Skip to content 
Choosing a medical website design agency is really choosing who will handle your patients’ data. A good one designs a site that books appointments and also keeps it HIPAA compliant from the first form to the last tracking script.
HIPAA compliant website design means building a clinic or practice website so that any protected health information (PHI) it collects, such as appointment requests, intake answers or portal logins, is only shared with vendors that have signed a business associate agreement (BAA), is encrypted and access controlled, and never leaks to ad or analytics tools. A purely informational page usually does not touch PHI. Forms, booking, chat, portals and tracking pixels are where HIPAA risk lives.
This guide explains what HIPAA actually requires of a website, where healthcare sites commonly go wrong, and how we work as a medical website design agency for clinics, behavioral health providers and private practices. It is practical guidance from a web agency, not legal advice, so have your compliance officer or healthcare attorney confirm decisions for your organization.
Does your website need to be HIPAA compliant?
HIPAA applies to covered entities (health plans, health care clearinghouses and healthcare providers that conduct certain transactions electronically) and to their business associates. If your organization is covered, the question is not whether the whole website is “HIPAA compliant” but whether each feature handles PHI. HHS guidance on online tracking draws a useful line between page types:
| Website feature | Usually involves PHI? | Why |
|---|---|---|
| Home, about, services, hours, locations, careers | Usually no | General information that does not relate to an individual’s care |
| Contact or appointment request form | Often yes | Name plus a reason for visit or symptoms is health information tied to a person |
| Online booking or symptom checker | Yes, even without a login | HHS lists these unauthenticated pages as exceptions that can involve PHI |
| Patient portal, telehealth or login pages | Yes | HHS says tracking on authenticated pages generally has access to PHI |
| Live chat or AI chat assistant | Often yes | Patients type symptoms, medications and insurance details into chat |
| Analytics, ad pixels, session recording | Depends on where they run | They can capture form fields, URLs and IP addresses on pages that involve PHI |
One legal update matters here. In June 2024, a federal court in American Hospital Association v. Becerra vacated the part of the HHS tracking guidance that said HIPAA is triggered when a tracker links an IP address to a visit to an unauthenticated public page about a health condition. The rest of the guidance, including the rules for portals, login pages and booking forms, still stands on the HHS page.
What HIPAA requires of a healthcare website
There is no single “HIPAA website” standard. The HIPAA Security Rule asks regulated entities to run a risk analysis and put administrative, physical and technical safeguards in place for electronic PHI. For a website, that translates into a short list of safeguards we build in:
- A BAA with every vendor that touches PHI. That includes the host, form tool, booking system, chat or AI assistant, email delivery service and any CRM that stores submissions. HHS confirms a cloud provider that stores ePHI is a business associate even if the data is encrypted and the provider has no key (HHS cloud computing guidance).
- Encryption in transit and at rest. HTTPS on every page, and form submissions stored encrypted rather than sitting in a plain WordPress database table or an unencrypted email inbox.
- Access controls. Unique logins, role-based permissions, multi-factor authentication for anyone who can see submissions, and automatic logouts.
- Audit logs. A record of who viewed or exported PHI, kept by the system that stores it.
- Backups and recovery. Tested backups held by a vendor covered by a BAA.
- A risk analysis that includes the website. The site, its plugins and its vendors belong in the same risk assessment as your EHR and phones.
Be wary of anyone selling a “HIPAA certified” website. HHS states that it does not endorse or recognize private HIPAA certifications, and a certificate does not shift your responsibility.
Forms, booking and chat: where PHI leaks happen
Most real risk on a practice website sits in the tools that collect patient details. Many WordPress form plugins email each submission, and some also save a copy in the database. If that form asks “What brings you in today?”, every copy now holds PHI.
How we build HIPAA-aware forms
- Use a form or intake platform that signs a BAA and stores submissions encrypted outside the WordPress database.
- Send staff a notification that a new submission exists, with a secure login link, instead of emailing the answers.
- Ask only what you need before the first call. A name, phone number and preferred time often do the job; save symptoms and insurance details for the secure intake step.
- Keep PHI out of URLs. Thank you pages and booking confirmations should not carry names, conditions or appointment types in the address bar, where analytics tools can read them.
- Turn off form “partial entry” saving and session recording on any page with a health form.
Chat deserves the same treatment. If you add a live chat or an AI chat assistant to a clinic site, choose a provider that will sign a BAA, configure it not to log full conversations where it does not need to, and tell patients not to share medical details in chat if the tool is not covered.
Tracking pixels, analytics and HIPAA
Tracking is one of the easiest places to get HIPAA wrong on a website. HHS guidance says covered entities must have a BAA with any tracking technology vendor that receives PHI, and that a cookie banner asking visitors to accept tracking is not a valid HIPAA authorization. Mentioning tracking in your privacy policy does not make the disclosure permitted either.
Google is explicit about its own tool: it does not offer a BAA for Google Analytics, tells HIPAA-regulated customers not to expose PHI to it, and says customers should not place Google Analytics tags on authenticated pages. In practice, that leads to a simple setup:
- No analytics, ad pixels, heatmaps or session recording on portal, login, booking or intake pages.
- On public pages, configure analytics so no form fields, search terms or URL parameters with health details are collected.
- Measure conversions server side or through a vendor that signs a BAA, rather than firing a Meta or Google Ads pixel on the thank you page of a health form.
- Audit every script on the site with a tag inventory at least once a quarter, because marketing tools and plugins add new ones over time.
This matters for marketing teams too. If you rely on paid search or SEO for patients or admissions, plan tracking before launch. Our SEO services for healthcare include measuring calls and bookings without exposing patient data.
