Short answer: For a clinic that HIPAA covers, the forms are only one part of its website that HIPAA reaches. On pages that need a login, like a patient portal, HHS says trackers generally have access to PHI (protected health information). Under HIPAA, a service that creates, receives, maintains or transmits PHI for you is generally a business associate, and you need a BAA (business associate agreement) with it. HHS also says you have to post your notice of privacy practices prominently on any website you keep with information about your customer services or benefits.
Before you read: We based this guide on HHS’s pages about the HIPAA Rules, business associates, cloud services, online tracking and the notice of privacy practices. We read them on November 10, 2026. Whether HIPAA applies, and what your website needs, depends on how your clinic handles health data. It is general information, not legal advice.
What HIPAA protects on a clinic website
HIPAA’s rules apply to covered entities and their business associates. HHS counts doctors and clinics as covered providers only if they transmit any information electronically in connection with a transaction for which HHS has adopted a standard.
An organization that is neither a covered entity nor a business associate doesn’t have to comply with the HIPAA Rules, it adds.
The Privacy Rule protects individually identifiable health information that a covered entity or its business associate holds or transmits, and calls it protected health information. HHS’s Privacy Rule summary describes it as information, demographic data included, about a person’s physical or mental health, the care they receive or payment for that care.
It counts when it identifies the person, or when there is a reasonable basis to believe it can. The summary says it includes many common identifiers, such as name, address and birth date.
On the website itself, HHS’s guidance on online tracking technologies says the HIPAA Rules apply when what trackers collect, or what reaches their vendors, includes PHI.
It adds that identifiable health information a covered clinic collects on its website generally is PHI, even when the person has no existing relationship with the clinic.
Patient portals and their login pages
Pages that require a login, such as a patient portal or a telehealth platform, are user-authenticated pages in HHS’s words. Trackers placed on those pages generally have access to PHI.
The guidance says those trackers may even have access to diagnosis and treatment information, prescriptions or billing details inside the portal.
The portal’s login page and its registration page are generally unauthenticated, the guidance says, because nobody has entered credentials to reach them. It notes that the login page may be the website’s homepage.
But login details typed there, or registration details such as a name and email address, meet the definition of identifiable health information, the guidance says. A tracker that collects them on those pages is disclosing PHI, and the HIPAA Rules apply.
In our view, keep ad and analytics tags off the portal, its login page and its registration page.
Public pages and the court order on part of the guidance
Pages anyone can open without logging in are unauthenticated pages. HHS’s examples are pages with general information such as your location, visiting hours, job openings or policies.
Trackers on many of those pages don’t have access to PHI, the guidance says, and then the HIPAA Rules don’t regulate their use. In some cases they may have access to PHI, and then the Rules apply.
The guidance asks clinics that are considering trackers to look at whether any PHI will reach a tracking vendor.
A note at the top of HHS’s tracking page refers to a court order of June 20, 2024. In it, a federal district court in Texas declared part of the guidance unlawful and vacated it.
The vacated part ties HIPAA obligations to an online technology linking a person’s IP address to their visit on an unauthenticated public page. Per the order, that page addresses specific health conditions or healthcare providers.
HHS says its next steps are under evaluation in light of that order.
The guidance says trackers on a public page where someone books an appointment or uses a symptom checker, without logging in, may have access to PHI in certain circumstances. Our guide to HIPAA compliant forms covers those pages and the tags on them.
Chat, booking and other services on the site
A business associate, HHS says, is generally a person or organization that does certain work for a covered entity involving creating, receiving, maintaining or transmitting PHI. It can also be one that provides certain services to a covered entity involving disclosure of PHI to it.
HHS’s examples include a third-party vendor “super intelligence (SI) chatbot” on a provider’s patient portal. It is on the list when it provides services involving the patient’s PHI, such as symptom assessment, medical reminders and appointment scheduling.
