HIPAA Compliant Website: What Your Practice Actually Has to Do in 2026

There is no such thing as a HIPAA certificate for a website. No agency issues one, no regulator inspects one, and any vendor selling you a compliance badge for your homepage is selling you a badge. What exists instead is a narrow set of rules that apply to particular things a site does, and a much larger set of things on your site the rules never touch.

That distinction is the entire article. Most of a medical practice website is ordinary marketing content with no patient data anywhere in it: the service pages, the clinician bios, the directions, the blog, the careers page. The compliance work concentrates in four narrow places. Knowing which four keeps you from paying for security theater on pages that never needed it, and from missing the pages that did.

The 30-second answer

If your practice is a HIPAA covered entity, your website has to protect patient information it collects, stores or transmits, and in practice that means four things: forms that collect patient details, third-party scripts that watch what visitors do, the vendors holding that data, and any logged-in patient area. Every vendor that touches that data needs a signed business associate agreement. Public pages carrying no patient data are not the problem. Separately from HIPAA, healthcare organizations receiving federal financial assistance from HHS must meet WCAG 2.1 Level AA, and that deadline moved in May 2026 to May 11, 2027 for recipients with fifteen or more employees. HIPAA penalties start at $145 per violation and are capped at $2,190,294 a year for identical violations.

First question: is your practice even covered

Not every health business is bound by HIPAA. The rules reach three groups, defined at 45 CFR 160.103: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction. If you bill insurance electronically, you are in. A cash-only practice that never files a claim electronically may not be, and a wellness app with no provider relationship usually is not.

Falling outside HIPAA is not the same as falling outside everything, and this is where health startups get caught. The FTC's Health Breach Notification Rule was written for exactly the businesses HIPAA misses. The Commission finalized amendments to it in April 2024, published at 89 FR 47028 on May 30, 2024 and effective July 29, 2024. Among the changes: for a breach affecting 500 or more people, the FTC has to be notified at the same time individuals are, and in no case later than 60 calendar days after discovery.

What counts as patient information on a website

Protected health information is individually identifiable health information, and the test is not whether a page mentions a medical condition. It is whether something identifying a person is tied to their health, their care, or payment for their care. A page describing your knee replacement service is not PHI. A form where a visitor types their name, phone number and "knee pain, worse at night" is.

Demographic details count once they arrive in that context, which is why an email address submitted through an appointment request sits in a different category from the same address dropped into a general newsletter box with nothing attached to it. Two consequences follow. Most of your website is genuinely out of scope. And the moment you add a form field asking why someone is getting in touch, the page holding that field changes character.

The four places compliance actually lives

Four things on a practice website carry real obligations: forms, third-party scripts, the vendors behind them, and the logged-in area if you have one. Everything else is a normal website.

Forms that collect patient details. Appointment requests, symptom questions, insurance details, file uploads. Ask what the form genuinely needs. A field you do not collect is a field nobody can leak, and most practices are collecting a clinical paragraph on a public form when a callback request would do.

Third-party scripts. Analytics, advertising pixels, chat widgets, heatmaps, embedded schedulers, review widgets. Each one is code from another company running on your page and reading what happens there. This is the category that produces almost all the enforcement, and it gets its own section below.

The vendors holding the data. Hosting, the form processor, the email inbox those submissions land in, the scheduler, the CRM. Form data emailed to a Gmail address is form data sitting in Gmail.

Any logged-in patient area. Portals, results, messaging. This is the highest-risk part of the site and usually the part that is not built by your web agency at all, which is a reason to be precise about where one system ends and the other begins.

Who has to sign a business associate agreement

Any outside company that creates, receives, maintains or transmits PHI on your behalf is a business associate, and so is a data transmission service that needs routine access to it, and so are their subcontractors. That definition also sits in 45 CFR 160.103. The agreement itself is required by 45 CFR 164.502(e), which requires satisfactory assurances documented in a written contract.

