Last verified: October 2026, against Webflow's terms, security page, pricing page and developer documentation. Webflow's help center blocked our checks. General information, not legal advice.
Is Webflow HIPAA compliant? No, and Webflow says so in its own terms. Few people search the question, but plenty of practices end up on Webflow because a design agency built their site there, so it's worth knowing where patient information can and can't go, and who keeps the site current after launch.
Short answer: is Webflow HIPAA compliant?
Short answer (verified October 2026): No. Section 3.6 of Webflow's Terms of Service (opens in a new tab), "HIPAA Non-Compliance," asks you not to provide or let site visitors provide protected health information (PHI), because "Webflow does not offer HIPAA compliant services at the present time." Its security page (opens in a new tab) says Webflow "is not designed to store or process protected health information." Use Webflow for public pages only, and send forms and booking to services that sign a business associate agreement (BAA).
Demand is small, about 20 searches a month for "is webflow hipaa compliant" (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). We cover it because agencies commonly build practice sites on Webflow, and owners inherit the platform without choosing it.
What Webflow's official documentation says about HIPAA
Two pages, both clear:
- Terms of Service, section 3.6 (effective November 15, 2023): you acknowledge the platform "may not be compliant" with HIPAA and agree not to provide, or enable end users to provide, PHI in your site content or otherwise through the platform. The plain-English summary beside it: "Please do not collect Protected Health Information using the Platform."
- Security page FAQ: "Webflow is not HIPAA compliant by default and is not designed to store or process protected health information." It adds that most marketing and informational sites "don't handle sensitive data," and that for regulated use cases Webflow "can be used alongside custom hosting or compliant backends."
We also tried Webflow's help center for HIPAA articles; it returned "access denied" to our checks in October 2026. Nothing we could read offered a BAA.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Webflow forms and where submissions go
Trace a single appointment request through a native Webflow form:
| Stop | What happens | Source |
|---|---|---|
| Webflow's storage | Webflow collects the submission; you can download submissions as a CSV | Webflow pricing (opens in a new tab) |
| Notification email | Webflow sends customizable notification emails | Webflow pricing |
| Data API | Apps with access can list every submission for a form | List Form Submissions (opens in a new tab) |
| Webhooks | A form_submission event sends the field data to another server | Form Submission event (opens in a new tab) |
| Automations | Zapier's "New Form Submission" trigger fires when a visitor submits any published form | Webflow's Zapier page (opens in a new tab) |
Webflow's own Zapier page describes one submission creating a HubSpot contact, a Slack notification and a Google Sheets row. On a practice site, that's one patient message copied into four vendors, none of them covered by Webflow. If your agency set up automations like this, check each tool, starting with is Zapier HIPAA compliant.
Plan limits differ too: the free Starter plan caps form submissions at 50 per site.
Using Webflow for a practice's public pages
Webflow is a reasonable home for content that publishes and doesn't collect: service pages, provider bios, insurance information, locations, articles and FAQs. That matches Webflow's own description of marketing and informational sites.
To keep it that way:
- remove native Webflow forms that patients might use to describe symptoms or request care;
- send "Request an appointment" buttons to a scheduler that signs a BAA;
- keep newsletter sign-ups to name and email, with no health questions;
- audit scripts (analytics, ad pixels, chat) on any page that embeds a form or booking tool.
Connecting a HIPAA-ready form or scheduler
- Pick a form service or scheduler that signs a BAA on the plan you'll pay for. Compare HIPAA form builders.
- Embed it with Webflow's custom code or embed element, and confirm your plan allows custom code.
- Delete the old native form and export or delete stored submissions that contain health details.
- Turn off automations that fired on the old form: Zapier zaps, Make scenarios, webhooks to CRMs.
- Set notifications to content-free alerts inside the new service.
- Ask how the embed loads. A form in its own frame from the vendor's domain is isolated from your page's scripts; fields injected into your page are not.
Who maintains a Webflow site week to week
Most Webflow practice sites are built by an agency or freelance designer, then left alone. Before you decide to stay, answer these:
Maintenance check:
- Weekly content: who writes and publishes articles, and who reviews them for clinical accuracy?
- New service pages: when you add a treatment, who builds its page, and how fast?
- Speed checks: who tests page speed after new images or scripts are added?
- Designer time: what does each change cost after launch, and is it in a retainer or billed hourly?
- Access: if the agency relationship ends, does the practice own the Webflow account and workspace?
If those answers are "nobody" or "it depends," the site will drift. See working with marketing agencies for how to set expectations, and builder vs managed site for the alternative. Other platforms are compared in the HIPAA checks for website builders.
Alternative to a builder plus an agency: Medfy is not a do-it-yourself builder. It rebuilds your practice's website and hosts it on your own domain, with HIPAA-compliant forms. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with your practice. You see a free preview of the rebuilt site first: start with a free audit and site preview, or read how Medfy handles patient data.
Frequently asked questions
Does Webflow sign a BAA?
No BAA is offered, as of October 2026. Webflow's Terms of Service ask customers not to provide, or let site visitors provide, protected health information, saying Webflow does not offer HIPAA compliant services at the present time. Its security page adds that Webflow isn't designed to store or process PHI. Keep patient information in a separate service that signs a BAA.
Can I collect patient information with Webflow forms?
No. Webflow's terms ask you not to collect protected health information on the platform, and native form submissions are stored by Webflow and sent in notification emails. Use an embedded form or scheduler from a service that signs a BAA instead, and check any automation, such as a Zapier zap, that already moves Webflow submissions into other apps.
Is Webflow a good choice for a medical practice website?
For public pages it can be: services, provider bios, locations and articles, with forms and booking handled by BAA-covered tools. The bigger question is upkeep. Webflow sites are often built by agencies, so ask who adds service pages, publishes articles, checks speed and fixes broken links each month, and what that designer time costs after launch.