What "HIPAA-compliant" actually means for a website (and what it does not)

What "HIPAA-compliant" actually means for a website (and what it does not)

The disclaimer up front

HIPAA compliance depends on technical, administrative, and operational safeguards across the entire organization that handles PHI. A website on its own is never "compliant." But a website can be built so it does not become the weak link.

What a HIPAA-aware site actually does

It encrypts everything in transit. It avoids storing PHI client-side. It processes forms through HIPAA-eligible infrastructure with a signed Business Associate Agreement (BAA). It keeps access logs. It surfaces patient-facing privacy notices clearly. The work is more about discipline than about any single feature.

Common pitfalls

Embedding generic web analytics that exfiltrate PHI in URL parameters. Using a contact form provider with no BAA. Posting screenshots that include real patient identifiers. Treating "our hosting provider says it is HIPAA-compliant" as enough on its own. None of these survive a real audit.

Written by Mustafa Karim, founder and principal consultant at NavoTech Digital Solutions. Have a project or counter-example? Get in touch.