The practical test is short. List every vendor that can see form submissions or portal data. For each, either a signed agreement exists or that vendor must not receive PHI. There is no third option, and "they told us they are HIPAA compliant" is not the same as a signature.

Google is the cleanest illustration because it publishes its own list. The HIPAA Included Functionality page, in the version effective May 14, 2026, names the services its business associate agreement covers: Gmail, Google Calendar, Google Chat, Google Drive with Docs, Forms, Sheets, Slides and Vids, Google Meet, Google Sites, Google Groups, Google Keep, Google Tasks, Google Vault, Google Voice for managed users, Cloud Identity Management, Apps Script, AppSheet and the Gemini apps. Google Analytics is not on that list. Neither are third-party add-ons. Google also says outright that customers without a signed agreement must not put PHI into these services at all.

The tracking script problem

Analytics and advertising pixels are where healthcare websites actually get into trouble, and most of the enforcement has come from the FTC rather than from HIPAA regulators. On July 20, 2023 the FTC and the HHS Office for Civil Rights sent a joint letter to roughly 130 hospital systems and telehealth providers, naming the Meta or Facebook pixel and Google Analytics specifically, and warning that these tools can reveal conditions, diagnoses, medications, treatments and where somebody sought care.

The money has followed the same pattern. GoodRx agreed to a $1.5 million civil penalty on February 1, 2023 in the first case ever brought under the Health Breach Notification Rule, over unauthorized disclosures to Facebook, Google and others. BetterHelp agreed on March 2, 2023 to pay $7.8 million to consumers, over revealing sensitive data to third parties such as Facebook and Snapchat after promising to keep it private, which the FTC called its first action returning money to consumers whose health data was compromised. Cerebral agreed to an order requiring it to pay more than $7 million, announced on April 15, 2024.

This is not history. On July 29, 2026, the FTC together with Utah and California sued Hims & Hers, alleging among other things that the telehealth company shared health information with Meta, Snap and other third parties while promising privacy. Those are allegations in a complaint, not findings, and the case is unresolved. It is also five days old as we publish this.

The HIPAA side of the same question has an odd twist worth knowing, because a lot of published advice is out of date on it. OCR's bulletin on online tracking technologies took the position that an IP address combined with a visit to a public page about a health condition was protected information. Hospital groups sued, and on June 20, 2024 a federal judge in the Northern District of Texas vacated that part of the revised bulletin as beyond the agency's authority. HHS withdrew its appeal on August 29, 2024.

Read that carefully before you relax. What the court removed was a specific theory about unauthenticated public pages. Everything behind a login is untouched by the ruling and squarely covered. And nothing in that case binds the FTC, which is the agency actually collecting money. The workable rule for a practice site: keep advertising pixels off pages tied to specific conditions and off the appointment flow, never put anything identifying into a URL or query string, and treat any vendor receiving that traffic as one that needs a signed agreement or needs removing.

What it costs when this goes wrong

HIPAA penalties are tiered by what you knew and what you did about it. The statutory tiers live at 45 CFR 160.404, and the amounts are inflation-adjusted every year in a table at 45 CFR 102.3. The current published figures run from $145 per violation where you genuinely did not know, to $73,011 per violation for willful neglect left uncorrected, with a cap of $2,190,294 for identical violations in a calendar year.

Per-violation is the phrase that should hold your attention. The tiers are a range, not a forecast, but a single misconfigured script does not misfire once. It misfires for every visitor, every day, until somebody notices.

The Security Rule bits a website actually touches

The technical safeguards are shorter than most checklists suggest, and one detail surprises nearly everyone. Under 45 CFR 164.312, unique user identification and an emergency access procedure are required. Automatic logoff and encryption are listed as addressable. So is encryption in transit, under the transmission security standard. The rest of the section covers audit controls, integrity of the data, and verifying that whoever is asking for access is who they claim to be.

