This HIPAA compliance checklist for your website ties every item to the HIPAA provision or guidance behind it and says who owns it: your practice, your vendor, or both. Run it when you launch a site, change vendors, or add a form or script. It covers the website only; your practice's wider program has its own practice-wide HIPAA checklist.
Honest note on demand: "hipaa compliance checklist website" gets about 10 searches a month at a $36.68 cost per click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). We built it anyway because the other HIPAA website guides need a reference to point to.
General information, not legal advice. A checklist does not make a site compliant: that also takes your practice's own HIPAA risk assessment, written policies and staff access rules. Checked October 2026.
How to use this HIPAA website compliance checklist
Work through it with whoever manages your site open on a second screen. Tick an item only when you've seen the evidence: the signed BAA, the setting, the page. Each line ends with the owner:
- Practice: your decision or your staff's task.
- Vendor: your website, hosting, form or chat provider's job, which you verify.
- Both: shared.
Copy the list into your compliance binder or a spreadsheet and add a date and initials per line. For context on why each area matters, see the HIPAA compliant website guide.
Forms and patient messages
- Every form that collects names plus health details is covered by a BAA with the form provider. Why: sharing PHI with a vendor requires written assurances (45 CFR 164.502(e) (opens in a new tab)). Owner: Practice.
- Forms load over HTTPS and submit over HTTPS. Why: transmission security (45 CFR 164.312(e) (opens in a new tab)). Owner: Vendor.
- Submissions are encrypted at rest. Why: encryption is an addressable access-control specification under 164.312(a). Owner: Vendor.
- Forms ask only for what you need to respond. A request form rarely needs date of birth or insurance numbers. Why: less PHI collected is less PHI at risk. Owner: Practice.
More on choosing tools: HIPAA compliant forms.
Hosting, storage and backups
- The host or platform storing submissions has signed a BAA. Why: the 2013 Omnibus Final Rule says a storage company "qualifies as a business associate, even if the entity does not view the information" (Federal Register (opens in a new tab)). Owner: Practice.
- Backups are encrypted, and the backup provider is in the BAA chain. Why: a data backup plan is required (45 CFR 164.308(a)(7) (opens in a new tab)). Owner: Vendor.
- Server logs don't capture form contents or patient names in URLs. Why: logs are storage too. Owner: Vendor.
- You know the country where data and backups are stored. Owner: Both.
What to require from a host: HIPAA hosting requirements.
Third-party scripts: analytics, pixels, chat, maps and video
- No ad pixels or analytics tags on pages that collect or reveal health information: forms, booking flows, confirmation pages, patient portals. Why: sending PHI to a vendor without a BAA is an impermissible disclosure. Owner: Practice, with the vendor that installs tags.
- Google Analytics, if used, is limited to pages with no patient information. Why: Google says it "does not offer Business Associate Agreements" for Google Analytics and tells HIPAA-regulated customers to keep tags off authenticated pages and pages tied to health care services (Google Analytics Help (opens in a new tab)). Owner: Practice.
- You've read the current status of HHS's tracking guidance. HHS revised its online tracking bulletin on March 18, 2024. On June 20, 2024, a federal court vacated one part of it, treating an IP address plus a visit to a public page about health conditions or providers as protected information, and said the ruling should not be read as limiting "other guidance" in the document (AHA v. Becerra (opens in a new tab)). Status checked October 2026; see HHS's bulletin page for its current notice. Owner: Practice.
- The chat widget has a BAA, and you know whether it sends messages to an AI model. Owner: Practice.
- Map and video embeds sit only on public pages, not inside forms or the portal. Owner: Vendor.
- Someone owns the tag inventory, so an agency can't add a pixel without review. Owner: Practice.
Details on what's at stake: tracking pixels and HIPAA.
Email notifications and inbox access
- Notification emails don't contain the submission, or the email provider has signed a BAA. Why: the email service stores whatever the notification carries. Owner: Both.
- Each staff member has a unique login to the inbox or form dashboard; no shared passwords. Why: unique user identification is required (45 CFR 164.312(a) (opens in a new tab)). Owner: Practice.
- The system logs who viewed which message. Why: audit controls must "record and examine activity" (164.312(b)). Owner: Vendor.
- Access is removed the day someone leaves. Owner: Practice.
Vendor BAAs and documentation
- A signed BAA is on file for every website vendor that handles PHI: platform, host, forms, chat, booking, email, agency. Owner: Practice.
- Each BAA names the plan or products covered, and your plan matches. Owner: Practice.
- Website risks appear in your risk analysis, which is required (45 CFR 164.308(a)(1)(ii)(A) (opens in a new tab)). Owner: Practice.
- Documentation is kept six years from creation or last effective date, and reviewed periodically (45 CFR 164.316(b) (opens in a new tab)). Owner: Practice.
Notices and policies on the site
- Your notice of privacy practices is posted prominently on the website and available electronically. Why: a covered entity with a website about its services "must prominently post its notice on the web site" (45 CFR 164.520(c)(3)(i) (opens in a new tab)). Owner: Practice.
- A website privacy policy explains cookies, analytics and forms, consistent with what the site actually does. Owner: Practice.
- Forms tell patients not to send urgent or detailed medical information through general contact forms. Owner: Practice.
How Medfy handles these items
Patient information from Medfy forms, chat and the CRM is stored in separate, encrypted HIPAA databases in the US or Canada. Medfy signs a BAA with each practice before any patient data flows, and ad platforms never receive patient data. The practice's risk analysis, policies and notice remain the practice's to own. See how Medfy handles patient data, or run the free marketing audit to find pixels on your current patient forms.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
What makes a website HIPAA compliant?
No single feature does. A practice website handles patient information compliantly when every vendor that touches it has signed a BAA, submissions are encrypted and stored with access controls and audit logs, third-party scripts stay off pages that collect health details, notifications don't spread PHI, and the notice of privacy practices is posted. Your own risk analysis and policies complete the picture. Confirm with your compliance officer.
How often should a practice review its website for HIPAA risks?
HIPAA doesn't set a website schedule, but the Security Rule requires documentation to be reviewed periodically and updated when operations change. In practice, review the site whenever you add a form, script, plugin or vendor, and run the full checklist at least once a year alongside your risk analysis. A tag added by an agency or plugin can change the answer overnight. Confirm the cadence with your compliance officer.
Who is responsible for HIPAA compliance on a practice website?
Your practice is, as the covered entity. Vendors that handle patient data through the site are business associates with their own direct duties under their BAAs and the Security Rule, but signing with them doesn't transfer your obligations. The practice still owns the risk analysis, staff access, policies and decisions about which tools go on the site. Confirm the split with your compliance officer.