HIPAA Compliance Checklist for Websites: The 12 Items That Matter in 2026
Last updated: August 15, 2026
A HIPAA compliance checklist for a healthcare website has 12 items, and only three of them are about the server. The rest are the forms, trackers, logins, vendors, and documents that turn a normal website into a system that handles patient data safely. Most checklists cover the whole practice: officers, training, notice of privacy practices. This HIPAA compliance checklist covers the website alone, because that is the system practices audit last and regulators find first. Work down the list. Each item on the HIPAA compliance checklist names the rule behind it, the two-minute check, and the fix. If you get to the bottom with every box ticked, your website is not your compliance problem anymore.
TL;DR: Quick answer
The 12-item HIPAA compliance checklist below covers hosting, forms, trackers, access, vendors, and documentation, with the rule and the fix for each.
Three items carry most of the risk: a signed BAA with your host, no ad or analytics pixels on patient pages, and no patient data emailed in plain text.
Item 12, the written risk analysis, is the one OCR asks for first. Its Risk Analysis Initiative has produced a dozen enforcement actions since October 2024 and expanded to risk management in 2026.
Only the pages that touch protected health information PHI) need the full checklist. A plain marketing page needs items 1 and 2 at most.
Every item here is a self-check. The professional version of the same review exists for the parts a browser cannot see.
Who this checklist is for
Any covered entity or business associate that runs a website touching PHI: practices, clinics, therapists, billing companies, health SaaS. If your site only lists services and a phone number, you may need almost none of this, and who needs HIPAA-compliant hosting settles that question first. If your site has an intake form, a booking flow, a portal, or a contact form that invites health details, this HIPAA compliance checklist is yours.
The 12-item HIPAA compliance checklist for websites
# | Item | The rule behind it |
|---|---|---|
1 | Signed BAA with your web host | 45 CFR § 164.308(b) |
2 | TLS on every page, encryption at rest | § 164.312(a)(2)(iv), (e) |
3 | Forms store to encrypted, covered storage | § 164.312, § 164.308(b) |
4 | No PHI in notification emails | § 164.312(e) |
5 | No ad or analytics pixels on patient pages | § 164.502(a); OCR guidance |
6 | Unique logins and MFA for every admin | § 164.312(a), (d) |
7 | Automatic logoff on admin and portal sessions | § 164.312(a)(2)(iii) |
8 | Audit logs kept and reviewed | § 164.312(b), § 164.316(b) |
9 | Tested backups and a recovery plan | § 164.308(a)(7) |
10 | A BAA for every vendor in the PHI path | § 164.308(b), § 164.504(e) |
11 | Old sites and staging copies found and secured | § 164.308(a)(1) |
12 | Written risk analysis that names the website | § 164.308(a)(1)(ii)(A) |
Items 1 to 3: the hosting layer
Every HIPAA compliance checklist starts here, because the host stores everything else. 1. Signed BAA with your host. Check: find the document. If you cannot, you do not have one. Fix: move the PHI-handling parts of the site to a host that signs, and keep the signed copy on file. What the contract must contain is in our HIPAA business associate agreement guide. 2. Encryption. Check: every page loads over HTTPS, and your host confirms encryption at rest for the database and uploads. Fix: force HTTPS sitewide and ask the host in writing. 3. Form storage. Check: where do submissions land? Fix: encrypted storage on covered hosting, never a plain database on a shared plan. The architecture is in HIPAA compliant WordPress forms.
Items 4 and 5: the two quiet leaks
These two fail more sites than everything else on the HIPAA compliance checklist combined. 4. Notification emails. Check: submit a test form and read the email that arrives. If it quotes the answers, patient data is leaving through an unprotected channel on every submission. Fix: content-free alerts ("a new form is waiting") or a BAA-covered mail path, covered in HIPAA compliant email. 5. Trackers. Check: open a booking or intake page, press F12, watch the Network tab for google-analytics, googletagmanager, facebook, or doubleclick. Fix: pull them off every PHI page and use self-hosted or BAA-signing analytics instead. IP addresses and URLs are two of the 18 HIPAA identifiers, which is why a pixel on a patient page produced eight-figure settlements; the full picture is in HIPAA tracking technologies.
