How to Make Your Website HIPAA Compliant: 7 Steps in the Right Order (2026)
Last updated: August 24, 2026
To make a website HIPAA compliant, work in this order: map which pages touch patient data, move those paths to hosting with a signed Business Associate Agreement (BAA), rebuild the forms, strip the trackers, lock down access, turn on logging and backups, then write the risk analysis. Most guides tell you to start with an SSL certificate. That is backwards, and this guide explains why the order matters when you make your website HIPAA compliant. It walks the seven steps with the rule behind each one, what done looks like, and what it costs. It also starts with the best news in the whole topic: most of your website does not need any of this.
TL;DR: Quick answer
Seven steps, in order: map the PHI paths, get BAA-covered hosting, fix the forms, strip the trackers, lock down access, turn on logs and backups, write the risk analysis.
The contract comes before the configuration. A perfect site on a host with no BAA still fails on legal grounds (45 CFR § 164.308(b)).
Only the pages that collect or show patient data need the work. Marketing pages can stay where they are, which keeps the cost down.
Typical budget: from $79 per month self-managed (BAA included) to $229 per month managed (migration included), plus one-time work on forms and trackers.
The paperwork step is not optional. The risk analysis is the first document OCR requests, and its absence is what turns an incident into a penalty.
Step 1: map which pages actually touch patient data
The first move to make your website HIPAA compliant is a map, not a purchase. Start with scope, because scope decides your budget. List every page and feature, then mark the ones that collect, display, or send health information tied to a person: intake forms, booking flows, portals, quiz funnels, chat widgets, and any contact form that invites health details. Those paths carry the duty. A service page with a phone number does not. The line between the two is drawn in who needs HIPAA-compliant hosting. This split matters because of the build it allows. Marketing pages stay on ordinary hosting. The patient-data paths move to a covered environment. No health questions ever appear on the ordinary side. Done that way, you make your website HIPAA compliant for a fraction of the cost of moving everything, and the requirements you are about to meet apply only to the paths that need them.
Step 2: put those paths on hosting that signs a BAA
The second step to make your website HIPAA compliant is a contract, and this is the step most guides bury. Under 45 CFR § 164.308(b), no vendor may hold protected health information (PHI) for you without a signed BAA. Your host stores every form entry and database row, so the host signs first, before any patient data moves. No setting on a host that refuses the contract can fix the contract. What the agreement must contain, clause by clause, is in our HIPAA business associate agreement guide. The same test applies to every other vendor in the path: the form tool, the scheduler, the email service. Each one that touches PHI signs a BAA or leaves the stack.
Step 3: rebuild the forms
Forms are where most attempts to make your website HIPAA compliant spring their first leak, in two quiet ways. Submissions land in a plain database on a shared server, and notification emails quote the answers in plain text to the front desk inbox. Fix both. Store submissions encrypted, on the covered hosting from step 2. Switch the alerts to content-free ("a new form is waiting") or a BAA-covered mail path. Test it by submitting a form and reading the email that arrives. The full architecture, including plugin choices, is in HIPAA compliant forms.
Step 4: strip the trackers from patient pages
Two of the 18 HIPAA identifiers are URLs and IP addresses, and every analytics or ad pixel collects both. On a booking page, that pairing ties a real person to care-seeking, which is how tracking pixels produced eight-figure settlements and Kaiser's 13.4-million-record exposure. Open your booking and intake pages, press F12, and watch the Network tab for google-analytics, googletagmanager, facebook, and doubleclick. Pull every match off the PHI paths and measure with self-hosted or BAA-signing analytics instead. The rules and safer tools are in HIPAA tracking technologies.
Step 5: lock down who gets in and how long sessions live
To make your website HIPAA compliant on the access side, the named safeguards under 45 CFR § 164.312(a) and (d) are: one login per person, multi-factor authentication on every admin account, old accounts removed the day someone leaves. Then set the timeout. Most platforms keep sessions alive for days by default, and idle sessions on admin and portal areas violate the automatic logoff specification (§ 164.312(a)(2)(iii)). The timeout tiers that hold up are in HIPAA automatic logoff requirements.
Step 6: turn on the ops layer
Three quiet systems make your website HIPAA compliant underneath everything else. Encryption: TLS on every page and encrypted storage underneath (§ 164.312(a)(2)(iv), (e)). Audit logs: who accessed what, kept six years and actually reviewed (§ 164.312(b), § 164.316(b)). Backups: encrypted, stored apart from production, with a restore you have really tested (§ 164.308(a)(7)). On good HIPAA hosting these arrive configured, which is the point of step 2. Verify them anyway, in writing. The recovery half is covered in HIPAA backup and disaster recovery.
Step 7: write it down
The work to make your website HIPAA compliant does not count until it is documented. Write the risk analysis: every system from step 1, its threats, its controls, its risk level, required under § 164.308(a)(1)(ii)(A) and the first document OCR requests in an investigation. The nine elements it must contain are in HIPAA risk analysis. Then keep yourself honest with the tickable HIPAA compliance checklist, and calendar a yearly review plus a re-check after any redesign, new form, or new vendor.
