Nobody Can Sell You a Compliant Website
The phrase gets used as though compliance were a feature you buy, like SSL. It is not. HIPAA obligations belong to the covered entity — the practice. They attach to your workflows, your business associate agreements, your staff training and your safeguards. A website can support that or undermine it, but it cannot carry it for you, and any vendor who guarantees you are compliant because they built your site is describing something that does not exist.
That is worth saying plainly because we had a version of that claim on our own site until recently, and removed it.
The Line That Actually Matters: PHI
Protected health information is the trigger. The moment a web form collects information that identifies a patient and relates to their health, care or payment for care, the rules engage — the vendor handling that data needs a business associate agreement, the transmission and storage need appropriate safeguards, and you need a record of it.
The practical consequence is a design decision, not a technical one: keep clinical detail off the public form. A form that asks for a name, a phone number and a reason to call is asking for contact information. A form that asks a patient to describe their symptoms is asking for PHI, and now you have a compliance problem where you previously had a contact form.
Then Say So on the Form
If a form is not a secure channel for health information, the form should say so, briefly, where the patient can see it before they type. It is one line under the submit button. It protects the practice, and it tells a patient who was about to describe a condition to phone instead — which is better for them anyway.
It is one of the most commonly missing items on a medical site.
What a Well-Built Site Does Carry
Real, checkable things, none of which are compliance in themselves: encryption in transit, so a certificate that actually covers every hostname you serve. Intake scoped to contact information, with anything clinical routed to a channel that can hold it. Access control on anything administrative. Vendor visibility — you should be able to name every third party that receives form data, including analytics and chat tools, because each one is a question.
That last one catches people out. An AI chat widget that stores what visitors type is a place patients will volunteer health details whether you asked for them or not. Our own privacy policy says exactly that about ours, because it is true.
Accessibility Is Not a Separate Conversation
A patient using a screen reader has to be able to book. Accessibility obligations for healthcare providers arrive from a different direction than HIPAA, but they land on the same page, and a site that fails them fails a patient who is more likely than average to need you.
What to Ask a Web Vendor
Four questions, and the answers are short. What patient data does this site collect, and where does it go? Ask for the list of third parties. Will you sign a business associate agreement? If the site handles PHI, that is not optional; if the vendor is surprised by the question, that is your answer. What does the form tell the patient before they type? And who owns the site if I leave? That last one is not a compliance question, but a practice that cannot take its own site elsewhere cannot fix a compliance problem quickly either.
The Honest Summary
A website cannot make a practice HIPAA-compliant. It can be built so that it never becomes the weak point — collecting less, saying clearly what it is not, and naming everyone who touches the data. That is what we mean when we say a site is built for HIPAA requirements, and it is a smaller claim than the industry usually makes.
The Questions This Raises
Does a website need to be HIPAA compliant? Only if it creates, receives, maintains or transmits protected health information. A brochure site with a contact form asking for a name and a phone number generally does not. The moment the form asks about symptoms, conditions or treatment, it does.
How do you make a website HIPAA compliant? Strictly, you do not — the practice is the covered entity. What you do is reduce what the site touches: scope the form to contact details, say on the form that it is not a secure channel, encrypt in transit, control administrative access, and hold a business associate agreement with every vendor that receives the data.
How can I tell if a website is HIPAA compliant? You cannot tell by looking. Ask the practice who receives form submissions and whether a BAA exists with each of them. If nobody can answer, that is the answer.
Which website platforms are HIPAA compliant? Platforms are not compliant or non-compliant in themselves — but some will sign a BAA and most consumer website builders will not. That single question narrows the field faster than any feature list.