Last verified: October 2026, against Wix's help center, App Market and HIPAA hosting page. General information, not legal advice.
Is Wix HIPAA compliant? Not by default, but it can be set up to support HIPAA: on eligible plans, Wix lets you switch on "PHI protection" and sign a business associate agreement (BAA). That puts Wix ahead of most website builders, and it also puts several decisions on you, from which apps stay installed to who receives form emails.
Short answer: is Wix HIPAA compliant?
Short answer (verified October 2026): Yes, with setup. Wix says "Wix is not HIPAA compliant by default" (Wix HIPAA hosting (opens in a new tab)), but sites on its Business, Plus, Elite, Business Elite or Enterprise plans can activate PHI protection and sign Wix's BAA (Wix Help Center (opens in a new tab)). The BAA covers HIPAA-enabled Wix services only, not other Wix services or unlisted third-party apps. Wix adds that "you are responsible for how you use and configure your site."
Interest is modest: "is wix hipaa compliant" gets about 70 searches a month (CPC $44.58) and "wix hipaa" 20 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What Wix's official documentation says about HIPAA and BAAs
Who and which plans. Wix offers HIPAA features to "eligible US healthcare providers and their business associates." Sites built in the Harmony Editor, Wix Studio Editor or Wix Headless qualify on Business, Plus, Elite, Business Elite and Enterprise plans. Activating on a lower plan prompts an upgrade.
How to turn it on. From a desktop (it can't be done on mobile), open the site dashboard's Compliance, Privacy & Cookies page, choose HIPAA Compliance, review the HIPAA-supported apps, select Activate PHI Protection, then sign the BAA. Wix recommends collecting no protected health information (PHI) until both steps are done.
What the BAA excludes, per Wix's BAA article (opens in a new tab):
- health data in Wix services that aren't HIPAA-enabled;
- third-party apps not marked HIPAA-compliant;
- data handled before you signed.
What changes when PHI protection is on:
| Area | What Wix says happens |
|---|---|
| Visitor analytics | Data that could identify visitors is hidden, so you lose some reports |
| Wix Inbox | Only HIPAA-compliant channels; you can't start new Facebook or Instagram conversations |
| Collaborators | They may see PHI, so give the minimum permissions |
| Invoices | Can be shared behind an access code |
| Plan cancellation | Data stays protected for 30 days, then the site is no longer HIPAA-compliant |
| Ownership transfer | The new owner must sign a new BAA |
Wix also says some Wix Analytics data isn't compatible with PHI-protected sites, so it hides that data (Wix Analytics request (opens in a new tab)).
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Wix Forms, Wix Bookings and member data: where PHI ends up
Wix Forms. Forms built with the old Wix Forms are the trap. Wix says data in them "may not be as securely handled as the latest version," that an old form can't be switched to the new Wix Forms, and that you must delete and recreate it. Then check notifications: the site owner gets a submission email by default, and you can add collaborators and outside email addresses (Wix Forms notifications (opens in a new tab)). Each inbox that receives submission details is another place PHI lives.
Your email address. Wix gives every site a generic sending address, and HIPAA sites get a HIPAA-compliant one. Once you connect your own business email, such as Gmail, Wix says the preset address is no longer used, so that email provider now carries the messages and needs its own BAA.
Wix Bookings. Bookings is in Wix's HIPAA-supported apps collection (opens in a new tab). Wix's one rule for it: don't add notes to individual bookings, because they "may contravene HIPAA regulations"; notes on client profiles in the contact list are fine. If your practice books through Wix, read online appointment booking for what the booking flow should and shouldn't ask.
Member data. Wix Members Area is also in the HIPAA-supported collection, alongside Wix Smart Chat, Wix Blog and 36 other apps as of October 2026.
App Market add-ons. Here's where most Wix sites drift. Once PHI protection is on, Wix hides non-compliant apps from App Market searches, but any third-party app you install still needs its own check. Wix says it can't vouch for the HIPAA compliance of apps or services it doesn't control, and that confirming each one with its provider is your job. Take a third-party live-chat app: if a visitor types symptoms into it, that app's maker is holding PHI, and you need its BAA, not Wix's.
When a Wix site is fine for a practice
A Wix site with no forms, booking, chat or member login is a brochure. It collects no patient information, and the plan and BAA questions don't arise.
Wix also works for a practice that collects information, if you do the setup:
- you're on an eligible plan and PHI protection is active;
- the BAA is signed, and re-signed after any change of site owner;
- old Wix Forms are rebuilt as new Wix Forms;
- every installed app is either in Wix's HIPAA-supported list or covered by its own BAA;
- form notifications go only to people and inboxes covered by a BAA.
Comparing options? See is Squarespace HIPAA compliant for a builder that limits its BAA to scheduling, or browse all HIPAA checks for website builders.
Making forms HIPAA-safe on a Wix site
- Audit what's installed. List every form, booking widget and chat tool, and note which app made each.
- Rebuild old forms in the new Wix Forms, then delete the old versions and export or delete their stored entries.
- Ask only what you need to reply. Name, phone, preferred time and a short reason are usually enough before a call.
- Trim notifications. Send alerts to named staff with collaborator roles, not shared or personal inboxes.
- Limit collaborator roles to the people who handle requests, and remove them when they leave.
- Or embed an outside form that signs its own BAA. Compare HIPAA form builders if you'd rather keep entries off Wix entirely.
Moving from Wix to a HIPAA-ready site
Some practices outgrow the setup: too many apps to vet, too much configuration that one staff change can undo. If you move, keep your domain, export your content, and map every Wix URL to its new address with a redirect. The moving off Wix safely checklist covers the order of operations.
Alternative to configuring it yourself: Medfy is not a do-it-yourself builder. It rebuilds your practice's website and hosts it on your own domain, with HIPAA-compliant forms. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with your practice. You see a free preview of the rebuilt site first: start with a free audit and site preview, or read how Medfy handles patient data.
Frequently asked questions
Does Wix sign a BAA?
Yes, as of October 2026, on eligible plans. Wix's help center says sites on Business, Plus, Elite, Business Elite or Enterprise plans, built in the Harmony Editor, Wix Studio Editor or Wix Headless, can activate PHI protection from the desktop dashboard and then sign Wix's BAA. The BAA doesn't cover non-HIPAA Wix services, unlisted third-party apps or data handled before you signed.
Is Wix Bookings HIPAA compliant?
Wix Bookings appears in Wix's collection of HIPAA-supported apps as of October 2026, so it can sit under Wix's BAA once PHI protection is active. Wix's guidance adds a limit: don't add notes to individual bookings, though notes on client profiles in the contact list are allowed. Review booking notifications and any connected calendar or payment apps separately.
Can a medical practice use Wix?
Yes. A brochure site with no forms, booking or chat collects no patient information. If your site does collect it, use an eligible plan, activate PHI protection, sign Wix's BAA, rebuild any old Wix Forms and remove apps outside Wix's HIPAA-supported list. Then limit collaborator access and keep form answers out of any email inbox that no BAA covers.