HIPAA Compliant Website: Requirements and the 2026 Checklist
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-compliant-website
Last updated: October 20, 2026
A HIPAA compliant website is a site where every path patient data can travel is covered. That means hosting under a signed Business Associate Agreement (BAA), encrypted forms, clean trackers, controlled logins, and policies behind it all. Here is the good news buried in that sentence. Most healthcare websites only need part of the work. The marketing pages carry no patient data and need no special treatment. The parts that collect or show it, the forms, the booking flow, the portal, carry all the duty. Covering those parts well is what a HIPAA compliant website really means. This guide gives you the six requirements, the traps that break them, what it costs, and the fastest honest path to done.
TL;DR: Quick answer
A HIPAA compliant website needs six things. They are BAA-covered hosting, encryption in transit and at rest, compliant forms, trackers that never see patient data, session controls, and a written risk analysis.
Only the pages that touch protected health information (PHI) must meet the rules. A plain service page does not. The intake form does.
The hosting contract comes first. A perfect site on a host with no BAA fails on legal grounds before any technical test (45 CFR § 164.308(b)).
The common failures are quiet ones: a form emailing symptoms in plain text, an analytics pixel on the booking page, a login that never times out.
Realistic cost for a small practice: managed plans from $229 a month, and the first month includes 4 hours of migration and configuration. Securing forms and trackers is one-time work on top.
Does your website even need to be HIPAA compliant?
Start here, because the answer decides your budget. HIPAA follows the data, not the industry label. A site that only describes your services and lists your phone number handles no PHI. It needs good security, not HIPAA. The duty starts when the site collects or displays health information tied to a person. An intake form asking about symptoms. A booking flow for appointments. A portal showing results. Even a contact form becomes PHI handling the moment a visitor types health details into it. The full walk-through of that line is in who needs HIPAA-compliant hosting. If patient data flows anywhere on your site, the six requirements below apply to those paths.
The six requirements of a HIPAA compliant website
Each requirement below maps to a named rule. Together they are what a HIPAA compliant website actually means in 2026.
Requirement | The rule behind it | What it looks like |
|---|---|---|
1. BAA-covered hosting | 45 CFR § 164.308(b) | The host that stores your forms and database signs a BAA first |
2. Encryption | § 164.312(a)(2)(iv), (e) | TLS on every page, AES-256 on stored data |
3. Compliant forms | § 164.312, § 164.308(b) | Encrypted storage, content-free alerts, a covered chain end to end |
4. Clean trackers | Privacy Rule; OCR guidance | No analytics or ad pixels on pages that see patient data |
5. Session controls | § 164.312(a), (d) | Unique logins, MFA, automatic logoff on admin and portal areas |
6. Written risk analysis | § 164.308(a)(1)(ii)(A) | A document mapping where PHI flows and what protects it |
Requirement one carries the rest. The host stores every form entry and database row, which makes it a business associate. The contract that binds it is explained clause by clause in our HIPAA business associate agreement guide. Requirement three is where leaks often start: the standards live in HIPAA compliant WordPress forms. Requirement four is the one OCR wrote guidance about, covered in HIPAA tracking technologies.
Requirement five includes the automatic logoff rule, which is easy to overlook; it is detailed in HIPAA automatic logoff requirements. The MFA side of requirement five is covered in HIPAA MFA requirements. Requirement six, the risk analysis, has its own guide: HIPAA risk analysis.
The tickable version of these requirements is our HIPAA compliance checklist. What a practice website needs from its host is covered in medical website hosting.
Two of these rules could get stricter for a HIPAA compliant website. Today, encryption is an "addressable" safeguard, and § 164.312 requires you to verify each user's identity without naming multifactor authentication (MFA). Addressable does not mean optional. You must use it where reasonable and appropriate, or document why not and use an equivalent alternative if reasonable (45 CFR § 164.306(d)(3)). HHS proposed a Security Rule update on January 6, 2025. It would require MFA and encryption of ePHI at rest and in transit, with limited exceptions. It is still a proposal, and the federal regulatory agenda now targets a final rule in July 2027. Proposed requirements are not law yet; the current Security Rule still applies.
The split-site option: comply where it counts
You do not have to move everything. A common, defensible build keeps the marketing site on ordinary hosting. The PHI paths move to a covered setup. The public pages stay cheap and fast. The intake forms, booking flow, and portal live on BAA-covered hosting with the safeguards on. Two rules make the split real. No health questions on the ordinary side, ever. And the patient-facing links must point at the covered side, so data never takes the wrong road. Done this way, a HIPAA compliant website costs a fraction of moving the whole thing. Our guide to affordable HIPAA hosting shows why shrinking the covered part is the biggest saving.
Which platform can you build it on?
Any platform whose data layer can live under a BAA can carry a HIPAA compliant website. Self-hosted WordPress on covered hosting is the common answer, and the full verdict is in is WordPress HIPAA compliant. Our managed HIPAA WordPress hosting is one version of that covered hosting, with the BAA signed within 24 hours of signup, before patient data moves.
Website builders mostly fail at the contract stage, with narrow exceptions we track in HIPAA compliant website builder. Custom applications work when they run on covered infrastructure. The platform is rarely the blocker. The contract and the configuration are. If an agency builds or maintains the site, HIPAA compliance for marketing agencies covers the BAA and duties that come with it.
