How Do You Make a HIPAA Compliant Website?
A Tucson counselor gets a letter from her malpractice carrier asking whether her website is HIPAA compliant. She looks at the site: her photo, her rates, her office on Grant Road, and a form that says tell us what brings you in. That last one is the whole problem.
Most Practice Sites Shouldn't Be Compliant
They should be irrelevant to HIPAA. A site holding no patient information has nothing to protect and nothing to report. The compliance work belongs on the intake and booking tools, which are separate products built for it.
One form field is usually what drags a site into scope.
"What brings you in today?" is a health question.
Build the website so it never receives patient information, and HIPAA has nothing to attach to. If the site does collect health details, compliance means four things: a signed business associate agreement with every vendor that can see the data, encryption in transit and at rest, per-user access controls with audit logs, and a written breach notification plan.
For a solo therapist or a two-chair dental office, the cheaper and safer arrangement is almost always a plain brochure site plus a separate scheduling or intake product that already carries the compliance burden. Those products exist, they sign agreements, and they cost a fraction of what it takes to make a general-purpose website defensible.
This is general information, not legal advice. Internet Crafters builds websites, and we're neither attorneys nor compliance auditors. HIPAA obligations depend on facts specific to your practice, so treat what follows as a way to ask your attorney better questions rather than a substitute for asking them.
Does a Small Practice Website Even Fall Under HIPAA?
Usually not, and that surprises people who've been told otherwise. HIPAA governs protected health information. A page listing your specialties, your hours, the insurance you take, and a phone number contains none of it, so there's nothing for the rule to reach.
What pulls a site into scope is collection. The moment a patient can type something about their health into your website, that information is protected wherever it lands, including the inbox it gets forwarded to.
Here's the ladder, from a site that's clearly outside to one that's clearly inside.
Most Tucson practices we talk to are sitting on rung three without realizing it. Somebody added a friendly "how can we help?" box to the contact form years ago and it's been quietly collecting health details ever since.
What Actually Makes a Website HIPAA Compliant?
Four things, and only one of them is really about the website. Signed agreements with every vendor that can see the data, encryption both in transit and at rest, per-user access with an audit trail, and a breach plan written before you need it.
Notice what isn't on that list. Nothing about your design, your content, or your platform. Compliance is about what happens to the data after somebody submits it, which is why "we built it on a secure platform" answers none of the question.
A signed agreement with everyone who touches the data
Called a business associate agreement. Your host, your form provider, your email service, your booking tool. Each one that can see patient information has to sign one, and most consumer-grade services will not.
Encryption on the wire and at rest
HTTPS covers the trip between the visitor and the server. Encryption at rest covers the copy sitting in a database or an inbox afterward, which is the half people forget. 45 CFR 164.312 is where these sit in the regulation.
Access controls and an audit trail
Unique logins per person, no shared front-desk password, and a log showing who opened which record and when. A shared login makes the audit trail worthless because it can't tell two people apart.
A breach plan written before you need it
Who gets called, how fast patients are notified, and who reports it to the Office for Civil Rights. Sixty days is the outer limit for notifying individuals after discovery.
Do You Need a Business Associate Agreement With Your Web Host?
Only if the host can see protected health information. A static site with no forms and no database gives your host nothing to sign for, because nothing patient-related ever reaches their servers.
Add an intake form that emails you what a patient wrote, and the picture changes fast. The host, the form service, and the email provider can all see that message, so each of them needs an agreement. That's usually three vendors, and the consumer tiers of most of them won't sign.
This is where practices get an unpleasant surprise. The website cost 500 dollars and the compliant email and form stack that has to sit behind it costs more per year than the site did outright.
It's also the argument for keeping the two apart. A brochure site on ordinary hosting, plus a scheduling product built for healthcare that handles anything sensitive on its own domain, keeps the regulated surface small and legible.
The cheapest compliant website is one with nothing to protect.
Keep the patient information on tools built to hold it, and the website stops being a liability question.
Are Google Analytics and Tracking Pixels Allowed on a Practice Website?
On ordinary public pages, yes, and the legal position changed in 2024. HHS had issued guidance treating an IP address plus a visit to a page about a health condition as protected information. In June 2024 a federal judge in Texas vacated that part, ruling in the American Hospital Association's case that the agency had exceeded its authority.
The practical read is narrower than the headline. Analytics on your homepage, your services page, and your about page sit on firmer ground than they did. Tracking inside a patient portal or on a page somebody reaches after logging in was never in question and is still off limits.
Where practices still get caught is form data leaking into an ad platform. If a booking form passes the appointment type into a conversion event, that's health information going to a vendor who hasn't signed anything, and no court ruling covers it.
The safe habit is to keep analytics on pages that anyone can reach without identifying themselves, and to keep every tracking script off the pages where somebody tells you about their health.
What Does a HIPAA Violation Cost a Small Practice?