Hosting, WordPress and plugins
WordPress can be used for a HIPAA compliant website, but WordPress itself is just software. Compliance depends on how it is hosted and configured. The practical rules we follow:
- Keep PHI off the marketing site where you can. The simplest pattern is a fast public WordPress site with no PHI stored in it, linking out to a BAA-covered form, booking or portal platform.
- If WordPress must store PHI, the host must sign a BAA. Confirm your host will sign one before you build, not after.
- Limit plugins. Every plugin is code with access to your database. Remove anything unused and keep core, themes and plugins updated.
- Lock down admin access. Multi-factor authentication, strong role separation and no shared logins.
- Keep maintenance ongoing. Updates, backups and security monitoring are part of the safeguard, not a launch task. Our WordPress maintenance guide outlines what that includes.
Designing for patient trust
Compliance keeps you out of trouble. Design is what gets a worried patient to book. In our experience, the healthcare sites that convert well share a few traits:
- A clear first screen that states who you treat, where, and how to get started, with a phone number that is tappable on mobile.
- Plain-language privacy cues next to forms, for example a short line explaining how information is protected and who will contact them.
- Provider bios with real credentials, plus insurance and payment information that answers the money question early.
- Fast load times and accessible design, since many patients browse on older phones or use assistive technology. Our guide to accessible web design for small businesses covers the basics.
- One primary call to action per page: call, book or request a callback.
How our medical website design agency builds a HIPAA compliant site
- Data flow mapping. We list every place the site collects, sends or stores information, and which vendor handles it.
- Vendor and BAA review. We confirm which tools will sign a BAA and replace the ones that will not.
- Architecture decision. Usually a public WordPress site with PHI handled by covered platforms, or a covered host if PHI must live in WordPress.
- Design and build. Patient-first layouts, secure forms, accessible components and fast pages.
- Tracking setup and audit. Analytics and ad tags only where they are safe, with a documented tag inventory.
- Pre-launch checks. HTTPS, form routing, access controls, backups and a script audit on every template.
- Ongoing maintenance. Updates, monitoring and quarterly tag reviews.
What does a HIPAA compliant website cost?
There is no standard price, and we would be wary of a flat “HIPAA website” package quoted before anyone has looked at your data flows. The cost depends far more on the tools that handle PHI than on the design itself. These are the factors that move the budget:
| Cost factor | Lower cost | Higher cost |
|---|---|---|
| Where PHI lives | Public site with no PHI, forms and booking on a covered platform | PHI stored in WordPress on a BAA-covered host |
| Forms and intake | A few short request forms | Multi-step intake, file uploads, insurance capture |
| Booking and portal | Link to existing EHR booking or portal | Custom booking integration with your EHR or practice software |
| Chat and AI | No chat, or chat that collects no PHI | BAA-covered chat or AI assistant with integrations |
| Tracking | Basic privacy-safe analytics on public pages | Server-side conversion tracking for paid campaigns |
| Ongoing costs | Standard maintenance | BAA-covered hosting and SaaS subscriptions, quarterly audits |
Budget for recurring software as well as the build. Some form, hosting and chat vendors only include a BAA on specific plans, so check which plan you need before comparing prices.
Common HIPAA website mistakes
- Using a standard contact form plugin that emails symptoms to a shared inbox.
- Leaving a Meta or Google Ads pixel on booking and thank you pages.
- Assuming a cookie banner covers tracking on pages that involve PHI.
- Signing up for a chat or AI tool without checking whether it will sign a BAA.
- Paying for a “HIPAA certified website” badge instead of fixing data flows.
- Treating compliance as a launch task and never auditing scripts again.
Medical website design agency FAQs
Does every healthcare website need to be HIPAA compliant?
Only the parts that create, receive, store or send PHI are in scope. A brochure page with your hours and services usually is not. Contact forms that ask about symptoms, booking tools, portals and chat usually are, along with any tracking that runs on those pages.
Is WordPress HIPAA compliant?
WordPress can be part of a HIPAA compliant setup, but software alone is never compliant. It depends on the host, the plugins, the form and booking tools, access controls and whether vendors that handle PHI sign a BAA.
Can I use Google Analytics on a medical website?
Google does not sign a BAA for Google Analytics and says not to put its tags on authenticated pages or expose PHI to it. A common approach is to keep it on public informational pages only, configured so it does not collect health details, and use other methods for sensitive conversion tracking.
Is an SSL certificate enough to make a website HIPAA compliant?
No. HTTPS protects data in transit, which is necessary, but you also need covered vendors with BAAs, secure storage, access controls, logging and a risk analysis that includes the website.
Is there an official HIPAA certification for websites?
No. HHS says it does not endorse or recognize private HIPAA certifications. Vendors can show security audits and sign BAAs, but responsibility stays with your organization.
Do contact forms need to be HIPAA compliant?
If a form collects health information tied to a person, such as a reason for visit, symptoms or insurance details, treat it as PHI and use a tool that signs a BAA and stores submissions securely. A form that only asks for a name, phone and preferred time carries far less risk.
What should a healthcare website development agency handle?
More than design. Ask any healthcare website development agency to map your data flows, confirm which vendors will sign a BAA, build secure forms and booking, set up tracking that keeps PHI out of ad and analytics tools, and keep the site maintained after launch. If an agency cannot explain where patient data goes, keep looking.
How do I choose a medical website design agency?
Look for healthcare portfolio work, a clear answer on BAAs and tracking, accessible and fast builds, and ongoing maintenance in writing. Ask who owns the site and the domain, and how they handle patient forms. A low quote that skips these questions usually costs more later.
Need a clinic website that is both compliant and easy to book from?
Our team designs healthcare and behavioral health websites with data flow mapping, BAA-covered tools and privacy-safe tracking built into the project. See our website design services and tell us about your practice. We will start by mapping where patient data goes today.
