How to Make WordPress HIPAA Compliant: 8-Step 2026 Guide

Last updated: October 22, 2026

Here is how to make WordPress HIPAA compliant in eight steps. Move to hosting that will sign a Business Associate Agreement (BAA), limit which pages touch patient data, switch to secure forms, and turn on encryption. Then lock down logins, turn on audit logs, harden and back up WordPress, and run a yearly risk analysis with staff training. WordPress on its own is not HIPAA compliant. WordPress.com's terms of service include no BAA, and a standard install lacks the safeguards the law requires. The good news is that only the parts of your site that collect or store protected health information (PHI) must be compliant, not every page. The work splits into technical safeguards, like hosting, encryption, forms, and logs, and administrative safeguards, like policies, risk analysis, and training. Both sets are defined in the HIPAA Security Rule at 45 CFR Part 164.

TL;DR: Quick answer

• WordPress is not HIPAA compliant by default. WordPress.com's terms of service include no BAA, so host the site with a provider that will sign one, as 45 CFR § 164.308(b) requires.

• Only pages that collect or display PHI, usually intake and contact forms, must meet HIPAA standards. Plain marketing pages that store no patient data do not.

• Technical safeguards under 45 CFR § 164.312 include encryption in transit and at rest, unique logins, automatic logoff, and audit controls. HIPAA sets no retention period for logs, but you must keep required documentation for six years (45 CFR § 164.316(b)(2)(i)).

• Administrative safeguards under 45 CFR § 164.308 require a written security risk analysis and staff training. OCR runs an enforcement initiative on risk analysis, and its 14th action came in June 2026.

• A managed HIPAA host can configure the server side and sign the BAA. Our managed plans run on single-tenant AWS from $229 a month, billed monthly with no long-term contract.

How to make WordPress HIPAA compliant, step by step

The eight steps below show how to make WordPress HIPAA compliant from the ground up. Work through them in order, because each one builds on the last. Before you learn how to make WordPress HIPAA compliant step by step, gather four things. First, a list of every page and form on your site. Second, a clear note of which of those collect health information, such as appointment requests, intake forms, or symptom questions. Third, admin access to your current hosting account. Fourth, the name of the person who will own compliance going forward, often a practice manager or office lead. Not on WordPress? The platform-neutral version of this build is how to make your website HIPAA compliant.

Step 1: Move to hosting that signs a BAA

Start with hosting, because nothing else counts without it. This is the foundation of how to make WordPress HIPAA compliant. A BAA is the written contract in which your host promises to safeguard PHI. HIPAA lets a host create, receive, maintain, or transmit electronic PHI for you only with that assurance in place (45 CFR § 164.308(b)). If a host will not sign one, you cannot store patient data on it. Our guide to the HIPAA Business Associate Agreement covers what it should include.

Budget hosts like Bluehost do not sign BAAs, and WordPress.com's terms of service include none either (both checked October 20, 2026). Premium managed WordPress platforms are no exception; our answer to is WP Engine HIPAA compliant explains why its lack of a BAA rules it out too. Site builders differ. Wix announced a HIPAA option with a signable Business Associate Agreement on April 7, 2026. It requires activating PHI protection on a Business, Plus, Elite, Business Elite or Enterprise plan before signing (is Wix HIPAA compliant).

If you are weighing WordPress against drag-and-drop platforms first, see our HIPAA compliant website builder comparison. Choose a host built for healthcare that signs the BAA, encrypts your data, and keeps audit logs. What that buys over an ordinary plan is set out in HIPAA compliant hosting vs regular hosting. The host comparison behind step one is in best HIPAA WordPress hosting.

Our HIPAA compliant WordPress hosting runs your site on single-tenant AWS. Every plan includes a web application firewall, encryption at rest and in transit, tested encrypted backups, and six-year audit logging. We sign the BAA within 24 hours of signup, before patient data moves. Your first month includes 4 hours of migration and configuration for your existing site. Here is what the 4 hours cover; after that, work is $175 an hour, quoted before work starts. For a move with no gap in coverage, follow our plan to migrate to HIPAA compliant hosting.

