A dental website does not need to be HIPAA compliant from top to bottom. The pages that only describe your practice, your services and your prices hold no patient information. The parts that collect, store or send patient health information do: forms where patients describe symptoms or insurance, the emails those forms send, online booking that asks why someone is coming in, patient portals, live chat, and any tracking tool that can see those pages. Every vendor that handles that information needs to sign a business associate agreement with the practice.
I build websites for dental practices, and HIPAA is the subject where I see the most confident advice that is wrong in both directions. Some practices are sold “HIPAA compliant hosting” for a brochure site that never stores a patient’s name. Others run a contact form that asks about symptoms and emails the answers to a free Gmail account. This guide goes through a practice website piece by piece: where health information comes in, what each tool needs, what changed with analytics in 2024, and a checklist you can use on your own site.
One note before we start: I am a web developer, not a lawyer or a compliance officer. This is how I set up practice websites, with the official sources I rely on. If your practice has a compliance consultant, run your decisions past them.
Does a Dental Website Need to Be HIPAA Compliant?
The HIPAA rules apply to protected health information (PHI): health information that can be tied to a person, handled by a covered entity such as a dental practice or by a vendor working for it. A website is not “compliant” or “non-compliant” as a whole. What matters is whether a given page or tool touches PHI.
- A page about dental implants, your team or your opening hours contains no PHI. It needs normal website security, nothing HIPAA-specific.
- A form where someone types their name and “my tooth has been hurting for a week” collects PHI. Everything that handles that submission is now in scope.
- A patient portal or logged-in area is in scope by definition.
So the useful question is not “is my website HIPAA compliant?” but “where does patient information enter my website, and where does it go next?”
Where Health Information Enters a Dental Website
| Part of the site | Does it handle PHI? | What it needs |
|---|---|---|
| Service, team, location and cost pages | No | Normal security (HTTPS, updates) |
| Simple contact form (name, phone, email, preferred time) | Usually treat as yes once the patient adds a reason for visiting | Keep it minimal; send to a tool or inbox covered by a business associate agreement |
| New-patient intake, medical history, insurance forms | Yes | A HIPAA forms tool with a signed agreement |
| Online booking | Yes if it asks the reason for the visit or symptoms | Booking through your practice software, or a booking tool that signs an agreement |
| Email notifications from forms | Yes if the form content is in the email | An email service with a signed agreement, or send only a “new submission” alert |
| Live chat, chatbots, AI assistants | Yes, patients type symptoms into them | A vendor that signs an agreement, or no chat |
| Patient portal, logged-in pages | Yes | Practice software built for it; no third-party tracking |
| Analytics, ad pixels, call tracking | Depends on the page and what they record | See the analytics section below |
| Reviews and testimonials | Yes if a reply or post reveals someone is a patient | Written permission; replies that confirm nothing |
Business Associate Agreements: Who Needs One
A business associate agreement (BAA) is a contract in which a vendor that handles PHI for the practice agrees to protect it under HIPAA’s rules. If a vendor will not sign one, PHI should not go into that vendor’s product.
On a typical practice website, these are the vendors to check:
- The forms tool that receives intake or symptom forms.
- The email service that receives form notifications or patient emails.
- The online booking tool, if it collects the reason for the visit.
- Live chat or chatbot providers.
- Call tracking, if it records calls or transcribes them.
- The web host, only if PHI is actually stored on the website’s server (for example, form entries saved in the WordPress database).
Ask each vendor directly: “Will you sign a BAA, and which plan includes it?” Many tools offer one only on higher plans, and some say plainly in their terms that their product must not be used for health information.
Forms: The Most Common Problem
Forms are where most practice websites go wrong, because the default setup of a typical website form is not built for health information. A standard WordPress form plugin saves entries in the website’s database and sends the full submission by email; neither is covered by an agreement.
The setup I use:
- Keep the public contact form minimal: name, phone, email, preferred days, and a reason chosen from a short list (“cleaning”, “new patient”, “emergency”) rather than a free-text box describing symptoms.
- Do not store entries in the website database, or delete them automatically once they have been delivered, unless the host has signed a BAA.
- Send the full details only to a covered destination, such as a HIPAA forms tool or an email account covered by a BAA.
