Home › Blog › HIPAA-Compliant Website

HIPAA-Compliant Website Requirements for Medical Practices

Forms, online booking, patient portals and tracking tools are where practice websites run into HIPAA. Here is what the rules require and how to set your site up safely.

The Short Answer

A medical practice website must follow HIPAA whenever it collects, stores or shares protected health information. That usually means contact and appointment forms, online booking, patient portals, live chat, and the tracking tools that run on those pages. A plain brochure site with no forms and no tracking on patient pages has little HIPAA exposure.

There is no official HIPAA certification for websites. Compliance depends on how the site handles patient data, and on signed business associate agreements (BAAs) with every vendor that touches it.

Where Websites Most Often Break HIPAA

Website feature	HIPAA risk	What to do
Contact or appointment form	High if it asks for symptoms, dates of birth or insurance	Use a form service that signs a BAA, encrypt submissions, keep health details out of notification emails
Patient portal or online booking	High: these pages are likely covered by HIPAA	No Google Analytics or ad pixels on these pages; vendor must sign a BAA
Live chat or chatbot	Medium to high: patients type health details	Use a chat vendor that signs a BAA, or tell patients not to share health details
Analytics on public pages	Lower after the 2024 court ruling, but still a privacy risk	Collect only what you need; consider an analytics tool that signs a BAA
Ad pixels and retargeting	High on any page tied to patient care	Keep them off portals, forms and booking pages
Website hosting	High if submissions or files are stored on the server	Choose a host that signs a BAA and encrypts data at rest
Email newsletters	Low if they contain no health details	Do not add patients to marketing lists based on their condition without permission

What Google Says About Google Analytics

Google's own help page on HIPAA is clear. It says Google "makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." It also says authenticated pages are likely covered by HIPAA and customers "should not set Google Analytics tags on those pages."

So Google Analytics can stay on your public pages, such as your home page and blog, but not on your patient portal, booking flow or forms. If you need analytics on those pages, use a tool whose vendor signs a BAA.

The 2024 Court Ruling on Tracking

In 2022, HHS issued guidance warning covered providers about tracking technologies, and it updated that guidance in March 2024. On June 20, 2024, a federal court in Texas (American Hospital Association v. Becerra) struck down one part of it: the idea that an IP address combined with a visit to a public page about a health condition counts as protected health information. HHS dropped its appeal in August 2024.

The rest of the guidance still stands. Tracking on logged-in pages, such as patient portals, and inside mobile apps can still expose protected health information. Treat those areas as off limits for ad pixels and standard analytics.

Your HIPAA Website Checklist

List every tool on the site: forms, chat, booking, analytics, ad pixels, heat maps, video and fonts. Know what data each one receives.
Sign a BAA with every vendor that handles patient data, including your host if form submissions are stored on the server. If a vendor will not sign one, do not send it patient data.
Use HTTPS everywhere and encrypt stored submissions.
Keep health details out of email. Form notifications should say "new request" and point staff to a secure system, not repeat the patient's message.
Ask only for what you need. A general contact form does not need a date of birth or a list of symptoms.
Keep ad pixels and standard analytics off portals, booking pages and forms.
Turn on strong logins, such as multi-factor authentication, for the website admin, hosting and any system that holds patient data.
Post your Notice of Privacy Practices on the site. HIPAA requires this when a covered provider has a website about its services.
Review the site once a year, and every time someone adds a new plugin, pixel or form.

Website Builders and Plugins

Many popular website builders and form plugins do not sign BAAs. That does not mean you cannot use them for your public pages. It means patient data should not flow through them. A common setup is a regular site for marketing pages, with forms, booking and the portal handled by HIPAA-ready services that sign BAAs.

Is a New Security Rule Coming?

HHS proposed a major update to the HIPAA Security Rule on January 6, 2025. It would make encryption and multi-factor authentication firm requirements in most cases. As of November 2026, the update is not final, and the current Security Rule still applies. Building to the proposed standard now, with encryption and multi-factor authentication, is a safe choice.

Need Help Building It Right?

Our IT team builds and fixes websites for medical practices, with HIPAA-ready forms, booking and analytics set up from the start. We also build sites for businesses in every other industry. See what a site costs in how much a website costs.

Sources: Google Analytics Help, "HIPAA and Google Analytics"; HHS Office for Civil Rights bulletin on online tracking technologies (December 2022, updated March 2024); American Hospital Association v. Becerra, N.D. Tex., June 20, 2024, and HHS's withdrawal of its appeal (August 2024); 45 CFR 164.520(c)(3); HHS proposed HIPAA Security Rule update (Federal Register, January 6, 2025). This is general information, not legal advice.

Frequently Asked Questions

Is there an official HIPAA certification for websites?

No. HHS does not certify websites or vendors as HIPAA compliant. A website is compliant when the way it collects, stores and shares patient information meets the HIPAA rules, and when every vendor that handles that information has signed a business associate agreement.

Can a medical practice use Google Analytics?

Only on pages that do not involve patient information. Google says it does not offer a business associate agreement for Google Analytics and that customers should not put its tags on logged-in pages such as patient portals. Keep it off booking pages, forms and portals.

Do website contact forms need to be HIPAA compliant?

Yes, if the form can collect health information, such as symptoms, appointment requests or insurance details. Use a form service that signs a business associate agreement, encrypts the data, and does not send the details in plain email.

What did the court decide about tracking on public pages in 2024?

In American Hospital Association v. Becerra (June 20, 2024), a federal court in Texas struck down the part of HHS guidance that treated an IP address plus a visit to a public health page as protected health information. HHS dropped its appeal. The rest of the guidance, including tracking on patient portals and apps, still applies.

Does a practice website need a privacy notice?

Yes. HIPAA requires a covered provider that has a website about its services to post its Notice of Privacy Practices prominently on the site.

Reviewed by Hassan Raza Awan, Founder — 4+ years of hands-on U.S. medical billing experience. General billing information — verify against current CMS guidance and your payer contracts.

Need the paperwork too? Use our Notice of Privacy Practices generator and HIPAA authorization form generator.

Need a HIPAA-Ready Website?

Our IT team builds secure websites, forms and booking for practices, and for businesses worldwide. Ask us for a free quote.

Get a Free Practice Audit