The seven steps at a glance
Step | The rule behind it | Done looks like |
|---|---|---|
1. Map the PHI paths | Scope; § 164.308(a)(1) | A page list with every PHI path marked |
2. BAA-covered hosting | § 164.308(b) | Signed BAA on file before data moves |
3. Rebuild the forms | § 164.312, § 164.308(b) | Encrypted storage, content-free alerts |
4. Strip the trackers | § 164.502(a); OCR guidance | No ad or analytics pixels on PHI pages |
5. Access and sessions | § 164.312(a), (d) | Unique logins, MFA, idle timeout set |
6. Encryption, logs, backups | § 164.312, § 164.308(a)(7) | TLS everywhere, six-year logs, tested restore |
7. Risk analysis and review | § 164.308(a)(1)(ii)(A) | Dated document, yearly review on the calendar |
Why the order matters
Most step guides start with the SSL certificate, because it is the easiest step. But encryption on a host that signs no BAA protects data the law says cannot be there at all. Scope comes first because it shrinks every later step. The contract comes second because it is the legal floor the technical work stands on. The paperwork comes last because it has to describe a finished system, not a planned one. Follow the sequence and each step to make your website HIPAA compliant builds on the one before it. Skip around and you end up like the practices in OCR's enforcement files: encrypted, certified, and still in violation on contract or documentation grounds, with 2026 penalty tiers running $145 to $2,190,294 per violation.
Which platform are you on?
The steps to make your website HIPAA compliant are the same on every platform; the difficulty is not. On self-hosted WordPress, every step has a clean path, and the WordPress-specific version of this build, plugins and all, is in how to make WordPress HIPAA compliant. On website builders, step 2 is the wall: most refuse the BAA, with the narrow exceptions tracked in HIPAA compliant website builder. On custom applications, the steps map to your infrastructure, and the buyer-ready version is in HIPAA compliant hosting for healthcare SaaS. If you are choosing a platform today, choose for step 2, because everything else is fixable later and the contract is not.
What it costs to make your website HIPAA compliant
The recurring cost is the covered hosting layer: from $79 per month self-managed with the BAA included, to $229 per month managed with migration included. The one-time cost is steps 3 and 4, fixing the forms and removing the trackers, plus the honest afternoon step 7 takes. The split-site build from step 1 is what keeps those numbers small, because only the PHI paths ride the covered layer. The full market math is in our 2026 HIPAA hosting cost guide. Compare all of it to the downside: the quiet failures this guide fixes are the exact patterns in OCR's settlement announcements.
Where to get help, and where you do not need it
Here is the honest pain point. Steps 1, 5, and 7 are within reach of any careful practice manager with this guide open. Steps 2 and 6 are what hosting is for, and steps 3 and 4 are the ones an office cannot fully see from the inside, because the evidence lives in mail paths and browser scripts. We sell both halves, so weigh that as a disclosure. Our healthcare hosting covers steps 2, 5, and 6 out of the box: BAA at every tier, encryption, session hardening, six-year logging, tested backups. Our client-side compliance review is steps 3 and 4 done professionally: every form, script, and vendor mapped, with fixes, in a report your risk analysis can cite. And if step 1 shows your site holds no patient data at all, you need none of this, and we will tell you so. Send us your page map and we will tell you which steps you can close yourself for free.
Frequently asked questions
How do you make a website HIPAA compliant?
Seven steps in order: map which pages touch patient data, move those paths to BAA-covered hosting, rebuild the forms with encrypted storage and content-free alerts, remove trackers from patient pages, enforce unique logins with MFA and timeouts, verify encryption, logging, and backups, then write the risk analysis.
Does my whole website need to be HIPAA compliant?
No. Only the pages that collect, display, or send patient data carry the duty. A common build keeps marketing pages on ordinary hosting and moves the forms, booking flow, and portal to a covered environment, with no health questions on the ordinary side.
What is the first step?
Mapping, not encryption. List every page and mark the PHI paths, because scope decides the budget and every later step. The first purchase, if one is needed, is hosting that signs a BAA, since the contract precedes the configuration.
How much does it cost to make a website HIPAA compliant?
The covered hosting layer runs from $79 per month self-managed (BAA included) to $229 per month managed (migration included), based on published 2026 pricing. Add one-time work on forms and trackers. The split-site build keeps totals down by covering only the PHI paths.
Is an SSL certificate enough to make a website HIPAA compliant?
No. TLS is one required control among many. Without a signed BAA from the host, encrypted forms, clean trackers, access controls, logging, backups, and a written risk analysis, an SSL certificate is a padlock on a door the law says cannot hold patient data.
Recap: make your website HIPAA compliant
To recap, you make your website HIPAA compliant in seven ordered steps: map the PHI paths, put them on BAA-covered hosting, rebuild the forms, strip the trackers, lock down access and sessions, verify encryption, logs, and backups, and write the risk analysis. Only the patient-data paths need the work. The contract comes before the configuration, and the paperwork proves the rest. Work the list once, calendar the yearly review, and the website stops being your compliance problem.
This article is general information, not legal advice. Regulatory citations reflect 45 CFR Parts 160 and 164 and OCR guidance as of August 2026; pricing reflects published 2026 rates and may change. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed August 2026.
Sources
45 CFR § 164.308 (administrative safeguards: BAA requirement, risk analysis, contingency plan): ecfr.gov
45 CFR § 164.312 (technical safeguards: access, automatic logoff, audit, encryption): ecfr.gov
45 CFR § 164.316 (documentation and six-year retention): ecfr.gov
HHS OCR: Use of online tracking technologies