First, a note on what this is
This checklist explains common website considerations for healthcare organizations. It isn't legal advice. Your compliance officer or healthcare attorney should review your specific setup.
Also note that there's no such thing as a "HIPAA-certified" website. HIPAA applies to how protected health information (PHI) is collected, stored, and shared — so what matters is how your site and its vendors handle that information.
Map where your website touches patient information
List every place information enters or leaves your site:
- Contact and appointment-request forms
- Patient-portal and online-scheduling links
- Live chat or AI assistants
- Email notifications sent from forms
- Analytics, advertising pixels, and session-recording tools
Forms and vendors
If a form collects PHI — symptoms, conditions, medications, insurance details — it should be processed by a HIPAA-eligible service that will sign a Business Associate Agreement (BAA). Standard form tools and regular email often won't. When a BAA isn't in place, limit forms to contact details and move clinical questions into your secure systems.
A simple rule: if you wouldn't put it on a postcard, don't collect it through a standard website form.
Tracking technologies
In December 2022 the HHS Office for Civil Rights issued guidance warning that analytics and advertising trackers on healthcare websites can disclose PHI. In June 2024, a federal court in American Hospital Association v. Becerra vacated part of that guidance — specifically the position that an IP address combined with a visit to an unauthenticated public page is PHI — and HHS later withdrew its appeal.
Other parts of the guidance were not vacated. Tracking on authenticated pages such as patient portals, and on pages that reveal why someone is visiting, remains high-risk without a BAA. A conservative approach:
- Keep advertising pixels off patient portals, scheduling flows, and condition-specific pages
- Configure analytics to collect the minimum necessary
- Review every third-party script on the site
- Document your decisions with your compliance team
Accessibility
HHS's 2024 Section 504 rule adopted WCAG 2.1 Level AA as the web accessibility standard for recipients of HHS federal financial assistance. In 2026, HHS extended the compliance dates: recipients with 15 or more employees now have until May 2027, with a later date for smaller recipients. Check current HHS guidance for the exact deadline that applies to you — and remember accessible design also simply makes your site easier for every patient to use.
Security basics
Every healthcare website should also have:
- HTTPS on every page
- Regular software updates and security monitoring
- Strong passwords and multi-factor authentication for website admins
- Backups you've tested restoring
- A clear privacy policy that matches what the site actually does
Building or updating a practice website? We design patient-friendly sites with privacy-conscious forms and analytics — talk with us.