- Move anything detailed (medical history, insurance details, date of birth, medications) to a HIPAA forms tool or the intake module of your practice management software. Those tools typically cost $50 to $150 a month, and handling this one job properly is worth it on its own.
Every form must load and submit over HTTPS, which should be true of every page of any website today.
Email: Where Form Submissions End Up
A form can be perfectly secure on the website and still send a patient’s details in plain text to an inbox with no agreement behind it. Two fixes, either of which works:
- Use an email service that signs a BAA. Google Workspace signs a BAA on eligible editions, covering Gmail, Drive and Calendar once the agreement is accepted and the account is configured; Microsoft 365 also offers one. A free personal Gmail account is not covered.
- Send only an alert. The notification email says “New appointment request, log in to view” and the details stay inside the HIPAA tool.
The same applies to patients emailing you directly from the website. If your contact page invites patients to email, make sure that inbox is covered.
Online Booking
Online booking is one of the most useful features on a practice website, and one of the easiest to set up badly.
- The best option is the booking feature of your practice management software, because the appointment, the patient record and the agreement are already in one place.
- General booking tools need checking. Calendly, for example, does not sign BAAs, and its terms say the data you put into it must not contain protected health information, according to several HIPAA compliance publications that reviewed it. A general tool can still be used for “pick a time” with name and phone only, as long as it never asks for the reason for the visit, symptoms or insurance.
- If you need to ask why someone is booking, use a tool that signs a BAA.
Analytics, Ad Pixels and Call Tracking
This area changed in 2024, and much of the advice online is out of date.
In December 2022, the federal Department of Health and Human Services (HHS) published guidance saying tracking tools on health websites can disclose protected information. On 20 June 2024, a federal court in Texas, in American Hospital Association v. Becerra, struck down the part of that guidance that treated tracking a visit to a public page about a health condition or a provider as protected information. HHS dropped its appeal in August 2024. The rest of the guidance still stands, which means:
- Public pages (your procedure pages, cost page, blog) can generally use analytics, with the usual care.
- Logged-in pages, patient portals, and pages where patients submit health information must not send data to a tracking vendor unless that vendor has signed a BAA.
Google’s own position on Google Analytics is clear. Google says it does not offer business associate agreements for Analytics, makes no claim that Analytics meets HIPAA requirements, and tells customers subject to HIPAA to use it only on pages that are not HIPAA-covered and to keep its tags off logged-in pages.
What I do on practice sites: analytics and ad pixels on the public pages only; nothing on the intake forms, booking confirmation pages or portal; form fields never passed to analytics; and the decision written down in a short document the practice keeps. Call tracking that records or transcribes calls needs a vendor that signs a BAA, because patients describe their problems on the phone.
Chat Widgets and AI Chatbots
Patients type symptoms into chat boxes, whether you ask them to or not. A chat widget or AI assistant on a dental website is therefore collecting PHI, and the vendor needs to sign a BAA. If it will not, the safest choices are a chat that only books a callback (name and phone) or no chat at all. A clear phone number and a working booking button usually do more for a practice than a chat bubble.
Hosting and WordPress
Is WordPress HIPAA compliant? WordPress is software, so it is neither compliant nor non-compliant on its own; it depends on what you store in it. A WordPress site that only publishes information about the practice, with forms that send patient details straight to a HIPAA forms tool, does not hold PHI and can run on ordinary good hosting. A WordPress site that stores form entries, patient files or portal data in its own database does hold PHI, and then the host must sign a BAA and the site needs the same care as any system holding patient records.
That is why I recommend keeping PHI out of the marketing website entirely: the website stays fast and affordable to host, and the patient data lives in software built for it.
Website builders follow the same logic. Most general website builders do not sign BAAs, so they are fine for the informational part of a practice site and unsuitable for collecting health information. Link out to a HIPAA forms or booking tool for those parts.
Reviews, Testimonials and Photos
Marketing can create HIPAA problems too.
- Review replies must not confirm that the reviewer is a patient or mention anything about their care. In 2019, a Dallas dental practice paid $10,000 to the HHS Office for Civil Rights after its replies to Yelp reviews disclosed patients’ names, treatment plans, insurance and costs.
- Testimonials, before-and-after photos and patient stories on the website need the patient’s written authorization.
- Photos of your office should not show patient charts, screens or patients in the background.
My guide to local SEO for dentists includes review-reply wording that confirms nothing, and my article on dental marketing strategies covers the marketing side of these rules.
