Blog Post

Ru    Runing a medical practice without a website is not realistic anymore. Your patients expect to find you online, book appointments through their phones and access their health records without calling your office. But here’s what catches most practitioners off guard: your website is not just a marketing tool—it is a potential HIPAA liability if you do not set it up correctly.
I started working with healthcare practices back in 2012 and I have watched countless doctors, dentists and therapists make expensive mistakes with their websites. Some got hit with five-figure fines. Others faced investigations that cost them months of stress and legal fees. The worst part?

Foundation: Comprehension HIPAA in Simple Language

The core principle is simple: protect your patients’ health information. When that information gets combined with anything that identifies them personally, it becomes Protected Health Information—PHI. And PHI has special rules.The penalties start at $100 per violation and can climb to $50,000 each time you mess up. If you’re repeatedly careless, you could face $1.5 million in fines annually. I’ve seen a small dental practice pay $80,000 because they didn’t properly secure their online appointment system. The violation seemed minor to them at the time.

What Actually Counts as PHI on Your Website?

This trips up almost everyone. PHI isn’t just your patient’s diagnosis or their prescription details. It’s any health information connected to someone’s identity.Last year, a physical therapist showed me their website. They had a testimonials page with patient photos, full names and descriptions of the injuries they treated. “But they said I could use these!” the therapist insisted. Except they only had verbal permission. HIPAA requires specific written authorization that explains exactly what information you’ll share and where it’ll appear.Your appointment reminders? If they mention why someone’s coming in, that’s PHI. Emails saying “Your diabetes follow-up is Tuesday” combine identity with health information. Even “Your appointment with Dr. Smith” could be problematic if Dr. Smith only treats a specific condition.

Contact forms are another trap. That innocent “What brings you to our office?” field?

Your Website’s Security: The Non-Negotiables

 If not, stop everything and fix this today. That “s” stands for secure and it means your site encrypts data between the server and your visitors’ browsers.

Without HTTPS, patient information travels across the internet like a postcard. Anyone with basic technical skills can intercept it. I’m not exaggerating—this is script kiddie level stuff. No HTTPS means no HIPAA compliance, period.Next up: your hosting company. If they say What’s that? We don’t do those,” you need to switch hosts immediately. A BAA is a legal contract that makes your hosting company responsible for protecting any PHI they might access.learned this the hard way years ago. A client used a popular budget hosting service that explicitly refused to sign BAAs. When we tried to launch their patient portal, we realized the whole thing was a non-starter.Every staff member who can log into your website data management needs their own username and password. No sharing logins. No “admin123” passwords. And definitely no sticky notes with passwords on them stuck to monitors.

Set up automatic logouts. If someone walks away from their computer while logged into your patient system, that session should end after 10-15 minutes of inaction. I once walked through a medical office and counted four computers left logged in to their enduring database. Anyone could have walked by and accessed hundreds of patient records.You need audit logs too. These track who accessed what information and when. If there’s ever a breach, these logs are the first thing investigators want to see. They’re also how you catch internal problems before they become disasters.

Patient Portals: Convenience Meets Compliance Challenges

Patient portals are amazing when done right. Your patients can view test results, request prescription refills, message your staff and schedule appointments without playing phone tag. But portals also create concentrated points of risk.Before you implement any portal, verify that the vendor is truly HIPAA-compliant. Don’t take their word for it—ask for documentation. Check if they’ve had security audits. Read their BAA carefully before signing it. Some vendors have clauses that limit their liability in ways that should concern you.The portal needs strong authentication. That means requiring complex passwords with a mix of upper and small letters, numbers and symbols. Much better, add two-factor verification where users get a code texted to their phone or produced by an app.Here’s a mistake I see constantly: practices set up portals but don’t educate patients about security. Your patients need to know they should never share login details, should log out after each session and should not access their portal over public WiFi at Starbucks without a VPN.

Appointment reminder systems deserve special notice. Text and email reminders are incredibly useful for reducing no-shows, but HIPAA limits what you can include. A reminder should have the date, time and location—that’s it. Do not include the appointment type, the provider’s specialty, or anything else that hints at why they’re coming in.

Contact Forms and Data Collection: Where Most Practices Slip Up

Your website probably has a contact form. Maybe it asks for a name, email, phone number and “How can we help you?” That last field is where things get dangerous.Patients do not know HIPAA rules. They will write things like “I need an appointment because I’ve been having severe headaches and dizziness for two weeks.” Boom—you just collected PHI through an unsecured form.The second option means working with a form service that’ll sign a BAA and encrypts data at rest, not just in transit.New patient intake forms are even riskier. These typically ask for medical history, current medications, reactions, previous surgeries and insurance information—basically a complete PHI profile. If you are collecting this online, you absolutely need a HIPAA-compliant form solution with proper encryption and secure storage.

I’ve seen practices use free form builders like Google Forms for intake paperwork. Google clearly states that Google Forms is not a HIPAA- issue and they do not sign BAAs for it. Every patient form submitted that way is a potential violation.

The Google Analytics Problem Nobody Talks About

This is where things get technical, but stay with me because this trips up almost everyone. You probably have Google Analytics tracking your website traffic. That’s standard practice for understanding how people find and use your site. But Google Analytics becomes a HIPAA problem if it’s tracking pages that contain PHI.

