Blog

How to Make Your Website HIPAA Compliant: 7 Steps in the Right Order (2026)

Most guides start with the SSL certificate. That is backwards. The seven steps in the order that works: map which pages touch patient data, get the BAA, rebuild the forms, strip the trackers, lock down access, verify the ops layer, and write the risk analysis. With the rule behind each step, real costs, and the parts you can do yourself for free.

Joseph Abear · Aug 24, 2026

HIPAA Risk Analysis: The 9 Elements OCR Looks For in 2026

The risk analysis is the one document OCR asks for first and the one most practices cannot produce. Its nine required elements, why the website is the system most analyses leave out of scope, what OCR's 2024 enforcement initiative is finding, and how a small practice builds a defensible one with HHS's free tool.

Joseph Abear · Aug 18, 2026

HIPAA Website Audit: How to Check Your Site and Fix What You Find

Your website is an ePHI system, and OCR's most-cited failure is the risk analysis that never covered it. A HIPAA website audit checks three layers: the hosting and BAA, the forms and data flows, and the tracking scripts running in your visitors' browsers. Here is the 15-minute self-audit, what audits usually find, and what each fix costs.

Joseph Abear · Jul 13, 2026

HIPAA Automatic Logoff: What the Rule Requires and What Timeout to Set

HIPAA automatic logoff is an addressable rule under 45 CFR § 164.312(a)(2)(iii). HIPAA names no exact timeout; risk analysis sets it, usually 2 to 15 minutes. Here is what the rule says, what times to pick by workspace, and why your website sessions count too.

Joseph Abear · Jun 11, 2026

How to Make WordPress HIPAA Compliant: 8-Step 2026 Guide

WordPress is not HIPAA compliant out of the box. This guide walks through eight steps to make a WordPress site HIPAA-ready: compliant hosting with a signed BAA, secure forms, encryption, access controls, six-year audit logs, and a yearly risk analysis.

Joseph Abear · Jun 8, 2026

Will Termageddon Make Your Website HIPAA Compliant?

Termageddon is a well-regarded generator for website privacy policies, terms, and cookie consent, but those documents address general privacy laws, not HIPAA. Compliance still requires a BAA, a risk analysis under 45 CFR § 164.308(a)(1)(ii)(A), and Security Rule safeguards. Here is where each layer fits.

Joseph Abear · Jun 3, 2026