HIPAA-Compliant Web Design

HIPAA is the Health Insurance Portability and Accountability Act, a federal law passed in 1996. Three parts of it reach a practice website. The Privacy Rule governs how patient information may be used and shared. The Security Rule sets the safeguards required once that information is electronic — access controls, encryption, activity logging. The Breach Notification Rule says what you must do if patient information is exposed. Enforcement sits with the Office for Civil Rights at the Department of Health and Human Services.

Materially, yes. Ordinary shared hosting puts your website on a server with hundreds of neighbours, typically with no activity logging, no encryption at rest, and no agreement covering patient information. HIPAA-compliant hosting means the server environment itself is built for protected health information — encrypted storage and transmission, role-based access control, audit logging and redundant backups — and that the host will sign a Business Associate Agreement accepting responsibility for it.

The quickest way to tell the difference: ask a budget host to sign a BAA. Most will not.

A BAA is a written contract between a practice and any vendor that creates, receives, stores or transmits patient information on its behalf. If your website collects appointment requests, or your web company hosts your site or manages your email, they are handling protected health information and a BAA is required. It sets out what the vendor safeguards and what happens if something goes wrong.

If a web company will not sign one, that answers the question for you. Ours covers the hosting, the email and the patient forms together, because that is how a breach actually happens — through whichever piece was left out.

It applies the moment your website touches patient information. A purely informational site with no forms and no patient email is a lighter case. But nearly every practice website has a contact form, an appointment request or an intake document — and each of those collects protected health information. Where that data travels, where it is stored, and who can reach it sits squarely inside the Security Rule.

More than most practices expect. Protected health information is health information that can be tied to a specific person, and the identifiers include the obvious ones — name, date of birth, phone number, email address, medical record number — along with photographs and dates connected to care.

In website terms: a completed appointment form is patient information. So is a before-and-after photo. So is an email in which someone describes a symptom. So is a testimonial that names a procedure.

Standard email is not encrypted end to end, so a message containing patient information sent through an ordinary inbox is one of the most common exposures in a practice. Forwarding a patient’s question to a personal address is the same problem.

HIPAA email uses encrypted transmission with the access controls and written agreements behind it — and it has to work the way your team already works, in Outlook and on their phones, or it simply will not get used.

A great deal, because that is where most patient communication now happens. A system that is only secure at the front desk is not secure. HIPAA email on your team’s phones, encrypted delivery from your website forms, and healthcare-grade HTTPS on every device mean a patient message answered from a parking lot is handled exactly like one answered at a desk.

It matters on the patient’s side too — most people fill in your appointment form on a phone, so that is where their information is most often entered.

The Breach Notification Rule requires notifying the affected individuals without unreasonable delay and no later than 60 days, notifying HHS, and, where a breach affects 500 or more people, notifying the media. This is part of why audit logging and encrypted backups matter beyond prevention — if something does happen, you need to be able to establish what was actually reached.

None of this is legal advice, and how these rules apply to your practice specifically is a question for your compliance officer or your attorney. What we can tell you plainly is how your website, hosting, email and forms are configured.