Insights
Building a website that can handle health data
If patients can book, message, or fill out a form on your site, HIPAA is already in the room. Here's what that means in practice, without the legal fog.
When a website becomes a HIPAA problem
The rule of thumb is simple. The moment your site touches protected health information, a name attached to a condition, an appointment request, an intake form, a billing detail, it has to be built and run to HIPAA standards. A brochure site that only lists your hours and location doesn't carry that weight. A patient portal, an online intake form, or a contact form that asks what brings you in absolutely does.
Most violations we see in the wild aren't dramatic hacks. They're ordinary website choices made without noticing PHI was in the frame.
The work that makes a site compliant
Encrypt everything, both directions
Traffic between the patient and the site rides TLS, and stored data is encrypted at rest. If a form submission lands in a plain database or, worse, a plain email inbox, that's a finding waiting for an auditor.
Get a BAA from every vendor that touches data
Hosting, forms, email, scheduling, chat. Each one that can see PHI signs a business associate agreement, and the popular consumer tools mostly won't. That single fact decides more of your architecture than any technical preference.
Control who sees what
Role based access, so the front desk sees schedules and not charts. Multi factor authentication on anything administrative. Shared logins are how small practices fail audits.
Keep audit logs, and keep them a long time
Who logged in, what they viewed, what changed. HIPAA expects logs retained for at least six years, which rules out most casual setups on its own.
Keep marketing tools away from PHI
The quiet one. Analytics scripts, ad pixels, and session recorders on pages where patients enter information can transmit PHI to third parties. Regulators have been explicit about this, and it's the mistake we find most often on otherwise careful sites.
Train the people as carefully as the systems
Everyone who can touch patient data needs to know what counts as PHI and what to do when something looks wrong. The breach report that saves you is the one your own staff files early.
Have the breach plan before the breach
Who gets called, what gets preserved, who notifies whom, on what clock. Writing it during the incident is too late.
What this costs, honestly
Less than people fear and more than a template. Compliance is mostly discipline, the right vendors, the right agreements, the right defaults, applied from the first day of the build. Retrofitting it onto a site that grew up casual is the expensive version.
Fines are tiered per violation and they stack by the year, but the real cost is the trust of the patients whose data leaked. That one doesn't have an appeal process.