HIPAA basics for websites handling health info

What HIPAA means for your website if you work in healthcare or collect health-related information, and the technical safeguards we implement.

HIPAA — the Health Insurance Portability and Accountability Act — is a US federal law that protects the privacy and security of health information. If your business is a health plan, a healthcare clearinghouse, or a healthcare provider who sends health information electronically for billing and similar transactions — or a business associate of one — HIPAA affects how your website is built and operated.

Many healthcare-adjacent businesses underestimate how much HIPAA touches their online presence. A contact form asking about conditions, an online appointment booking system, a patient portal — all of these can bring HIPAA requirements into scope.

This is not legal advice

Chykalophia is a design and web agency, not a law firm. This article explains HIPAA concepts as they relate to website design and development, and describes best practices we follow. It is not legal advice. HIPAA is complex, and enforcement can be severe. Please consult a qualified healthcare attorney or compliance specialist to confirm your obligations and develop a complete compliance program.

Quick summary

HIPAA protects Protected Health Information (PHI) — data that can connect a person to their health condition or care. If your website collects, stores, or transmits PHI, the Security Rule requires administrative, physical, and technical safeguards, including access controls and audit controls, plus a documented decision about encryption. Standard website contact forms and analytics tools are generally not built for HIPAA. We can help you implement a HIPAA-aligned website architecture, but you will also need legal counsel, internal policies, and Business Associate Agreements with your vendors.

What HIPAA protects

HIPAA protects Protected Health Information, or PHI. PHI is any information that:

Relates to a person's past, present, or future physical or mental health condition, healthcare services, or payment for healthcare
Can be used to identify the individual

PHI includes names, addresses, dates (including birthdates and treatment dates), phone numbers, email addresses, Social Security numbers, account numbers, URLs, and any other data that could identify a person — when combined with health information.

Electronic PHI (ePHI) is PHI stored or transmitted digitally, and it is what matters most for websites.

Who HIPAA applies to

HIPAA applies to two main categories:

Covered Entities — the three kinds of organization the rules name directly:

Healthcare providers (doctors, dentists, therapists, hospitals, clinics) who send health information electronically for billing and similar transactions
Health insurance plans and payers
Healthcare clearinghouses

Business Associates — companies that create, receive, maintain, or transmit PHI on behalf of a covered entity:

A website agency that builds and hosts a patient portal
A cloud storage provider storing ePHI
An email service used to communicate health information
A scheduling software vendor

If we build or host a site that handles ePHI for a covered entity, we become a Business Associate. This requires a Business Associate Agreement (BAA) — a formal contract that defines each party's HIPAA responsibilities.

Does your website handle PHI?

Use this as a quick guide — but verify with a lawyer:

Your site has…	Likely handles PHI?
A general contact form (name, email, question)	Usually no — unless visitors frequently submit health details
A contact form that asks about medical conditions or symptoms	Yes
Online appointment booking that includes reason for visit	Yes
A patient login portal	Yes
A telehealth video or messaging feature	Yes
A health assessment or symptom checker	Yes
Standard analytics on a public marketing page, with no health data	Generally no — but see the pitfalls section
A staff-only admin area containing patient records	Yes

'Contact us' forms can unintentionally collect PHI

Even a simple contact form can receive messages containing health details. If your business is a covered entity, you may need to treat your contact form infrastructure as potentially handling PHI — which affects what email service you use, how you store submissions, and what happens to that data.

Key technical safeguards for HIPAA-aligned websites

HIPAA's Security Rule requires covered entities and business associates to implement three types of safeguards: administrative, physical, and technical. Here are the technical ones most relevant to websites.

'Required' and 'addressable' are not the same thing

The Security Rule splits its detailed requirements into two kinds. Required ones you must simply implement. Addressable ones you must assess: implement them if they are reasonable and appropriate in your environment, and if they are not, document why and put an equivalent alternative measure in place if that is reasonable and appropriate. "Addressable" is not optional, and it is not a loophole — it is a decision you have to make and write down.

Encryption

Encryption is addressable, both for data at rest (§ 164.312(a)(2)(iv)) and for data in transmission (§ 164.312(e)(2)(ii)). So the rule does not flatly command "encrypt everything." It requires you to assess encryption and record what you decided.

In practice, for a website that touches ePHI, the answer is almost always yes on both counts:

In transit: use HTTPS (SSL/TLS), which encrypts data between the visitor's browser and your server. It is hard to argue this is not reasonable and appropriate for a modern website.
At rest: encrypt data stored in databases, file systems, and backups.

There is a second, practical reason to encrypt. The Breach Notification Rule only bites on "unsecured" PHI, which the regulation defines as PHI "that is not rendered unusable, unreadable, or indecipherable to unauthorized persons" using a method the Secretary of HHS has specified. Encrypt to that standard and a lost laptop or stolen database may not trigger a notification at all. Skip it and you lose that protection.

Access controls

Only authorized people should be able to access ePHI. The rule requires unique user IDs and an emergency access procedure, and makes automatic logoff addressable. What we typically build:

Individual user accounts, never shared logins, with strong passwords
Two-factor authentication (good practice rather than a specific requirement in the rule, which asks only that you verify who is accessing ePHI)
Role-based access (staff can only see what they need)
Automatic session timeouts

Audit controls

This one is required, with no wiggle room: you must put mechanisms in place that record and examine activity in any system that holds or uses ePHI. In practice that means your systems generate audit logs, someone actually reviews them, and you retain the documentation.