The list names an IT contractor or vendor, such as a managed services provider, whose maintenance or support work requires it to create, receive, maintain or transmit electronic PHI (ePHI).
A business associate needs a BAA with its own subcontractors before it gives them PHI, HHS says, and those subcontractors are business associates too.
No BAA is needed, it adds, with someone whose services don’t involve PHI, such as a janitorial service or an electrician. That holds when any access to PHI would be only incidental and reasonable safeguards are in place.
Our live chat guide covers how to add a chat widget, and our online booking guide covers what to set up on a booking page.
Our guide on patient messages and HIPAA covers email, texts and WhatsApp.
In our view, if the vendor of a chat or booking tool refuses a BAA, keep the tool off pages where patients write about their health.
Hosting that keeps patient data
When a covered clinic uses a cloud service to create, receive, maintain or transmit ePHI for it, such as storing it, that service is a business associate. HHS says so in its guidance on cloud computing.
Asked which cloud providers offer HIPAA-compliant services, HHS’s Office for Civil Rights (OCR) answers that it doesn’t endorse, certify or recommend specific technology or products.
The guidance says a service level agreement (SLA) with the provider is common, and it can cover HIPAA concerns. Its examples are system availability and reliability, backup and data recovery, and how data returns to you when the service ends.
The list also names security responsibility and limits on use, retention and disclosure. The guidance adds that the SLA terms should be consistent with the BAA and the HIPAA Rules.
It also says a BAA has to require the business associate to return or destroy all PHI when the agreement ends, where feasible. Servers outside the United States are allowed with a BAA, with the rest of the HIPAA Rules followed. Still, OCR notes that the risks to ePHI may vary greatly with the location.
A provider that receives and keeps only information de-identified the way the Privacy Rule requires isn’t a business associate, the guidance adds. Our guide to web hosting covers how hosting works and how to choose it.
In our view, buy the hosting in the clinic’s own name, so the agreement and the data stay with the clinic.
What a business associate agreement says
HHS lists what a written contract with a business associate requires. Among other points, it sets the permitted and required uses and disclosures of PHI. The business associate won’t use or further disclose PHI beyond that, except as required by law.
It requires appropriate safeguards, the Security Rule included for ePHI. The business associate reports any use or disclosure the contract doesn’t provide for, breaches of unsecured PHI included.
It also covers patients’ requests for copies, amendments and accountings, and HHS’s access to the business associate’s practices, books and records.
When the contract ends, the business associate returns or destroys the PHI if feasible. Its subcontractors with access to PHI agree to the same restrictions and conditions, and the clinic can end the contract if the business associate violates a material term.
HHS publishes sample business associate agreement provisions and says using them isn’t required for compliance with the HIPAA Rules.
A tracking vendor that meets the business associate definition is one, HHS says, whether or not a BAA is in place.
Signing an agreement with the elements of a BAA doesn’t make a tracking vendor a business associate if it doesn’t meet the definition.
Security on the site, starting with the risk analysis
The Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI’s confidentiality, integrity and availability. HHS says that risk analysis affects every other safeguard, because it shows which measures are reasonable and appropriate.
The Rule’s technical safeguards include access control, audit controls, measures against improper alteration or destruction of ePHI and authentication. Transmission security guards against unauthorized access to ePHI sent over an electronic network.
Some implementation specifications are “addressable”, and HHS says that doesn’t mean optional. Where one isn’t reasonable and appropriate for you, the Rule allows an alternative that achieves the standard’s purpose, if it is reasonable and appropriate, with the reason documented.
For trackers with access to PHI, the tracking guidance says the risk analysis and risk management have to address them. Its examples of safeguards include encrypting ePHI sent to the tracking vendor.
They also include authentication, access, encryption and audit controls on ePHI kept in the vendor’s infrastructure.
OCR says it is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies.
In our view, use HTTPS on every page, not only on the pages with forms.