Where compliant websites quietly fail
Four quiet failures are worth checking first. A form plugin emails intake details to the front desk in plain text. An analytics or ad tag on the appointment page sends the visitor's IP address and appointment details to a vendor with no BAA. WordPress keeps an admin who ticks "Remember Me" logged in for 14 days by default. And a staging copy of the site, database included, sits on an uncovered server. None of these announce themselves. Each one turns a HIPAA compliant website back into an ordinary one without anyone noticing. To check your own site, work through our HIPAA website audit, section by section. For the analytics side, see is Google Analytics HIPAA compliant.
What does a HIPAA compliant website cost?
A HIPAA compliant website can cost less than you fear when the split-site logic is applied. The covered hosting layer starts at $229 a month for a managed plan, and your first month includes 4 hours of migration and configuration. After that, extra work is $175 an hour, quoted before work starts. The one-time work is securing the forms, removing the bad trackers, and writing the risk analysis. The full budget math, including where practices overspend, is in our 2026 HIPAA hosting cost guide. The expensive path is the other one. HHS's current penalty amounts, published in January 2026, run from $145 to $2,190,294 per violation (45 CFR § 102.3). Each quiet failure above can be a violation.
The fast path, honestly
Two ways to get there, and we sell both, so weigh this as a disclosure. If you are building or moving a site, our healthcare hosting gives the PHI side of your site a covered home on single-tenant AWS. We sign the BAA within 24 hours of signup, before patient data moves. Every plan includes a web application firewall, encryption at rest and in transit, six-year audit logging, and tested encrypted backups. HIPAA itself sets no log retention period; here is how long to keep HIPAA audit logs. Our BAA covers the servers and services we run, so your form, email, and EHR vendors need their own. Session timeouts and MFA inside WordPress or your app are software settings, so agree in writing who sets them.
If you already have a site and want to know where it leaks, start with our client-side compliance review. Either way, tell us what your site collects. If only your forms and booking flow touch PHI, those may be the only parts of a HIPAA compliant website that need to move.
Frequently asked questions
What makes a website HIPAA compliant?
Six things: hosting under a signed BAA, encryption in transit and at rest, compliant forms, and trackers kept away from patient data. Add session controls with automatic logoff and a written risk analysis. The rules apply to the pages that touch PHI, not to every page.
Does my medical website have to be HIPAA compliant?
Only the parts that collect or display patient information. A pure marketing site with no health forms handles no PHI. The moment a form asks about symptoms or books an appointment, that path must meet the requirements.
How do I make my existing website HIPAA compliant?
Map where patient data flows, and move those paths to BAA-covered hosting. Secure the forms, strip trackers from PHI pages, add MFA and automatic logoff, and write the risk analysis. Many sites keep their marketing pages exactly where they are. That is the cheapest route to a HIPAA compliant website. The step-by-step build order is in how to make your website HIPAA compliant.
Can a HIPAA compliant website use Google Analytics?
Not on pages that see patient data. Google says it does not offer Business Associate Agreements for Google Analytics. In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance. That part said an IP address plus a visit to a public health information page is, by itself, PHI. The rest of the guidance still applies. Trackers on patient portals, login pages, booking flows and apps can still expose PHI. Patients sue, too. In July 2026, a federal court approved Kaiser's $47.5 million class action settlement over trackers on its website and apps. Keep analytics on the marketing side and off the booking, intake, and portal paths. Here is what AHA v. Becerra changed.
What does a HIPAA compliant website cost?
Our managed plans start at $229 a month, and monthly plans have no long-term contract. Add one-time work on forms, trackers, and documentation. A split-site build keeps the total down by covering only the PHI paths.
Recap: HIPAA compliant website
To recap, a HIPAA compliant website covers every path patient data travels: BAA hosting, encryption, compliant forms, clean trackers, session controls, and a written risk analysis. Only the PHI-touching parts carry the duty, and a split-site build uses that to keep costs sane. The failures are quiet ones, so check the form emails, the pixels, and the session timeouts first. Get the hosting contract right, secure the paths, write it down, and the website stops being your compliance problem.
This article is general information, not legal advice. Regulatory citations reflect 45 CFR Parts 102, 160 and 164 and OCR guidance as of October 2026. HHS says it is still evaluating its next steps on the tracking guidance. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed October 2026.
Sources
45 CFR § 164.308 (administrative safeguards, BAA requirement, risk analysis): ecfr.gov
45 CFR § 164.312 (technical safeguards): ecfr.gov
HHS OCR: Use of online tracking technologies
45 CFR § 164.306 (addressable implementation specifications): law.cornell.edu
45 CFR § 102.3 (civil money penalty amounts): law.cornell.edu, updated by 91 FR 3665 (January 28, 2026)
HHS proposed Security Rule update: 90 FR 898 (January 6, 2025) and Unified Agenda, RIN 0945-AA22
AHA v. Becerra, No. 4:23-cv-01110 (N.D. Tex.): district court docket and Fifth Circuit docket 24-10775
Doe v. Kaiser Foundation Health Plan, No. 3:23-cv-02865 (N.D. Cal.), final approval order of July 14, 2026: courtlistener.com
Google: HIPAA and Google Analytics