Let me paint a picture. A patient logs into your portal. Google Analytics records their session, including URLs they visit. If those URLs include patient identifiers or information about their conditions (like “/patient/12345/diabetes-results”), you’ve just sent PHI to Google. Google’s standard Analytics doesn’t have a BAA, so this violates HIPAA.The solution involves careful configuration. You need to anonymize IP addresses, exclude tracking on patient portal pages entirely and strip any identifying information from URLs before they hit Analytics. Some practices use alternative analytics tools that are designed for HIPAA compliance.Facebook pixels and remarketing tags create similar issues. These tools track user behavior to show directed ads. But if they are active on pages where patients might be logged in or viewing health information, they could be collecting PHI. I generally recommend keeping these tracking tools completely off any pages that might contain patient information.

Email Marketing: It is More Complicated Than You Think

 healthcare practices send marketing emails—monthly newsletters, health tips, appointment reminders. General marketing emails usually aren’t HIPAA issues because they don’t contain PHI. An email blast about flu shot availability going to your subscriber list is fine.

But what if you segment that list? Let’s say you want to send information about diabetic foot care to patients with sugar disease. Now you are using health information to target specific patients. This requires extra care.Your email service provider needs to sign a BAA. MailChimp, Constant Contact and most popular services won’t sign BAAs for standard accounts. You need to use services specifically designed for healthcare or pay for enterprise plans with HIPAA compliance features.Direct patient communication via email needs explicit consent. When patients fill out intake paperwork, include a section where they acknowledge the risks of email connect and authorize you to send health information this way. Be clear that email is not perfectly secure.

My recommendation? Use your patient portal for anything involving PHI. Save email for general appointment confirmations (without health details) and marketing messages. It’s simpler and much less risky.

Patient Testimonials and Photos: Getting This Right

Testimonials are marketing gold, but they’re also where practices commonly violate HIPAA. A patient saying “Dr. Johnson is great!” on Google Reviews is fine—that’s unsolicited and patient-initiated. But you posted that review on your website without permission? Potentially problematic.If you want to feature patient stories on your website, you need detailed written authorization. This can’t be buried in your general consent forms.Never identify clients by name in photos unless you have explicit permission. Even then, consider using first names only or initials. The less identifying information, the better.

For online reviews, do not ask patients to mention specific treatments or conditions. Keep requests generic:If you had a positive experience, we’d appreciate a review. If patients voluntarily share health information in their reviews, document that it was unsolicited. You can not control what people write about themselves, but you can control what you request.

The Business Associate Agreement: Your Safety Net

Every vendor that might access PHI needs to sign a BAA. That includes your web host, patient portal provider, email service, form processor and even services you might not immediately think of as handling PHI.A BAA makes the vendor legally responsible for protecting any PHI they access. It outlines their security obligations, what happens if there’s a breach and how liability gets allocated. Without a signed BAA, you’re on the hook for their mistakes.

Here’s what shocks people: many popular services explicitly won’t sign BAAs or support HIPAA compliance. Standard Google Analytics? No BAA. Basic Wix or online tool websites?  

Training Your Team: The Human factor

Technology can only protect you so far. Your staff needs to understand HIPAA compliance for everything they do online. That means regular training—at least annually and whenever you implement new systems .Document everything. Keep records of who attended training, what topics you covered and when sessions occurred. If there’s ever an investigation, you will need to prove you took compliance seriously.Designate someone as your HIPAA Privacy Officer and someone as your Security Officer. 

When Things Go Wrong: Breach Reaction

HIPAA requires specific breach notification procedures. If more than 500 people are affected, you have to notify the unit of Health and Human Services and local media within 60 days. For smaller breaks, you still need to notify affected persons within 60 days and report to HHS every year.Speed matters. The faster you respond, the better you look to regulators and affected patients. Transparency matters too. Trying to hide a breach always makes things worse.I have helped practices through several breach investigations. The ones that had plans in place, responded quickly and communicated clearly faced much smaller consequences than practices that panicked or tried to downplay what happened.

Mobile Devices Add Another Layer

Your patients are accessing their health information from phones and tablets. This creates new security challenges you need to address.

Educate patients about mobile security. They should use strong device passcodes or biometric locks. They shouldn’t access their health information over public WiFi without a VPN. They should keep their apps and running systems updated.

Staying Current: HIPAA Keeps Developing

HIPAA regulations do not stay fixed.The Office for Civil Rights issues new guidance, enforcement priorities shift and technology creates new compliance challenges. You can not just set up a compliant website once and forget about it.Schedule regular compliance reviews—at least annually. Check that all your vendor BAAs are current. Verify your security moves still meet requirements.  

The Underside Line

HIPAA compliance for healthcare websites is not something you can handle once and ignore.. It requires continuous attention, regular updates and a commitment to protecting your patients’ privacy in a steadily digital world.The regulations might seem mind-blowing, especially if technology is not your strong suit. But they exist for good reasons. Every requirement ultimately serves the goal of keeping your patients’ sensitive health information private and secure.Your patients trust you with their most personal health information. That trust extends to how you handle that information digitally. When you take  HIPAA compliance seriously, you are not just avoiding consequences—you are respecting  that trust and supporting the right foundations of healthcare practice.

Start with the basics: secure your website, get the right contracts in place and train your team. Build from there. It gets easier as you go and eventually, thinking about privacy and security becomes second nature.

You have got this. And if you need help, there are lots of resources and professionals who specialize in helping healthcare practices navigate HIPAA compliance. Do not try to figure it all out alone.