You've probably seen the phrase "HIPAA-compliant website" in a proposal somewhere. It's a good sales line. It's also, in most of the ways it gets used, not quite true — and you're the one who deserves the honest version, since you're the one whose license is on the line if something goes wrong.
The Boundary Nobody States Plainly
HIPAA compliance isn't a feature you install. It's a set of administrative, physical, and technical safeguards around how protected health information is created, stored, and transmitted — and a public marketing website, built and used correctly, generally shouldn't be touching protected health information at all.
That's the actual answer, and it's better news than it sounds like. A website that never collects, stores, or transmits PHI has a much smaller compliance surface to worry about, because the risk it needs to manage is narrower.
So when someone sells you a "HIPAA-compliant website," what they usually mean — and what they should say plainly — is a website built with HIPAA in mind: structured to keep patient information off the public-facing site entirely, so the compliance burden sits where it belongs, in your practice management and EHR systems, not scattered into a contact form nobody thought carefully about.
What a Website Can Actually Guarantee
A contact form with no clinical fields. Name, email, phone, a general message box. Nothing asking about symptoms, diagnoses, or treatment history. If a form on your site is asking "what brings you to therapy" with an open text field, that's PHI being collected and stored somewhere, and that's the actual risk — not the hosting provider, not the SSL certificate.
A booking flow that routes to your EHR, not a generic calendar tool. The scheduling itself should hand off to the system actually built to handle clinical scheduling securely, not live inside a marketing site's plugin.
No third-party scripts logging more than they should. Analytics tools, chat widgets, and marketing pixels can inadvertently capture form data. A site built carefully audits what's actually running and why.
Encrypted transmission (SSL) as a baseline, not a selling point. This is table stakes in 2026 — every legitimate site has it. If it's being sold to you as a premium compliance feature, that's a sign the rest of the pitch may be inflated too.
How easy it is to actually hold this boundary depends a lot on what you're building on. (We compared WordPress, Squarespace, Wix, and Astro on exactly this.)
What No Website Can Guarantee
No web designer, however good, can make categorical claims about your organization's HIPAA compliance as a whole. That determination involves your policies, your staff training, your business associate agreements, your practice management system — most of which has nothing to do with the public website at all.
Be cautious of anyone who states otherwise in writing. It's not just imprecise, it's a liability for both of you if it's ever tested.
The Question Worth Asking Instead
Not "is this HIPAA compliant" — ask "does this site avoid collecting anything it shouldn't, and does it route everything sensitive to the systems actually built to handle it." That's a question with a real, verifiable answer, and it's the one that actually protects you.