Is any website builder HIPAA compliant? What to check

Can a website builder be HIPAA compliant?

Yes, in one case, and only on the right plan with the right settings. Wix says sites on its Harmony Editor, Wix Studio Editor or Wix Headless "can be HIPAA compliant" once you activate PHI protection and sign its BAA (Wix Help Center (opens in a new tab)). Wix adds that "you are responsible for how you use and configure your site."

The others draw a line. Squarespace says its form blocks "can't be used as part of a HIPAA-compliant solution" (Squarespace form blocks (opens in a new tab)) and offers a BAA only for Acuity Scheduling (Acuity Scheduling and HIPAA (opens in a new tab)). Webflow's terms ask you not to collect PHI because Webflow "does not offer HIPAA compliant services at the present time" (Webflow Terms of Service (opens in a new tab)).

The audience asking is small but specific. "hipaa compliant website builder(s)" gets about 170 searches a month (CPC $62.21, keyword difficulty 0), and the single-builder checks follow: Squarespace 90 (CPC $70.54), Wix 70, WordPress 40, GoDaddy 40 and Webflow 20 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).

Not sure what your current site collects or loads? Get your free audit and site preview: the audit's ads check flags privacy risks such as pixels on patient forms, and it reads public information only.

The two questions: will it sign a BAA, and where does form data go?

1. Will the vendor sign a BAA for what you actually use?

HIPAA defines a business associate as a person who, on a covered entity's behalf, "creates, receives, maintains, or transmits protected health information" (45 CFR 160.103 (opens in a new tab)). A builder that stores your contact-form submissions fits that description. Without a signed BAA covering that product and plan, patient information shouldn't go there.

Check the scope, not just the yes. Squarespace's Acuity BAA doesn't cover Squarespace form blocks. Wix's BAA "does not cover health data stored or processed through non-HIPAA enabled Wix services," nor third-party apps that aren't marked HIPAA-compliant (Wix BAA article (opens in a new tab)).

2. Where does each submission go?

Follow one appointment request through a typical builder site:

• The builder's own storage. Squarespace keeps form-block submissions in the block; Webflow stores them and lets you download a CSV.
• The notification email. Squarespace sends submissions to your account email by default. Whoever hosts that inbox now holds PHI.
• Connected services. Google Drive, Mailchimp, Zapier, a CRM. Each copy sits with another vendor that needs its own BAA.
• Scripts on the page. Chat widgets, analytics tags and ad pixels load on the same page as the form.

If any stop on that path lacks a BAA, the setup has a gap, whatever the builder says about encryption.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Squarespace, Wix, WordPress, GoDaddy and Webflow at a glance

As of October 2026, from each vendor's own pages. Each builder name in the BAA column links to our full, dated check.

A few details behind the table:

• Squarespace's terms say you may not use its services to handle "protected health information" unless the account is designated HIPAA-enabled and you sign a separate BAA (Squarespace Terms of Service (opens in a new tab), section 7.4). In practice that means Acuity.
• Wix hides apps that aren't HIPAA-compatible from App Market searches once PHI protection is on, and still says you must confirm any third-party app with its provider.
• WordPress.com's current terms (updated October 6, 2026) don't mention HIPAA or BAAs (WordPress.com Terms of Service (opens in a new tab)). Jetpack's form block saves responses in the site's database, emails them to the form owner and, if Akismet is on, sends them to Akismet for spam checks (Jetpack Forms (opens in a new tab)).
• GoDaddy's help center and legal agreements returned "access denied" to every check we ran on October 23, 2026, so we state no verdict.
• Webflow's security page says it "is not designed to store or process protected health information" (Webflow Security (opens in a new tab)).

Brochure sites vs sites that collect patient information

A brochure site publishes and nothing more: services, hours, provider bios, insurance accepted, a map and a phone number. If nothing on it collects or stores patient information, the builder's BAA stops being the main question, and any of the five can host it.

The picture changes the moment the site has any of these:

• a contact or appointment-request form ("Tell us about your symptoms")
• online booking that captures a reason for visit
• a chat widget
• a patient login or member area
• file uploads such as insurance cards or referral letters

Each can receive PHI. A name next to a reason for visit is enough, and a plain "How can we help?" box invites people to type a diagnosis anyway. Check the scripts too: an ad pixel or chat script on a page with a form loads right alongside it, so ask each vendor what it collects.

