HIPAA Compliant Website: Requirements and the 2026 Checklist
Last updated: August 13, 2026
A HIPAA compliant website is a site where every path patient data can travel is covered: hosting under a signed Business Associate Agreement (BAA), encrypted forms, clean trackers, controlled logins, and policies behind it all. Here is the good news buried in that sentence. Most healthcare websites only need part of the work. The marketing pages carry no patient data and need no special treatment. The parts that collect or show it, the forms, the booking flow, the portal, carry all the duty. Covering those parts well is what a HIPAA compliant website really means. This guide gives you the six requirements, the traps that break them, what it costs, and the fastest honest path to done.
TL;DR: Quick answer
A HIPAA compliant website needs six things: BAA-covered hosting, encryption in transit and at rest, compliant forms, trackers that never see patient data, session controls, and a written risk analysis.
Only the pages that touch protected health information (PHI) must meet the rules. A plain service page does not. The intake form does.
The hosting contract comes first. A perfect site on a host with no BAA fails on legal grounds before any technical test (45 CFR § 164.308(b)).
The common failures are quiet ones: a form emailing symptoms in plain text, an analytics pixel on the booking page, a login that never times out.
Realistic cost for a small practice: from $79 per month self-managed to $229 per month managed, plus the one-time work of securing forms and trackers.
Does your website even need to be HIPAA compliant?
Start here, because the answer decides your budget. HIPAA follows the data, not the industry label. A site that only describes your services and lists your phone number handles no PHI. It needs good security, not HIPAA. The duty starts when the site collects or displays health information tied to a person. An intake form asking about symptoms. A booking flow for appointments. A portal showing results. Even a contact form becomes PHI handling the moment a visitor types health details into it. The full walk-through of that line is in who needs HIPAA-compliant hosting. If patient data flows anywhere on your site, the six requirements below apply to those paths.
The six requirements of a HIPAA compliant website
Each requirement below maps to a named rule. Together they are what a HIPAA compliant website actually means in 2026.
Requirement | The rule behind it | What it looks like |
|---|---|---|
1. BAA-covered hosting | 45 CFR § 164.308(b) | The host that stores your forms and database signs a BAA first |
2. Encryption | § 164.312(a)(2)(iv), (e) | TLS on every page, AES-256 on stored data |
3. Compliant forms | § 164.312, § 164.308(b) | Encrypted storage, content-free alerts, a covered chain end to end |
4. Clean trackers | Privacy Rule; OCR guidance | No analytics or ad pixels on pages that see patient data |
5. Session controls | § 164.312(a) | Unique logins, MFA, automatic logoff on admin and portal areas |
6. Written risk analysis | § 164.308(a)(1)(ii)(A) | A document mapping where PHI flows and what protects it |
Requirement one carries the rest. The host stores every form entry and database row, which makes it a business associate. The contract that binds it is explained clause by clause in our HIPAA business associate agreement guide. Requirement three is where most sites leak: the standards live in HIPAA compliant WordPress forms. Requirement four is the one OCR wrote guidance about, covered in HIPAA tracking technologies. And requirement five includes the timeout rule most sites miss, detailed in HIPAA automatic logoff requirements.
The split-site option: comply where it counts
You do not have to move everything. A common, defensible build keeps the marketing site on ordinary hosting. The PHI paths move to a covered setup. The public pages stay cheap and fast. The intake forms, booking flow, and portal live on BAA-covered hosting with the safeguards on. Two rules make the split real. No health questions on the ordinary side, ever. And the patient-facing links must point at the covered side, so data never takes the wrong road. Done this way, a HIPAA compliant website costs a fraction of moving the whole thing.
Which platform can you build it on?
Any platform whose data layer can live under a BAA can carry a HIPAA compliant website. Self-hosted WordPress on covered hosting is the common answer, and the full verdict is in is WordPress HIPAA compliant. Website builders mostly fail at the contract stage, with narrow exceptions we track in HIPAA compliant website builder. Custom applications work when they run on covered infrastructure. The platform is rarely the blocker. The contract and the configuration are.
Where compliant websites quietly fail
Four patterns show up in nearly every review we run. A form plugin emails intake details to the front desk in plain text. An analytics tag fires on the appointment page and ships identifiers to an ad platform. A WordPress admin session stays alive for two weeks because nobody changed the default. And a staging copy of the site, database included, sits on an uncovered server. None of these announce themselves. Each one turns a HIPAA compliant website back into an ordinary one without anyone noticing. This is exactly what our HIPAA website audit walks through, section by section.
What does a HIPAA compliant website cost?
A HIPAA compliant website costs less than most practices fear, when the split-site logic is applied. The covered hosting layer runs from $79 per month self-managed, BAA included, to $229 per month managed with migration included. The one-time work is securing the forms, removing the bad trackers, and writing the risk analysis. The full budget math, including where practices overspend, is in our 2026 HIPAA hosting cost guide. The expensive path is the other one: the 2026 penalty tiers run from $145 to $2,190,294 per violation, and the quiet failures above are violations.
The fast path, honestly
Two ways to get there, and we sell both, so weigh this as a disclosure. If you are building or moving a site, our healthcare hosting gives the PHI side of your site a covered home: BAA at every tier, encryption, firewall, logging, and backups, with the session hardening done as part of a managed build. If you already have a site and the question is "where does it leak," our client-side compliance review maps every form, tracker, and vendor against the six requirements. You get the fix list. Either way, tell us what your site collects and you will get a straight answer, including "your marketing site is fine where it is."
Frequently asked questions
What makes a website HIPAA compliant?
Six things: hosting under a signed BAA, encryption in transit and at rest, compliant forms, trackers kept away from patient data, session controls with automatic logoff, and a written risk analysis. The rules apply to the pages that touch PHI, not to every page.
Does my medical website have to be HIPAA compliant?
Only the parts that collect or display patient information. A pure marketing site with no health forms handles no PHI. The moment a form asks about symptoms or books an appointment, that path must meet the requirements.
How do I make my existing website HIPAA compliant?
Map where patient data flows, move those paths to BAA-covered hosting, secure the forms, strip trackers from PHI pages, add MFA and automatic logoff, and write the risk analysis. Many sites keep their marketing pages exactly where they are. That is the cheapest route to a HIPAA compliant website.
Can a HIPAA compliant website use Google Analytics?
Not on pages that see patient data. OCR's tracking guidance and a wave of enforcement made third-party pixels on patient pages a named risk. Keep analytics on the marketing side and off the booking, intake, and portal paths.
What does a HIPAA compliant website cost?
The covered hosting layer runs from $79 per month self-managed to $229 per month managed based on published 2026 pricing, plus one-time work on forms, trackers, and documentation. A split-site build keeps the total down by covering only the PHI paths.
Recap: HIPAA compliant website
To recap, a HIPAA compliant website covers every path patient data travels: BAA hosting, encryption, compliant forms, clean trackers, session controls, and a written risk analysis. Only the PHI-touching parts carry the duty, and a split-site build uses that to keep costs sane. The failures are quiet ones, so check the form emails, the pixels, and the session timeouts first. Get the hosting contract right, secure the paths, write it down, and the website stops being your compliance problem.
This article is general information, not legal advice. Regulatory citations reflect 45 CFR Parts 160 and 164 and OCR guidance as of August 2026; tracking-technology enforcement continues to evolve. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed August 2026.
Sources
45 CFR § 164.308 (administrative safeguards, BAA requirement, risk analysis): ecfr.gov
45 CFR § 164.312 (technical safeguards): ecfr.gov
HHS OCR: Use of online tracking technologies