On this page
A HIPAA compliant website is one where every vendor that receives patient information through the site, from the host and form tool to chat, scheduling and tracking, has signed a business associate agreement (BAA) and has a permitted reason to receive it, every other vendor receives no protected health information (PHI), and data is protected in transit. Tracking needs the closest look, because ad pixels and session replay scripts send what visitors view and type to the companies that run them, and Meta, Google Ads and TikTok do not sign a BAA. Curve Compliance, which signs a BAA on every plan, offers a free scan that lists those scripts on any public page.
Book a call. Not sure what your site sends today? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What makes a website HIPAA compliant
HIPAA applies to covered entities and their business associates (see what HIPAA compliance means). For them, a website is one more place where PHI is collected and shared. Each tool that touches patient information has to be accounted for.
HHS's guidance on tracking technologies shows where that happens. It says “Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI.” It also gives a public-page example: tracking tools “might collect an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider,” and in that case “the regulated entity is disclosing PHI to the tracking technology vendor” (HHS). The same page notes that on June 20, 2024 a federal court vacated one part of the guidance: the part saying HIPAA applies when a tool connects a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers.
Hosting and transmission security
The Security Rule's transmission standard reads: “Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.” Encryption is listed as an addressable specification under it (45 CFR 164.312(e)). For a website, HTTPS on every page is the usual starting point.
If form submissions or other PHI are stored on or pass through your host, the host needs a BAA. HHS says that if a covered entity or business associate “uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules.” That holds “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data” (HHS). See which website hosts sign a BAA.
Forms and intake
For a covered entity, a contact, booking or intake form that asks for a reason for the visit, symptoms or insurance collects PHI. The form tool needs a BAA, and the answers must not ride along to ad platforms in URLs, event names or page titles. See form builders that sign a BAA, what to collect in a patient intake form, and the safe path from website forms to ad platforms.
Curve Forms are hosted by Curve under the BAA Curve signs on every plan. Form events reach Meta, Google Ads and your other destinations server-side, and form answers, page titles and free text are never sent.
Chat, scheduling and call tracking
Each of these tools receives what a patient types or says, so each needs a BAA on the plan you actually use. The BAA Directory groups the common tools by category: scheduling, chat and support and calls. For the detail, see chat tools that sign a BAA, HIPAA compliant scheduling software and HIPAA compliant call tracking. An embedded booking widget can load trackers of its own, so check what your pages load, widget included.
Tracking pixels and analytics
HHS says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS). The big ad and analytics platforms do not sign one: see the Directory entries for Meta, Google Ads, Google Analytics 4 and TikTok. Their pixels should not run on pages where PHI is involved, such as logged-in pages, booking flows and forms.
Curve's scanner page notes that “The Meta Pixel, the Google Ads tag and the TikTok Pixel are the scripts healthcare sites most often carry” (Curve Compliance). Session replay deserves the same check, because HHS notes such scripts “record a user's activities (e.g., mouse movements, clicks, and typing)” (HHS); see session replay tools that sign a BAA. For one pixel in detail, read what the TikTok Pixel sends from a health site, and for the cookie side, third-party cookies on health websites.
Consent banners are not HIPAA authorization
HHS is direct: “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.” A privacy policy does not fill the gap either. HHS says “the Privacy Rule does not permit disclosures of PHI to a tracking technology vendor based solely on a regulated entity informing individuals in its privacy policy, notice, or terms and conditions of use that it plans to make such disclosures” (HHS). See whether a cookie banner is enough for HIPAA.
Post your notice of privacy practices
The Privacy Rule has a website line of its own: “A covered entity that maintains a web site that provides information about the covered entity's customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the web site” (45 CFR 164.520(c)(3)(i)). See the notice of privacy practices and your website.
Choosing a web designer or site builder
Site builders take different positions. Here is what each says on its own pages, checked November 2, 2026:
| Site builder | Signs a BAA? | What it says | Source |
|---|---|---|---|
| Wix | Specific plans | “HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans.” “Once you’ve activated PHI protection, you can sign the BAA.” | Wix Help Center |
| Squarespace | Not for websites | “Your Business Associate Addendum (BAA) doesn't cover other Squarespace features.” Acuity Scheduling is the covered feature. | Squarespace Help Center |
| Webflow | No | “Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time.” | Webflow Terms |
| WordPress.com | No public statement | The BAA Directory found no HIPAA or BAA statement on WordPress.com's support site or terms. | BAA Directory |
More are listed under site builders in the BAA Directory. When you hire a medical web design company, ask:
- Will you sign a BAA? If the agency or its tools can see form submissions or patient messages, it needs one.