Items 6 to 9: access, logs, and recovery
The middle of the HIPAA compliance checklist is the Security Rule's technical safeguards, applied to your site. 6. Logins. Check: any shared admin account? Any account without MFA? Fix: one login per person, MFA on all of them, old accounts removed the day someone leaves. 7. Automatic logoff. Check: WordPress keeps sessions alive 48 hours by default, and two weeks with "remember me." Fix: idle timeouts on admin and portal sessions, tiered by risk, per HIPAA automatic logoff requirements. 8. Audit logs. Check: can you show who accessed what, and how long are logs kept? Fix: logging at the server and application layers, retained six years, reviewed on a schedule. 9. Backups. Check: when did you last restore one? Fix: encrypted backups, kept apart from production, with a tested restore, per HIPAA backup and disaster recovery.
Items 10 to 12: vendors, ghosts, and paperwork
10. Vendor BAAs. Check: list every tool that touches patient data: scheduler, form service, email, chat, CRM. Fix: a signed BAA for each, or the tool leaves the PHI path. Our vendor verdicts, from Calendly to WordPress, answer the common ones. 11. Ghost sites. Check: old campaign pages, staging copies, a previous site at a subdomain. Fix: take them down or secure them; a forgotten form still collects. 12. The risk analysis. Check: does your written risk analysis name the website as an ePHI system? Fix: add it, with the data flows mapped. This is the item OCR asks for first. Its Risk Analysis Initiative, launched in October 2024, reached a dozen enforcement actions by 2026 and now scrutinizes whether you acted on the findings, not just whether the document exists.
How to actually get through the list
Here is the honest pain point. A HIPAA compliance checklist is simple to read and slow to finish, because half the items need server access, vendor answers, or a developer, and the office manager holding it has none of those. Two paths clear it. If you want the hosting-layer items handled as a unit, our healthcare hosting arrives with items 1, 2, 7, 8, and 9 done: BAA at every tier, encryption, session hardening, audit logging, and tested backups, from $79 per month self-managed to $229 per month managed with migration included. If you want the whole list checked against your live site, our client-side compliance review is items 3 through 5 and 10 through 11 done professionally: every form, script, and vendor mapped, with a findings report your risk analysis can cite. We sell both, so weigh that as a disclosure. The manual checks above are yours either way. Send us your ticked and unticked boxes and we will tell you which gaps matter, including the ones you can close yourself for free.
Frequently asked questions
What should a HIPAA compliance checklist for a website include?
Twelve items: a signed BAA with the host, encryption, covered form storage, clean notification emails, no pixels on patient pages, unique logins with MFA, automatic logoff, audit logs, tested backups, vendor BAAs, secured old sites, and a risk analysis that names the website.
Does a small practice need all 12 items?
Only for the pages that touch PHI. A marketing-only site needs items 1 and 2 at most. The moment a form or booking flow collects health details, the full HIPAA compliance checklist applies to those paths.
Which items matter most?
Items 1, 4, and 5: the host BAA, plain-text notification emails, and pixels on patient pages. Those three account for most real-world website findings and most of the settlement money.
Is a HIPAA compliance checklist enough for an audit?
It is the working tool, not the proof. The proof is item 12: a written risk analysis that covers the website and shows you acted on what you found. OCR requests that document first.
How often should I run through it?
Yearly at minimum, matching the risk-analysis cadence, and after any change: a new form, plugin, tag, or redesign. Most violations enter through changes nobody re-checked.
Recap: HIPAA compliance checklist
To recap, this HIPAA compliance checklist covers the website only: BAA hosting, encryption, form storage, clean emails, no pixels, MFA, logoff, logs, backups, vendor BAAs, ghost sites, and the risk analysis. Three items carry most of the risk, one item is what OCR asks for first, and only the PHI-touching pages need the full list. Tick what you can today, get help for the parts that need server access, and write it all down.
This article is general information, not legal advice. Regulatory citations reflect 45 CFR Parts 160 and 164 and OCR guidance as of August 2026; enforcement details reflect public OCR announcements through 2026. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed August 2026.
Sources
45 CFR § 164.308 (administrative safeguards, risk analysis, contingency plan, BAA requirement): ecfr.gov
45 CFR § 164.312 (technical safeguards): ecfr.gov
HHS OCR: Use of online tracking technologies
HHS OCR: Enforcement process and results (Risk Analysis Initiative actions)