Step 2: Map which pages actually handle PHI

You do not need to make your whole website compliant. You need to make the parts that touch PHI compliant. Walk through your page list and mark every form or feature that collects health details. Common examples are new patient intake forms, appointment requests that ask about symptoms, and patient portals. A simple "contact us" form that asks only for a name and email is lower risk. Treat its submissions as PHI the moment it invites health questions. This step keeps your project focused and your costs down. The wider, platform-neutral requirements are in our HIPAA compliant website guide.

Check tracking tools on those pages as well. In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance. The rest still applies. Trackers on patient portals, login pages, booking flows and apps can still expose PHI. Our guide to HIPAA tracking technologies explains what is still allowed.

Step 3: Replace stock forms with HIPAA-ready forms

Standard WordPress form plugins are not HIPAA compliant on their own. Contact Form 7 does not store submissions; it sends each one by email. WPForms says paid licenses store form entries in your WordPress database. Neither maker offered a BAA when we checked on October 20, 2026. A plugin maker that never receives your submissions is not a business associate, so it needs no BAA (45 CFR § 160.103). Then the BAAs that matter are your host's and, for emailed entries, your email provider's.

WPForms Lite is the catch. It does not save entries in your WordPress database, and its setup wizard has a pre-checked box that turns on Lite Connect. Lite Connect backs up every entry to WPForms servers, so turn it off before any form collects health information.

Run the plugin on hosting that signs a BAA, encrypt stored entries, and do not email submissions in plain text. Our BAA covers the servers and services we run, so an outside form service or mailbox needs its own BAA. If you would rather not keep entries on your own server, use a form service built for HIPAA that signs its own BAA.

For the WordPress-specific architecture, plugin choices, and where entries should live, see our dedicated guide to HIPAA compliant WordPress forms. The form side is covered in depth in HIPAA compliant forms. Selling health products or services through the site adds an ecommerce layer, covered in is WooCommerce HIPAA compliant.

Step 4: Turn on encryption in transit and at rest

Encryption scrambles patient data so it cannot be read without a key. HIPAA treats encryption as "addressable" under 45 CFR § 164.312(a)(2)(iv) and (e)(2)(ii). That means you must use it where reasonable and appropriate, or document why not and use an equivalent measure instead. In practice, you should always use it. Protect data moving across the internet with TLS 1.2 or higher, and TLS 1.3 where you can. Protect stored data with strong encryption such as AES-256.

That may change. HHS proposed the first major Security Rule update since 2013 on January 6, 2025. It would require encryption of ePHI at rest and in transit, with limited exceptions. It is still a proposal. The federal regulatory agenda now targets a final rule in July 2027 (see our new HIPAA Security Rule tracker). Separately, S. 3315, the Health Care Cybersecurity and Resiliency Act, passed the Senate on September 30, 2026. It now waits in the House and is not law. If enacted as passed, HHS would have to require multifactor authentication, encryption of PHI, and security testing. Proposed requirements are not law yet; the current addressable standard still applies.

Step 5: Control who can log in

HIPAA requires that only authorized people reach patient data under 45 CFR § 164.312(a) and (d). Give every user a unique login, never a shared account, so you can tell who did what. Turn on multi-factor authentication (MFA) for all admin accounts, which means a password plus a second code. The full MFA picture, including what the proposed rule would change, is in HIPAA MFA requirements. Set automatic logoff so an idle session closes on its own, as called for in 45 CFR § 164.312(a)(2)(iii). Remove old accounts the day someone leaves. These steps are simple, and they blunt password guessing, one of the most common attacks on WordPress sites.

Step 6: Turn on audit logs and decide how long to keep them

HIPAA's audit controls standard (45 CFR § 164.312(b)) requires tools that record and examine activity in any system that holds or uses electronic PHI. You must also regularly review those records, such as audit logs and access reports (45 CFR § 164.308(a)(1)(ii)(D)). Logging needs to cover the server, WordPress, and your forms, and someone needs to review it for anything unusual.