The Security Basics
HIPAA’s Security Rule is mostly about the systems that hold PHI, but the website is the front door to the practice and deserves basic care:
- HTTPS on every page.
- WordPress, the theme and plugins kept up to date.
- Two-factor authentication on the website login, the hosting account and every tool that holds PHI.
- Separate logins for each staff member and contractor, removed when they leave.
- Regular backups that do not contain PHI, or that are themselves covered if they do.
A HIPAA Check for Your Dental Website
Work through this list on your own site, or with your developer.
Forms and booking
- List every form on the site and what it asks.
- Remove free-text symptom boxes from public contact forms.
- Move intake, medical history and insurance forms to a tool that signs a BAA.
- Check online booking does not collect the reason for the visit without a BAA.
- Turn off saving form entries in the website database, or confirm the host signs a BAA.
Email and chat
- Confirm the inbox that receives form notifications is covered by a BAA, or change notifications to alerts only.
- Remove or replace any chat widget whose vendor will not sign a BAA.
Tracking
- Remove analytics, ad pixels and session recording from intake, booking and portal pages.
- Check no form field values are sent to analytics or ad platforms.
- Confirm call tracking either does not record calls or has a BAA.
Marketing
- Check review replies confirm nothing about the reviewer’s care.
- Keep written authorization on file for every testimonial and before-and-after photo.
Paperwork
- Keep a list of every vendor that touches PHI, with the date each signed its BAA.
- Write down which pages carry tracking and why.
If you are planning a new site or a redesign, these decisions are cheapest to get right at build time. My guide to dental website design covers the rest of what a practice site needs, and my page on websites for dental practices shows how I build them. For the bigger picture of how practices get found, see my dental SEO guide and the local SEO guide for small businesses.
Frequently Asked Questions
How Do You Make a Website HIPAA Compliant?
Find every place the website collects, stores or sends patient health information: forms, email notifications, booking, chat, portals and tracking on those pages. Then make sure each of those uses a vendor that has signed a business associate agreement, keep patient data out of tools that will not sign one, keep tracking off pages where patients submit health details, and secure the site with HTTPS, updates and two-factor logins. Pages that only describe the practice need no special treatment.
How to Know If a Website Is HIPAA Compliant?
There is no official certification or badge for a website. Check what the site collects and where it goes: whether forms ask for health details, where submissions are stored and emailed, whether booking and chat vendors have signed business associate agreements, and whether analytics or ad pixels run on intake or portal pages. If all of those are covered, the website is handling patient information the way HIPAA expects.
Does a Website Need to Be HIPAA Compliant?
Only the parts that handle protected health information. A dental practice’s pages about services, team and prices hold no patient information and need ordinary security. Forms, booking, chat, email and portals that collect patient health details must be handled under HIPAA, which in practice means using vendors that sign business associate agreements.
Can Google Be HIPAA Compliant?
Some Google services can. Google Workspace signs a business associate agreement on eligible editions, covering services such as Gmail, Drive and Calendar once the agreement is accepted and the account is configured. Google Analytics is different: Google says it does not offer business associate agreements for Analytics and that it should only be used on pages that are not HIPAA-covered. A free personal Gmail account is not covered.
Is Google Analytics HIPAA Compliant?
No. Google states that it does not offer business associate agreements for Google Analytics and makes no claim that it meets HIPAA requirements. Practices can still use it on public pages such as service and cost pages, but should keep it off patient portals, logged-in areas and pages where patients submit health information, and never send form contents to it.
Is WordPress HIPAA Compliant?
WordPress itself is neither compliant nor non-compliant; it depends on what the site stores. A WordPress site that only publishes practice information and sends patient details straight to a HIPAA forms or booking tool holds no protected health information. If the site stores form entries or patient data in its own database, the host must sign a business associate agreement and the site must be secured like any system that holds patient records.
Is Calendly HIPAA Compliant?
Not for collecting health information. Calendly does not sign business associate agreements, and its terms say the data you put into it must not contain protected health information, according to several HIPAA compliance publications. A practice can still let patients pick a time with only their name and phone number, but should not ask for the reason for the visit, symptoms or insurance through it.
If you want your practice website checked for these issues, book a free 30-minute call and I will go through your forms, booking and tracking with you, whether or not we work together.