Integrity controls

Safeguards must ensure ePHI is not altered or destroyed improperly.

Secure disposal

The rule files this one under physical rather than technical safeguards, but it matters just as much for a website. When ePHI is no longer needed, it must be securely deleted — not just moved to a trash folder. The same goes for the hardware and media it was stored on.

What this means for common website tools

Standard off-the-shelf website tools are often not HIPAA-compliant without additional configuration or replacement:

Common tool	HIPAA-ready out of the box?
Standard WordPress contact form plugins	No — submissions are typically stored unencrypted and emailed in plain text
Standard business email	No — not encrypted end to end; PHI should not be sent this way
Standard analytics and advertising tags	Not suitable where they could pick up PHI, and many of these vendors will not sign a BAA at all
Standard shared web hosting	Generally no — you need infrastructure you control, and a host that will sign a BAA
Form tools sold specifically for healthcare use	Yes, when configured correctly and a signed BAA is in place
Telehealth platforms sold specifically for healthcare use	Yes, when configured correctly and a signed BAA is in place

Check the BAA yourself, not the marketing page

A vendor describing itself as "HIPAA compliant" is a marketing claim, not a legal status. What matters is whether it will sign a Business Associate Agreement with you covering the specific product and plan you are on, and whether you configure it the way that agreement requires. Check that the BAA covers the plan you are actually paying for, not just the product name.

Business Associate Agreements

A Business Associate Agreement (BAA) is a legal contract between a covered entity and a vendor (business associate) who handles ePHI. If your website agency, hosting provider, email service, or form tool handles ePHI for you, they must sign a BAA.

Not every vendor offers BAAs. When they don't, you generally cannot use that vendor for systems that handle PHI.

We can sign a BAA when we are contracted to build or host a site that involves ePHI. Discuss this with your project lead before work begins.

What we do to help

When we work on a healthcare website that involves ePHI:

We use hosting infrastructure whose provider will sign a BAA (such as dedicated servers or a cloud environment offered for healthcare use)
We implement SSL, and encryption at rest where your risk analysis calls for it
We replace standard contact forms with HIPAA-compliant form tools
We configure access controls and role-based permissions
We review which third-party tools are in use and flag those that lack BAA availability
We sign a BAA for our work when applicable and required

Technical work alone does not make you HIPAA compliant

HIPAA compliance requires more than a technically secure website. It requires internal policies and procedures, staff training, a breach notification protocol, a risk analysis, and often a compliance officer. We handle the technical layer. You and your legal counsel are responsible for the full compliance program.

Common pitfalls

Putting standard analytics or ad trackers on patient-facing pages. A tracker on a page behind a patient login, or on a page where the visit itself reveals someone's condition, can send identifiable health information to the vendor. That makes the vendor a business associate, which means it needs a BAA — and many analytics and advertising vendors will not sign one. HHS has published guidance on tracking technologies, though part of it was set aside by a court in 2024, so the boundaries here are genuinely unsettled. Check with your compliance counsel before adding any tracker to a healthcare site.
Standard contact forms. Most form plugins email submissions via standard (unencrypted) email and store them in a database that does not meet HIPAA standards.
Not getting BAAs with all vendors. Every vendor that touches ePHI needs a BAA. This includes your hosting provider, your email service, your CRM, and your website agency.
Thinking HTTPS alone is sufficient. HTTPS encrypts data in transit. You still need to address encryption at rest, plus access controls and audit controls, and the administrative and physical safeguards that sit alongside the technical ones.
Patient-facing forms on a non-HIPAA platform. If you are collecting insurance information, reason for visit, or medical history through a standard web form, that is likely ePHI.

Common questions

Do I need HIPAA compliance if I'm a wellness coach or fitness instructor, not a licensed provider?

HIPAA applies to covered entities — health plans, healthcare clearinghouses, and healthcare providers who send health information electronically for billing and similar transactions — and to their business associates. If you are not one of those and you do not handle health information for one, HIPAA may not directly apply. However, you may still have privacy obligations under general data protection laws, and clients will trust you more if you handle health data carefully. Consult a lawyer to clarify your situation.

Can patients email me their health information?

A patient can choose to communicate their own health information via unencrypted email — that is their right. But as a covered entity, you should inform them of the risks of unencrypted communication and get their acknowledgment. You should not initiate sending PHI via standard email.

What is a HIPAA risk analysis?

A risk analysis is a formal assessment of the potential risks to the confidentiality, integrity, and availability of ePHI in your organization. It is required under HIPAA's Security Rule. This is typically conducted or overseen by a healthcare compliance specialist, not a web agency.

Does my website need a HIPAA-compliant privacy notice?

Under the Privacy Rule, an individual "has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties" regarding that information. Covered entities meet this with a Notice of Privacy Practices (NPP). It is a specific legal document, separate from a general website privacy policy, and a healthcare attorney should draft or review it.

What should I do if I think there has been a data breach?

HIPAA requires a breach notification process — you must notify affected individuals, the HHS, and in some cases the media, depending on the scale. You should have a documented breach response plan in place before you ever need it. This is another area where healthcare legal counsel is essential.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.