Penalties run in four tiers based on how much you knew and how fast you fixed it. The floor is 145 dollars per violation for a practice that genuinely didn't know, and the ceiling is an annual cap of 2,190,294 dollars for willful neglect left uncorrected, under the amounts effective January 28 2026.
Per violation is the part that catches people. A misconfigured form isn't one violation, it's one per record exposed, which is how a small practice reaches a number that looks like a hospital's.
$145
Minimum penalty per violation in the lowest tier, the one for practices that genuinely didn't know, under the amounts effective January 28 2026 per the HIPAA Journal.
$2.19M
Annual cap for the top tier, willful neglect left uncorrected. Same 2026 schedule.
710
Large breaches reported to the HHS Office for Civil Rights in 2025, down 4.3 percent from the year before, per the HIPAA Journal's annual report.
61.5M
People whose health information was exposed in those breaches, a 78.7 percent drop from 2024's total of 289 million.
The breach numbers are worth reading the right way. Reported breaches fell slightly in 2025 and the count of affected people fell sharply, mostly because 2024 contained one enormous incident rather than because small practices got safer.
Enforcement against a two-person office is rare. The realiztic risk for a Tucson practice isn't a federal penalty, it's the notification letter you have to send every affected patient and what that does to a practice that runs on referrals.
What's the Simplest Setup for a Tucson Practice?
Split the job. Put the marketing on an ordinary website with no health questions on it, and put anything involving a patient's information on a product built for healthcare that will sign a business associate agreement. Two systems, one regulated, and the regulated one is somebody else's specialty.
A practical version looks like this. Services, bios, insurance accepted, directions, and a phone number live on the website, and a booking button hands the visitor off to a compliant scheduler on its own domain. Nothing sensitive is stored on the site at any point.
Website that stays outside HIPAA
- • Services, bios, hours, insurance accepted, directions
- • A phone number, because a call is not a web form
- • A contact form that collects a name and a number and nothing else
- • A booking button that hands off to a compliant scheduling tool on its own domain
- • No patient information ever stored on the website itself
Website that has to be compliant
- • Intake forms with symptom or history fields
- • Appointment types visible at booking
- • A patient portal or document upload
- • Live chat where somebody might describe a condition
- • Any of the above, plus a signed agreement with every vendor behind them, encryption at rest, per-user logins, audit logs, and a breach plan
Internet Crafters builds the left-hand column. Our websites for therapists and counselors are deliberately built without intake forms for exactly this reason, and the practices we work with route intake through a product that carries the compliance load.
Two related pieces if you're weighing the technical side: our explanation of static sites versus a CMS covers why a site with no database has a smaller attack surface, and whether your site needs to be ADA accessible covers the other compliance question practices ask us about.
Straight Answers
What Do Practice Owners Ask First?
The questions that come up on nearly every call with a Tucson practice.
Does a therapist in private practice need a HIPAA compliant website?
Only if the website itself collects health information. A site listing your specialties, rates, and phone number holds nothing protected. Most solo practices are better served by a plain brochure site plus a separate compliant intake tool.
Is an SSL certificate enough to be HIPAA compliant?
No. HTTPS covers data moving between the visitor and the server, which is one requirement out of several. It does nothing about encryption at rest, access controls, audit logs, business associate agreements, or breach notification.
Can you use Wix or Squarespace for a medical practice website?
For a brochure site with no patient information, yes. For anything collecting health details, check whether the platform will sign a business associate agreement. Most consumer website builders will not sign one on their standard plans.
What happens if a patient types their symptoms into a general contact form?
That message becomes protected health information the moment it arrives, and wherever it lands is now in scope. This is the most common way a practice website ends up regulated without anyone deciding it should be.
Who reports a breach, and how quickly?
The covered entity reports to the HHS Office for Civil Rights, and individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people carry additional notification requirements.
Does a website need a HIPAA notice of privacy practices posted on it?
Covered entities that maintain a website about their services must make the notice available on that site. That is a publishing requirement rather than a security one, and it applies whether or not the site collects anything.
Get the Website Out of the Compliance Conversation.
Internet Crafters builds practice websites for Tucson and Southern Arizona that hold no patient information at all, so HIPAA has nothing to attach to. Booking and intake get routed to tools built for it.
Bring your current site and we'll tell you which form fields are pulling it into scope. First hour is free inside Tucson city limits.
Written by Steve Bullis
Steve Bullis is the founder of Internet Crafters, a Tucson web studio building flat-rate websites for local businesses.
Sources
eCFR - 45 CFR 164.312, Technical safeguards
ecfr.gov
American Hospital Association - Judge rules in favor of AHA, vacating HHS online tracking bulletin (June 2024)
aha.org
HIPAA Journal - What are the penalties for HIPAA violations? 2026 update
hipaajournal.com
HIPAA Journal - 2025 healthcare data breach report
hipaajournal.com
HHS Office for Civil Rights - Breach portal
ocrportal.hhs.gov
External links open in a new tab. Internet Crafters has no affiliation with these publications.