Your notice of privacy practices on the site
HHS covers the website in its page on the notice of privacy practices. A covered entity has to post the notice prominently, and make it available, on any website it keeps with information about its customer services or benefits.
The notice explains in plain language how the clinic may use and disclose PHI. It also covers the patient’s rights, how to use them and how to complain.
It states the clinic’s legal duties, whom to contact for more information and an effective date.
The page adds a rule for a first service delivered over the internet, by email or otherwise electronically. The provider sends an electronic notice automatically and at once, in response to the patient’s first request for service.
HHS also publishes model notices of privacy practices.
In our view, link the notice from the footer of every page.
Our privacy policy guide covers the website’s privacy policy.
When PHI reaches a tracker without permission
If PHI reaches a tracking vendor with no Privacy Rule requirement or permission and no BAA, HHS says a breach of unsecured PHI is presumed.
The presumption holds unless you can show a low probability that the PHI has been compromised. Notice then goes to the affected patients, the HHS Secretary and, when applicable, the media.
A business associate, in turn, is responsible for notifying the clinic of breaches of unsecured PHI, HHS adds.
Before a clinic website goes live
- You listed every page, tag and outside service on the site, and what each one receives.
- The portal, its login page and its registration page carry no ad or analytics tags.
- Every service that is a business associate of the clinic has signed a BAA.
- Your risk analysis covers the site, its trackers and its vendors.
- Your notice of privacy practices is posted prominently on the site.
- You know what happens if PHI reaches a tracker without a BAA.
RememberPatient data can reach a clinic website through the portal, the trackers and every outside service, not only the forms. Under HIPAA, a service that creates, receives, maintains or transmits PHI for you is generally a business associate and needs a BAA. Your notice of privacy practices goes prominently on the site.
With our web design for cosmetic surgery clinics, we write the site in English and Spanish and build it in WordPress, so your team edits it without code. You buy the hosting and the domain in your own name, and we set them up.
Questions about a HIPAA compliant website
Is there an official HIPAA certification for a website or its hosting?
HHS’s Office for Civil Rights says it doesn’t endorse, certify or recommend specific technology or products. It gives that answer when asked which cloud providers offer HIPAA-compliant services. Instead, HHS describes a BAA with each provider that creates, receives, maintains or transmits PHI for you.
Does a clinic website need a BAA with its hosting company?
It does when the host creates, receives, maintains or transmits ePHI for the clinic, such as storing it. HHS says that host is a business associate, and keeping ePHI with it without a BAA violates the HIPAA Rules. A host that keeps only de-identified information isn’t a business associate.
Do trackers on public clinic pages fall under HIPAA?
HHS says trackers on many public pages, such as those with your location or visiting hours, don’t have access to PHI, so HIPAA doesn’t regulate their use. In some cases they may have access, and then it does. HHS says a court vacated part of this guidance on June 20, 2024, for IP addresses linked to visits to public pages about specific health conditions or providers.
Where does the notice of privacy practices go on a clinic website?
HHS says a covered entity has to post its notice prominently, and make it available, on any website it keeps with information about its customer services or benefits. For a first service delivered online, the provider also sends an electronic notice automatically, in response to the first request for service.
What happens if a tracker sends PHI to a vendor without a BAA?
If there is no Privacy Rule requirement or permission and no BAA, HHS says a breach of unsecured PHI is presumed. That holds unless you can show a low probability that the PHI has been compromised. Notice then goes to the affected patients, the HHS Secretary and, when applicable, the media.
Sources
All read on November 10, 2026 on HHS.gov, the website of the U.S. Department of Health and Human Services. The rules: Summary of the HIPAA Privacy Rule and Summary of the HIPAA Security Rule. Who they cover: Covered Entities and Business Associates. Business associates: Business Associates Frequently Asked Questions (FAQs) and Business Associate Contracts. Guidance: Guidance on HIPAA & Cloud Computing and Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. The notice: Notice of Privacy Practices for Protected Health Information.