The audit controls standard sets no retention period for the logs themselves. HIPAA does require you to keep Security Rule documentation for six years (45 CFR § 164.316(b)(2)(i)). The clock runs from when a document was created or last in effect, whichever is later. Many organizations keep logs for six years to line up with the documentation rule. Our guide to HIPAA audit logs covers what to record and how long common tools keep logs by default.

This is hard to do well by hand. Our managed plans include six-year audit logging. The review duty still applies to your practice, so name who reads the logs and how often.

Step 7: Harden and back up WordPress

A compliant host gives you a secure foundation, but part of how to make WordPress HIPAA compliant happens inside WordPress itself. Do not use "admin" as a username, and use strong passwords. Keep WordPress core, themes, and plugins updated, and remove plugins you do not use. WordPress's own hardening guide says the most common attacks target known flaws, such as in outdated plugins, or guess passwords by brute force. Which plugin categories are worth running at all is sorted in HIPAA compliant WordPress plugins.

Run a web application firewall to block common attacks. Keep encrypted backups, and test that you can restore them. HIPAA requires a data backup plan and a disaster recovery plan under 45 CFR § 164.308(a)(7). Our managed plans include a web application firewall, tested encrypted backups, and EBS storage with 7-day snapshot retention. With any host, confirm in writing who applies WordPress core and plugin updates. The full recovery side, including restore testing, is in HIPAA backup and disaster recovery.

WordPress updates do not patch PHP, so check that your server runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later release of the same branch. The PHP development team released these versions on October 21, 2026, to fix two critical flaws that can allow unauthenticated remote code execution. To see your PHP version in WordPress, open Tools, then Site Health, then the Info tab, and expand Server. Linux distributions can ship the fix without changing the main version number. Ubuntu 24.04, for example, lists its fixed package as version 8.3.6-0ubuntu0.24.04.13. So if your PHP comes from a distribution, ask your host or vendor to confirm the patched package, as php.net advises.

PHP 8.2 gets no security fixes after December 31, 2026, so plan a move to 8.3 or later. PHP 8.1 and older get no updates from the PHP project, so ask your vendor about backported fixes or move to a supported version now.

Step 8: Run a risk analysis and train your staff

Technology is only half of HIPAA. The Security Rule also requires administrative safeguards. You must complete a written security risk analysis under 45 CFR § 164.308(a)(1)(ii)(A). HHS says the Security Rule does not specify how often to perform it, and that the process should be ongoing. Some organizations repeat it annually, others as needed, depending on their environment. A yearly review, plus one after any major change such as a new host or form tool, is a sensible default. HHS offers a free Security Risk Assessment (SRA) Tool designed for small and medium-sized practices. OCR runs a Risk Analysis Initiative, and its 14th enforcement action came in June 2026, so do not skip this step. The nine elements that analysis must contain are in our HIPAA risk analysis guide.

You also must train staff on your policies under 45 CFR § 164.308(a)(5). To understand how the administrative, physical, and technical layers fit together, read our guide to HIPAA safeguards explained. Keep the work honest with our HIPAA compliance checklist for websites, which maps every item to its rule.

Common mistakes to avoid

When practices ask how to make WordPress HIPAA compliant, three mistakes show up again and again. The first is assuming the whole site must move to a special platform, when only the parts that handle PHI need to be compliant. The second is collecting health details through a stock contact form with no BAA behind it. The third is treating compliance as a one-time setup, when it needs ongoing updates, log review, and a risk analysis you keep current. Plan for the upkeep, not just the launch.

Recap: how to make WordPress HIPAA compliant

To recap, here is how to make WordPress HIPAA compliant. Host with a provider that signs a BAA, map your PHI pages, secure your forms, and encrypt data in transit and at rest. Then control logins, turn on audit logs, harden and back up WordPress, and run a yearly risk analysis with staff training. Do those eight things and you have covered the core safeguards for a WordPress site. That, in short, is how to make WordPress HIPAA compliant without guesswork.

Frequently asked questions

How do you make a WordPress site HIPAA compliant?

You make a WordPress site HIPAA compliant by moving it to hosting that signs a BAA and securing any forms that collect PHI. Then turn on encryption, control logins, switch on audit logs, harden WordPress, and complete a yearly risk analysis with staff training.

Is WordPress HIPAA compliant out of the box?

