HIPAA and your practice website

This page is general information, not legal advice. For decisions about your own practice, talk to your compliance officer or a healthcare attorney.

Does HIPAA apply to you?

HIPAA applies to "covered entities" and their "business associates". A healthcare provider is a covered entity if it sends health information electronically for standard transactions, such as insurance claims or eligibility checks. Most medical and dental practices that bill insurance are covered. A cash-only therapist who never bills insurance electronically may not be, but state privacy laws and the FTC Act can still apply.

If you're covered, your website is part of it. Information a patient types or selects on your site, together with something that identifies them, is generally protected health information (PHI), even if they aren't a patient yet.

Which pages matter

The HHS Office for Civil Rights explains how this works in its bulletin on online tracking technologies. In short:

• Inside a patient portal (pages behind a login), trackers generally have access to PHI.
• Appointment request and symptom-checker pages can expose PHI even without a login. HHS's example is a tracker collecting someone's email address or the reason they're seeking care when they book.
• Portal login and registration pages are public, but what people type into them counts as identifiable health information.
• General pages like hours, directions and job listings usually don't involve PHI, so tracking there generally isn't regulated by HIPAA.

The bulletin also says that a cookie banner is not a valid HIPAA authorization, that mentioning trackers in your privacy policy doesn't by itself permit a disclosure, and that a vendor promising to strip or de-identify PHI after receiving it isn't enough without a BAA. Our page-by-page guide lets you pick a page type and a tracker and see what applies.

The 2024 court ruling

On June 20, 2024, the federal district court for the Northern District of Texas (American Hospital Association v. Becerra) vacated one part of the bulletin: the part saying HIPAA is triggered when a tracker connects a visitor's IP address with a visit to a public page about specific health conditions or providers.

The rest of the bulletin stands, including portals, scheduling pages, symptom checkers and login pages. As of 30 October 2026, the HHS page still carries the court's note and says HHS "is evaluating its next steps". Pages about conditions and treatments are the unsettled middle; ask counsel before relying on either reading, and remember state privacy laws and reputation still apply there.

Business associate agreements

A business associate is a company that creates, receives, maintains or transmits PHI on your behalf. Before it handles PHI, you need a business associate agreement (BAA) with it: a contract that says what it may do with the information, how it protects it, and that it will report breaches to you.

Two points practices often miss:

• A vendor is a business associate because of what it does, whether or not a BAA has been signed. A tracking vendor that receives PHI from your booking page is one, even if nobody meant it to be.
• Cloud services that store PHI are business associates even if the data is encrypted and they don't hold the key. HHS's cloud guidance says this directly.

Does your web designer need a BAA? Only if they handle PHI: hosting a form that collects it, reading submissions, or having access to an inbox where submissions arrive. If forms post straight to your scheduler or a BAA-covered form service and the designer never sees submissions, a BAA usually isn't needed. When our work does involve PHI, we sign a BAA first.

Common vendors, checked 30 October 2026

Vendor terms change. Read the current terms, or ask the vendor in writing, before relying on this table.

What a contact or booking form must not do

• Load third-party trackers on the form page or its thank-you page.
• Send submissions to a service, inbox or server that hasn't signed a BAA with you.
• Put names, reasons for visit or other details into the page address (a "GET" form or a query string), where analytics tools and server logs pick them up.
• Ask for more than you need. If you can ask about symptoms on the phone, leave them off the form.
• Send an automatic reply that repeats the patient's details back by ordinary email.
• Run over plain HTTP. Every page should be HTTPS.

A contact form on a page about your practice raises the same questions as a booking form. If a patient can type "I need a root canal" into it, treat it as a patient page.

Hosting on Cloudflare

We host practice sites on Cloudflare as static pages. Because Cloudflare signs BAAs only with enterprise customers, we design sites so PHI never passes through it: public pages carry no patient information, and forms post directly to the practice's scheduler or a form service that has signed a BAA with the practice. If your practice needs PHI to flow through the web host itself, the host must sign a BAA, and we'll choose one that does.

Health apps outside HIPAA

If you offer a health app or tool that isn't covered by HIPAA, the FTC's Health Breach Notification Rule may apply instead. Since amendments that took effect in July 2024, it explicitly covers health apps and connected devices, and a "breach" includes sharing health data without the user's permission, not only hacking. Notices go to affected people within 60 days, and to the FTC when 500 or more are affected. Penalties run up to $53,088 per violation (the 2025 inflation-adjusted figure).

Sources

• HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, read 30 October 2026, with the court's June 20, 2024 note at the top.
• HHS OCR, Guidance on HIPAA and Cloud Computing.
• Cloudflare, HIPAA: BAAs only with enterprise customers.
• Google, HIPAA and Google Analytics, and HIPAA compliance with Google Workspace.
• FTC, Complying with FTC's Health Breach Notification Rule.

Scan your siteBook a tracker audit