A quick note before we start: this is educational, not legal advice. Your compliance officer or healthcare attorney has the final word. What follows is a plain-English map of where HIPAA touches a typical practice website.
Most practice owners think of HIPAA as something that lives in the office — locked file cabinets, EHR logins. But your website collects, moves, and stores information too, and every one of those touchpoints deserves a second look.
Contact forms. When a prospective client writes "I've been struggling with anxiety since my divorce" into your contact form, that's protected health information the moment it hits your inbox. Ask: where does that message go, who can read it, and do you have a signed BAA with the company that handles it?
Analytics and tracking. Standard analytics tools can collect IP addresses and behavior tied to health-related page visits. Know what your tools collect, and turn off anything you don't need.
Hosting and email. Your host stores your site's data; your email provider carries client messages. Both should be companies willing to sign a Business Associate Agreement — and "willing to sign a BAA" is a reasonable first filter when choosing vendors.
Chat widgets and schedulers. That friendly pop-up chat and the online booking tool are convenient, but each is another vendor touching client information. Vet them the same way.
Telehealth links. If your site links out to video sessions, make sure the platform on the other end is one built for healthcare, not a consumer video app.
None of this requires becoming a security expert. It requires asking vendors direct questions, choosing tools built for healthcare, and revisiting the answers once a year. Start with the contact form — it's the front door.
This is the work we do every day: websites for health practices where privacy is part of the foundation, not an afterthought. Start a conversation →