HIPAA for Websites & Apps
HIPAA compliant websites and web apps
What HIPAA asks of a website or web app that handles patient information, explained in plain words, and how we build and look after them.
The Short Version
Where patient data goes, the rules follow
HIPAA applies the moment your website or app collects, stores or sends protected health information: anything that links a person to their health, their care or payment for it. A symptom typed into a contact form counts.
Every system that touches it
The form, the server it's stored on and the email it's forwarded to all handle that data.
Every vendor signs a BAA
Each company that handles the data must sign a Business Associate Agreement with you.
Safeguards, not just paperwork
Encryption, access control and logging have to be set up and kept running.
No certificate to buy
There is no official HIPAA certification. Compliance is how a system is set up and run, every day.
Technical Safeguards
What HIPAA expects from the system itself
The HIPAA Security Rule lists technical safeguards for any system holding electronic patient information. In plain words, they come down to six things.
Encryption
Patient data encrypted as it travels and where it's stored, including backups.
Access control
Every person gets their own login, with access limited to what their role needs.
Audit logs
A record of who viewed or changed patient information, and when.
Strong sign-in
Two-factor login and automatic sign-out after inactivity, so an open screen doesn't stay open.
Integrity checks
Monitoring that shows whether data or files were changed without permission.
Backups and recovery
Encrypted backups and a tested way to restore them when something goes wrong.
BAAs and Hosting
What BAA-covered hosting does and doesn't cover
What a BAA is
A Business Associate Agreement is a contract where a vendor promises to protect patient data, use it only for the job and report any breach. HIPAA requires one before a vendor can handle that data.
What the host covers
Hosting providers that sign a BAA, such as AWS, Google Cloud and Microsoft Azure, secure their data centers and the services they run. Most budget hosts don't sign one.
What it doesn't cover
The setup on top is still yours: encryption settings, who has access and what gets logged. That part is the work we do.
HIPAA Compliant Web Forms
Why a standard contact form isn't enough
A standard contact form usually emails whatever the patient typed to a regular inbox. If that message includes health information, the form tool, the server and the email provider each need a BAA, and most don't have one. A compliant form works differently.
-
Encrypted from the browser
The submission is encrypted from the moment the patient presses send.
-
Stored, not emailed
Submissions land in a BAA-covered system. Staff get a notification without the patient's details in it.
-
Access logged
Only authorized staff can open a submission, and every view is recorded.
Working With Us
HIPAA compliant software development and care
Your site or app, set up right
For practices and health products that handle patient data
- We sign a Business Associate Agreement before accessing patient data
- A map of where patient data enters, is stored and leaves
- Safeguards set up and kept running
- Ongoing care on hosting that signs a BAA
Our reviews are professional assessments, not a certification or a guarantee.
Where to start
Pick the service that matches what you run.
- Website Security & Care for a practice website
- Fix & Improve for a specific problem, at a fixed price
- Fractional CTO for a health product that keeps growing
FAQ
HIPAA website questions
No. There is no official HIPAA certification from the government. Compliance depends on how a system is set up and run, and on having a Business Associate Agreement with every vendor that handles patient data.
Yes. We sign a Business Associate Agreement before accessing any system that holds patient data.
If it collects, stores or sends health information about patients, yes. A site that only lists services and contact details usually doesn't handle protected health information.
Not on its own. The BAA covers the host's side. Encryption, access and logging on your site or app still have to be set up correctly.
Yes. Most of our work is on systems someone else built. We start by mapping where patient data enters, where it's stored and where it goes.
Have a question about your setup? Book a free 30-minute call (opens in a new tab) and we'll look at it together.