A middle path many practices take: keep the brochure on the builder, and send everything that collects information to a service that signs a BAA.

Adding HIPAA-compliant forms to a builder site

The usual fix is to embed a form from a service that signs a BAA, so answers go straight to that service and never land in the builder.

1. Pick a form service that signs a BAA on the plan you'll buy. Compare options in HIPAA compliant form builders.
2. Embed it using your builder's embed or custom-code option. Check that your plan includes custom code before you commit.
3. Remove the builder's own form from that page, so no second copy lands in the builder's storage or your inbox.
4. Strip answers from notifications. Set the alert to "new request received" and have staff read the details inside the form service.
5. Audit the parent page. Some embeds load the form in a frame served from the vendor's domain; others inject the fields straight into your page, where any script on that page can see them. Ask the form vendor which kind you have, and remove analytics, ad pixels and session recorders from form pages you don't need them on.
6. Test it. Submit a fake request, then look everywhere a copy could appear: your inbox, the builder dashboard, any connected app.

Scheduling works the same way: use a scheduler that signs a BAA and embed or link it. Squarespace's own option is HIPAA-enabled Acuity Scheduling, which turns off some features (for example, email notifications no longer include client form answers).

When to move off a website builder

Moving makes sense when:

• you need forms, booking or chat on the site itself and the builder won't sign a BAA for them;
• the workarounds have multiplied: a form tool here, a scheduler there, a chat widget, each with its own login and BAA to track;
• nobody owns the site, so new services never get a page and nobody checks speed;
• you can't say where last month's form submissions are stored.

Staying makes sense when the site is brochure-only, changes rarely and someone on staff is comfortable editing it. Moving has real costs: URL mapping, redirects and DNS changes. Weigh them in builder vs managed site, and see HIPAA compliant websites for what else a practice site needs, from hosting to tracking.

How Medfy differs from a website builder

The practical differences from the five builders above:

• No form workaround. Form submissions go to Medfy's encrypted HIPAA databases and land in an access-controlled patient CRM and inbox, with role-based permissions and an audit log of who saw what.
• No weekly upkeep on you. The base plan includes a page per service, structured data, researched articles each week that you approve, and 500 AI credits a month for edits you ask for in plain English.
• Marketing without patient data. Marketing uses aggregate numbers only, and ad platforms never receive patient data.

The base plan is $349 a month, billed monthly, cancel anytime (Medfy pricing). Read how Medfy handles patient data for the details.

Frequently asked questions

Is there a HIPAA compliant website builder?

No builder is compliant on its own, but as of October 2026 Wix offers a BAA once you activate PHI protection on an eligible plan, and Squarespace offers one only for Acuity Scheduling. Webflow's terms say not to collect PHI. WordPress depends on your host and plugins, and GoDaddy's pages blocked our checks. Whichever you use, the setup and every connected service decide compliance.

Can I use Squarespace for a medical practice website?

Yes, for public information such as services, hours, providers and directions. Squarespace says its form blocks can't be part of a HIPAA-compliant solution, and its terms bar handling PHI without a HIPAA-enabled account and a separate BAA, which it offers for Acuity Scheduling. Keep patient requests off Squarespace forms: embed a form service that signs a BAA, or use HIPAA-enabled Acuity for booking.

Is Wix HIPAA compliant?

Wix can be, with setup. As of October 2026, sites on Wix's Business, Plus, Elite, Business Elite and Enterprise plans can activate PHI protection and sign Wix's BAA. That BAA excludes non-HIPAA Wix services and unlisted third-party apps, and forms built with old Wix Forms must be rebuilt. Wix says you remain responsible for how you configure and use the site.

Does my website need to be HIPAA compliant if it only shows information?

HIPAA governs protected health information, not web pages as such. A site that only publishes services, hours, bios and directions, with no forms, booking, chat or patient login, usually collects no PHI, so the builder's BAA matters less. Still check what third-party scripts on the site collect, and revisit the question the day you add a form, a scheduler or a chat widget.

Can I add HIPAA compliant forms to Wix or Squarespace?

Yes. On Squarespace, embed a form from a service that signs a BAA, because Squarespace says its own form blocks can't be part of a HIPAA-compliant solution. On Wix, you can use the new Wix Forms after activating PHI protection and signing Wix's BAA, or embed an outside service. Either way, keep answers out of notification emails and remove unneeded scripts from form pages.