- Where do form submissions go? Name the form tool, where answers are stored and who can read them.
- Which scripts will you install, and on which pages? Get the full list of pixels, analytics, chat and replay tools before launch.
- Who can add tags after launch? Anyone with tag manager access can add a pixel later.
The checklist
| Check | What good looks like | Source |
|---|---|---|
| Transmission security | Every page that collects information uses HTTPS | 45 CFR 164.312(e) |
| Hosting | The host signs a BAA if PHI is stored on or passes through it | HHS cloud guidance |
| Forms | The form tool signs a BAA, and answers stay out of URLs and ad events | HHS tracking guidance |
| Chat, scheduling, calls | Each vendor signs a BAA on the plan you use | HHS tracking guidance |
| Ad pixels | No Meta, Google Ads or TikTok pixel on pages where PHI is involved | BAA Directory |
| Session replay | Used only under a BAA, or not at all | HHS tracking guidance |
| Cookie banner | Treated as cookie consent, never as HIPAA authorization | HHS tracking guidance |
| Privacy notice | Posted prominently and available on the site | 45 CFR 164.520(c)(3)(i) |
| Risk analysis | The website and its vendors are part of it | 45 CFR 164.308(a)(1)(ii)(A) |
| Scan | Re-run after every site change, redesign or new tag | Curve scanner |
The risk analysis line comes from the Security Rule, which requires an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information” (45 CFR 164.308). See how to include marketing tools in a HIPAA risk assessment and, for vendors, ads and audiences beyond the website, the HIPAA compliance checklist for marketing teams. Which rules apply to your site depends on your setup, so talk to your counsel.
Scan your site
Curve's free website scan is a quick way to start the tracking line of the checklist. In Curve's words: “Enter a public URL and it loads the page, matches its HTML against 75 known tracking scripts in 11 categories, and lists each one it finds with a risk level.” For logged-in pages and booking flows, or a second pair of eyes on the result, book a call and Curve's team will review what your website sends to Meta, Google and TikTok with you.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
The same BAA covers Curve Forms, consent management, and session replay and heatmaps, so more of the website checklist sits with one vendor. Curve keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: HHS, Use of Online Tracking Technologies; HHS, Guidance on HIPAA and Cloud Computing; 45 CFR 164.312; 45 CFR 164.308; 45 CFR 164.520; Wix, Enabling HIPAA Compliance for Your Wix Site; Squarespace, Acuity Scheduling and HIPAA; Webflow Terms of Service; Curve Compliance, free website scan.
Frequently Asked Questions
What is a HIPAA compliant website?
It is a site where every vendor that receives patient information through it, including the host, forms, chat, scheduling and tracking tools, has signed a BAA and has a permitted reason to receive it, and every other vendor receives no PHI. Data in transit must also be protected under the Security Rule.
Does a medical website need to be HIPAA compliant?
If your organization is a covered entity or business associate, HIPAA applies to the PHI your website collects or shares. HHS says tracking technologies on logged-in pages “generally have access to PHI,” and booking and symptom forms can involve PHI on public pages too (HHS).
Which website builders sign a BAA?
Wix says it offers a BAA on its Business, Plus, Elite, Business Elite and Enterprise plans once PHI protection is on (Wix). Squarespace's BAA covers Acuity Scheduling only (Squarespace), Webflow's terms say it does not offer HIPAA compliant services (Webflow), and the BAA Directory lists more.
Does a healthcare website need HTTPS?
HIPAA requires technical measures to guard ePHI in transit and lists encryption as an addressable specification (45 CFR 164.312(e)). HTTPS encrypts traffic between the browser and the server, so use it on any page that collects patient information.
Is a cookie banner enough for HIPAA?
No. HHS says banners that ask users to accept or reject tracking technologies “do not constitute a valid HIPAA authorization” (HHS).
What should I ask a medical web design company?
Ask whether it will sign a BAA, where form submissions go, which scripts it will install on which pages, and who can add tags after launch. Ask for the full script list before the site goes live.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week (Directory entry).
Talk to Curve Compliance
Book a call. Want the tracking line of your checklist handled? Curve Compliance sends conversions to your ad platforms from its own servers, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.