HIPAA Website Compliance Checklist

Every page of your website must be served over HTTPS. HIPAA's Security Rule requires that all electronic protected health information (ePHI) transmitted over public networks be encrypted. An expired, missing, or self-signed SSL certificate is one of the most common violations found during compliance reviews.

• Confirm your SSL certificate is valid and issued by a trusted CA
• Ensure automatic HTTP-to-HTTPS redirects are in place
• Use TLS 1.2 or higher — disable TLS 1.0 and 1.1
• Verify that all subdomains used to collect data are also covered
• Check certificate expiration dates and set up renewal alerts

Automated scanners like HIPAA Guard check your SSL configuration on every scan so expiration never catches you off guard.

A HIPAA-compliant website must publish a clear, accessible Notice of Privacy Practices (NPP) that explains how patient information is collected, used, and shared. This is distinct from a generic privacy policy and must meet specific regulatory content requirements under 45 CFR § 164.520.

• NPP must be prominently linked from every page that collects PHI
• Include contact information for your Privacy Officer
• Describe patients' rights regarding their health information
• State how you respond to data breaches
• Date the policy and note the effective date of the most recent revision

Missing or inadequate privacy notices account for a significant share of OCR enforcement actions each year.

Any web form that collects protected health information (PHI) — including appointment requests, intake forms, or symptom checkers — must be secured at rest and in transit. Standard HTML contact forms that send unencrypted email are not HIPAA compliant.

• Use encrypted form submission tools or HIPAA-compliant form platforms
• Avoid storing form submissions in shared CMS databases without encryption
• Do not use standard Gmail, Outlook, or other non-BAA email to receive form data
• Implement CSRF protection on all forms
• Log form access and submission events for audit purposes

Review the HIPAA compliant forms guide for a deeper look at secure form architecture.

Third-party tracking technologies — including Google Analytics, Meta Pixel, and ad retargeting scripts — can inadvertently transmit PHI to vendors who have not signed a Business Associate Agreement (BAA). The FTC and OCR have both issued guidance making clear that tracking pixels on authenticated patient pages constitute a potential HIPAA violation.

• Audit every third-party script loaded on pages where PHI appears
• Remove tracking pixels from patient portals, appointment confirmation pages, and prescription pages
• Obtain BAAs from any analytics or tag management vendor that processes ePHI
• Implement a consent management platform to control cookie activation

Your web hosting environment must support HIPAA's administrative, physical, and technical safeguards. This means your hosting provider must sign a Business Associate Agreement and offer documented security controls including access logging, intrusion detection, and data backup.

• Confirm your host offers and will sign a BAA
• Verify data centers have physical access controls and environmental protections
• Ensure database backups are encrypted and tested regularly
• Use role-based access controls for server and CMS administration
• Enable audit logging for all administrative actions

See our guide on HIPAA-compliant web hosting for recommended providers and what to look for in a BAA.

HIPAA compliance is not a one-time event. The Security Rule requires covered entities and business associates to conduct periodic risk assessments and implement a process for ongoing monitoring. Websites change frequently — new scripts are added, certificates expire, and third-party integrations evolve.

• Schedule compliance scans after every significant site update
• Conduct a formal risk assessment at least annually
• Document all identified risks and remediation actions
• Train staff on HIPAA requirements whenever policies change
• Maintain an inventory of all systems that process PHI

Tools like HIPAA Guard automate continuous scanning so you catch regressions before they become violations.