How To Make Existing Healthcare Practice Website HIPAA Compliant
Making an existing healthcare website HIPAA compliant requires securing every touchpoint where Protected Health Information (PHI)—including patient names, email addresses, phone numbers, IP addresses paired with health searches, and appointment details—is collected, transmitted, stored, or analyzed. An existing healthcare website usually does not need to be rebuilt from scratch to improve HIPAA compliance. But simply adding SSL, a privacy policy, a cookie banner, or a “HIPAA-compliant form” is not enough.
The practical objective is to identify every place where PHI/ePHI can be created, collected, transmitted, stored, or disclosed, then secure those workflows and ensure the vendors touching that information are contractually and technically appropriate.
As of 2026, HHS states that the current HIPAA Security Rule remains in effect; proposed modifications to strengthen the Security Rule have not replaced the existing rule.
Start With the Website Data Flow
For a medical, dental, healthcare practice, example data flow could like this:
| Website Component | Typical HIPAA Concern | What To Do |
|---|---|---|
| Contact form | Patient may enter symptoms, diagnosis, treatment request | Use secure PHI-capable form/service + appropriate BAA |
| Appointment request | Identity + healthcare request | Treat as potentially PHI + appropriate BAA |
| Patient portal/login | Very high PHI exposure | Isolate and tightly control tracking/scripts + appropriate BAA |
| Live chat/chatbot | Patients disclose health information | HIPAA-compliant vendor + appropriate BAA |
| SMS/texting | Appointment/health information | HIPAA-compliant workflow and vendor + appropriate BAA |
| Email notifications | PHI can be sent into ordinary inboxes | Avoid sending PHI in ordinary notification emails + appropriate BAA |
| Call tracking | Call recordings/numbers may contain PHI | Review vendor and BAA requirements + appropriate BAA |
| Google Analytics | Data may be disclosed externally | Evaluate configuration and what data is transmitted |
| Google Ads tags | Advertising identifiers/tracking | Remove or isolate from PHI-sensitive workflows |
| Meta Pixel | Third-party disclosure risk | Generally keep away from PHI-sensitive pages/workflows |
| Session replay/heatmaps | May capture forms or patient behavior | Disable on sensitive areas unless appropriately controlled |
| Embedded scheduling | Patient/appointment information | Review data flow and vendor relationship |
| CRM | Stores leads that may contain health information | Appropriate safeguards + BAA when BA relationship exists |
| Hosting/CDN | May maintain/transmit website data/logs | Determine whether ePHI reaches provider |
| WordPress plugins | Can send data to external vendors | Inventory and minimize |
| Backups | May contain form/database PHI | Encrypt and access-control |
| Website administrators | Can potentially access PHI | Least privilege, MFA, logging |
| Marketing agency | May access leads, forms or analytics | Determine whether agency is a business associate |
Send Text
How may I help you?