Is My Website HIPAA Compliant?
A practical guide to evaluating your website's current compliance posture and identifying the gaps most likely to draw regulatory scrutiny.
Start with a Basic Technical Audit
The fastest way to get an initial answer is to run an automated scan. Tools like HIPAA Guard analyze your publicly accessible pages for the most common technical violations: SSL configuration, missing privacy notices, insecure form endpoints, and third-party tracking on sensitive pages.
An automated scan will not catch everything — it cannot see inside your database, review your policies, or verify whether your vendors have signed BAAs — but it will surface the technical issues that are most immediately visible and most commonly cited in enforcement actions.
Start your evaluation with a free scan, then use the results as a structured checklist to investigate each flagged item in depth. Many organizations are surprised to discover issues they didn't know existed, particularly around third-party scripts loaded by marketing teams without IT review.
Check Your SSL Configuration
Visit your website in a browser and verify you see the padlock icon in the address bar. Then dig deeper:
- Use a tool like SSL Labs to grade your TLS configuration
- Confirm your certificate expiration date and who manages renewals
- Verify HTTPS is enforced sitewide and that HTTP requests redirect to HTTPS
- Check all subdomains — patient portals, scheduling tools, and intake forms often live on different subdomains
- Ensure HSTS (HTTP Strict Transport Security) headers are set
An "A" grade on SSL Labs with HSTS enabled is a strong baseline for transmission security compliance, though it is only one element of the full picture.
Review Your Forms and Data Flows
Make a complete inventory of every form on your website and ask for each one: what data does it collect, where does it go, and is that destination covered by a BAA?
- Contact forms that ask about health conditions or symptoms
- Appointment request forms
- New patient intake forms
- Insurance verification forms
- Newsletter signup forms on healthcare websites
Trace each form submission to its destination. If it sends an email via a standard SMTP relay, that relay must have a BAA. If it writes to a CRM, that CRM must have a BAA. If it stores data in a spreadsheet in Google Drive, your Google Workspace account must have a BAA with Google activated.
Audit Third-Party Scripts
Open your browser's developer tools on any page where patients might be authenticated or where health information appears, and review the Network tab. Every external domain that receives a request is a potential data recipient.
Common problematic patterns include:
- Meta Pixel or TikTok Pixel on appointment confirmation pages that pass appointment type or referring page as event metadata
- Google Analytics on patient portal pages where the page title or URL reveals a diagnosis code or procedure
- Live chat widgets that log conversation transcripts to servers outside your BAA coverage
- CDN providers serving content from patient-facing pages without a BAA
The OCR's 2022 bulletin on tracking technologies makes clear that these scenarios are enforcement priorities.
Review Your Privacy Notice
HIPAA requires covered entities to post a Notice of Privacy Practices that meets the content requirements of 45 CFR § 164.520. Review your existing privacy policy against this checklist:
- Does it describe all uses and disclosures of PHI you make?
- Does it list patients' rights (access, amendment, accounting of disclosures)?
- Does it name your Privacy Officer or provide contact information?
- Does it state your legal duties regarding PHI?
- Is it clearly linked from all pages where PHI is collected?
- Does it carry a revision date within the last three years?
A generic "Privacy Policy" that covers GDPR and CCPA but does not address HIPAA-specific rights is not sufficient for covered entities.