No. WordPress.com's terms of service include no BAA, and a standard self-hosted install lacks required safeguards. You can make a self-hosted WordPress site compliant by adding compliant hosting, secure forms, encryption, access controls, and logging. The full verdict, covering WordPress.com and WordPress VIP, is in our answer to is WordPress HIPAA compliant.

Do I need HIPAA hosting if my site only has a contact form?

If that form collects health information, yes. The risk comes from the data, not the page count. A form that asks about symptoms or conditions handles PHI and must be protected.

Are WPForms or Contact Form 7 HIPAA compliant?

Not on their own. Both run on your own server, so the BAA you need is usually your host's, not the plugin maker's. Contact Form 7 sends submissions by email, and paid WPForms licenses store entries in your WordPress database. WPForms Lite's setup wizard pre-checks Lite Connect, which backs up entries to WPForms servers, so turn it off. Use hosting that signs a BAA, encrypt stored entries, and stop emailing entries in plain text.

Does every page on my website need to be compliant?

No. Only pages that collect, display, or store PHI must meet HIPAA standards. Plain informational pages that store no patient data do not carry the same requirements.

How long does it take to make a WordPress site compliant?

It depends on the size of the site and how many forms touch PHI. With us, the BAA is signed within 24 hours of signup, before patient data moves. Your first month includes 4 hours of migration and configuration, and work beyond that is $175 an hour, quoted before work starts. The administrative work, such as your risk analysis and staff training, is ongoing.

Get help making your WordPress site compliant

Knowing how to make WordPress HIPAA compliant is one thing; configuring it is another. HIPAA Compliant Hosting is a managed HIPAA hosting provider, so we have a commercial interest in this topic. We share these steps because a covered entity that understands them makes safer choices, whoever it hosts with. If you would rather not configure the server safeguards yourself, our HIPAA compliant WordPress hosting sets up the firewall, encryption, and six-year audit logging for you. We sign the BAA within 24 hours of signup. Your first month includes 4 hours of migration and configuration for your existing site. Plans start at $229 per month, billed monthly with no long-term contract.

Ready to move? Request a quote and tell us which forms on your site collect patient information.

This article is general information, not legal advice. Regulatory details are based on the current HIPAA Security Rule (45 CFR Part 164) as of October 2026. The encryption and MFA changes in the January 6, 2025 proposed rule are not final; the federal regulatory agenda targets a final rule in July 2027. Vendor positions were checked on October 20, 2026, and can change. Confirm your specific obligations with qualified legal counsel.

Sources

• 45 CFR 164.306 (required and addressable specifications), 164.308 (administrative safeguards) and 164.312 (technical safeguards).

• 45 CFR 160.103 (definition of business associate) and 164.316 (documentation and its six-year retention period).

• HHS: Guidance on Risk Analysis. HealthIT.gov: Security Risk Assessment Tool.

• HHS OCR: 14th Risk Analysis Initiative action (announced June 18, 2026).

• Proposed rule: 90 FR 898 (January 6, 2025), the HHS fact sheet and the Unified Agenda, RIN 0945-AA22.

• Congress.gov: S. 3315 actions.

• AHA v. Becerra: district court docket. HHS: online tracking bulletin.

• WordPress.com: Terms of Service (last updated October 6, 2026). WordPress.org: Hardening WordPress and Get a faster, more secure website: update PHP today.

• PHP: Security advisory: Critical remote code execution vulnerabilities, update now (October 21, 2026; CVE-2026-109618 and CVE-2026-109619) and Supported Versions.

• Ubuntu: CVE-2026-109618 and CVE-2026-109619 (both updated October 21, 2026).

• Bluehost: Hosting Services: HIPAA Compliance and Limitations. WP Engine: Is Your Website HIPAA Compliant? (updated September 17, 2026).

• Wix: HIPAA compliance launch (April 7, 2026) and HIPAA Compliance for Your Wix Site.

• WPForms: Security and Compliance, Lite Connect Entry Backups (updated September 9, 2026) and Setup Wizard (updated July 14, 2026).

• Contact Form 7: Save submitted messages with Flamingo.