Addressable does not mean optional. It means you either implement it or document why an alternative is reasonable for your setup, and the documenting is the part that gets skipped. In 2026 there is no defensible reason to skip encryption on a website anyway, so treat this as a paperwork question rather than an engineering one.

HHS proposed rewriting the whole Security Rule in a notice published at 90 FR 898 on January 6, 2025, which would tighten many of those addressable items into requirements. As of August 2026 it is still a proposal. Build as though it will land, because the things it proposes are things a competent build does anyway.

The healthcare accessibility deadline that just moved

This one is a different law with a different deadline, and it moved three months ago. On May 9, 2024, HHS published a final rule under section 504 of the Rehabilitation Act, at 89 FR 40066, requiring recipients of federal financial assistance from HHS to make their web content and mobile apps conform to WCAG 2.1 Level A and AA. Then, on May 11, 2026, the department published an interim final rule at 91 FR 25496 extending both compliance dates by a year.

Two things to check before you act on that. Whether your organization is a recipient of HHS financial assistance is a genuine question with a real answer, and it is not the same question as whether you are a HIPAA covered entity. The two sets overlap without matching. Second, the rule at 45 CFR 84.85 carries exceptions, including archived web content, conventional electronic documents that predate your compliance date and are not used to access your services, content posted by unrelated third parties, and password-protected documents about a specific individual.

Our advice is unchanged by the extension. If you are rebuilding anyway, build to WCAG 2.1 AA now, because doing it during a build costs close to nothing and retrofitting a finished site costs real money. We wrote the design side of this in our piece on healthcare website design and trust.

What to ask the agency building your site

Six questions separate an agency that has done this before from one that will learn on your project.

Which vendors will touch form submissions, and which of them will sign a business associate agreement? Which third-party scripts load on condition pages and on the appointment flow, and can you show me the list? Where do form submissions actually go, and are they emailed anywhere in plain text? Who holds admin access after launch, and what is the process for removing someone? Will you build to WCAG 2.1 AA, and how will you show me you did? And if we part ways, who keeps the site, the domain, the content and the analytics history?

An agency that answers "we use HIPAA compliant hosting" and stops has answered roughly one sixth of that. Hosting is the easiest part.

What we do here, and who we are wrong for

We build healthcare websites, and we are not a compliance firm. That line matters because the two get sold as one thing. Our work is the site itself: the pages, the forms, the speed, the structure, the script inventory, and picking vendors that will sign when they need to. We do not write your policies, run your risk analysis, or give you a legal opinion, and any agency offering all of that with a website is selling something outside its competence.

You can see our numbers without booking anything. A focused build is $1,499, charged once. Continuing work is $2,499 a month. Both are on the pricing page. Behind those numbers sit 200+ shipped projects, a typical two week turnaround on a focused build, and a 48 hour answer to any partnership request. On results, Cornerstone Healing Center's website conversions rose 20 percent after the redesign we did for them, which is the closest proof we have of a clinical audience making a hard decision quickly.

Where we are the wrong call: if you need a compliance program rather than a website, hire a firm that does that. If you are a health system with enterprise procurement and a security questionnaire, we are too small. If your project is really custom portal software integrated with an EHR, that is a different discipline. Our healthcare page covers what we do build, and the practices we do it best for are ones whose site is quietly losing people who were ready to call.

An audit you can run this afternoon

You do not need anyone's help to find out where you stand. Open your site in a private browser window with the developer tools network tab showing, click through to a condition page and start an appointment request, and write down every outside domain that loads. That list is your third-party script inventory, and for most practices it is longer than expected.

Then list every form on the site and where each submission lands. List every vendor from those two exercises and mark which ones have a signed agreement on file. Tab through the site with the keyboard only, and run one page through a contrast checker. Finally, write down who currently has admin access, including former staff and former agencies.

Five lists, one afternoon, no invoice. If the finished lists make you uncomfortable, that discomfort is the finding, and it is a far cheaper way to learn it than the alternatives described further up this page.