn’t say “every healthcare website must be fully HIPAA compliant.”
It focuses on whether protected health information (PHI) is involved and how it’s handled.
For many practices, the website becomes the first place PHI enters the organization, often unintentionally.
That’s why the question isn’t:
“Is my website HIPAA compliant?”
It’s:
“What role does my website play in handling patient information?”
If you’re unsure, that uncertainty alone is usually worth a closer look.
Feel free to send me a message if you have any questions or feel confused about your website and HIPAA compliance.
