Does my dental website need
to be HIPAA compliant?
A form by form data map and a decision tree for practice owners. General information, not legal advice, so take the questions to your healthcare counsel.
The short answer
HIPAA covers your practice, not your pages
A web page does not need to be HIPAA compliant on its own, because HIPAA applies to your dental practice as a covered entity, not to the site. What needs review is any form or tool that collects patient health details and sends them to an outside company.
A page with your hours and a map collects nothing about anyone. An intake form that asks about medications, a chat box where someone describes a cracked molar, or a booking tool that stores visit details is what to take to healthcare counsel or your privacy officer. This is general information, not legal advice.
WTM Studio is a website studio, not a compliance provider, and we never call a site HIPAA compliant. We build custom dental websites, and the data map below is what we would want your counsel to see before any build, ours or anyone else's.
What HIPAA applies to, in HHS's words
HHS says the HIPAA Rules apply to covered entities and to their business associates. Covered entities are health plans, health care clearinghouses and health care providers. Dentists are named in that provider list, next to doctors, clinics and chiropractors.
There is a condition. A provider is a covered entity only if it transmits health information electronically in connection with a transaction HHS has adopted a standard for. Your counsel can confirm which side of that line your practice sits on.
Web pages are not on the list. Your review starts with what the site collects and which companies receive it.
Source: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
Follow the data, one form at a time
Open your site on a phone. List every box a visitor can type into, every number they can tap to call, and every tracking tool your marketing company added. Then fill in a table like this one, asking your front desk and each vendor for the "Where it ends up" column.
| Form or tool | What it might collect | Where it ends up | Question for counsel or the vendor |
|---|---|---|---|
| Contact form | Name, email, phone and a free text message that may mention a tooth, a symptom or a treatment | An email inbox, the form service's servers, or both | If a patient types health details here, who stores that message? |
| Appointment request | Name, phone, preferred time, office, sometimes a reason for the visit | A front desk inbox or a request queue | Should the reason for the visit be a free text box at all? |
| Patient intake form | Medical history, medications, allergies, insurance details | A forms vendor, then your practice management system | Do we have a signed business associate agreement with the forms vendor? |
| Chat widget | Whatever the visitor types, plus saved transcripts | The chat vendor's servers, and sometimes staff phones | Does this vendor receive or keep patient information for us? |
| Online booking tool | Name, contact details, visit type, time and office | The booking vendor, often synced to your schedule | Will the vendor sign a BAA, and what does it keep after the sync? |
| Newsletter signup | Email address, sometimes a name | An email marketing service | If the list is built from patients or sorted by treatment, is it PHI? |
| Call tracking | Caller number and call time, and recordings in some setups | The call tracking vendor's dashboard | Are calls recorded or transcribed, and could a recording hold patient details? |
Any cell you cannot fill in is your first question for counsel.
A hypothetical example. A two office practice has a chat widget its marketing company added last year. At 9 p.m. a patient types: "My crown came off and I take blood thinners, can I come in tomorrow?" That message now sits on the chat vendor's servers, and a transcript is emailed to the office manager's phone. Nobody chose to collect a medication list, yet the site did. In the table, that chat row has two blank cells: how long the vendor keeps transcripts, and whether a BAA is on file.
Is a vendor handling patient information for you?
Run each row of your table through these steps, in order.
- Does the form or tool collect anything about a patient's health, care or payment? If you are not sure, treat it as a yes until counsel says otherwise.
- Does an outside company store it, receive it or pass it along? HHS lists cloud service providers handling ePHI, IT vendors with access to ePHI and third party AI chatbots on a patient portal handling PHI as examples of business associates.
- Then ask that company for a written business associate agreement. HHS says a covered entity generally needs a written BAA with a business associate that creates, receives, maintains or transmits PHI on its behalf. A vendor that will not discuss one has given you an answer.
- Is their access only incidental? HHS says a BAA is not required for someone whose services do not involve PHI beyond incidental access. Where your web designer or host falls depends on the work, so ask counsel.
Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
What a website designer can and cannot tell you
A designer can tell you:
- Every form on the site and every field it asks for.
- Where each form submits: an inbox, a vendor or your system.
- Which third party tools load on each page.
- Where a free text box could become a short list of choices, so patients type less about their health.
A designer cannot tell you:
- If your practice is a covered entity.
- If a vendor's agreement is adequate.
- If your site meets HIPAA. A web company that sells "HIPAA compliant" as a feature is answering a legal question. Ask who reviewed it, and get that in writing.
Six questions to bring to your counsel
- Is our practice a covered entity, based on how we bill and send health information?
- Which forms and tools on our website collect PHI, in your reading?
- Which of our website vendors are business associates, and do we have a signed BAA with each one?
- Should our contact and appointment forms drop free text fields where patients might describe symptoms?
- Do our chat, call tracking and analytics tools need a review, and who should do it?
- Who on our team owns this list, and how often should we recheck it as tools change?
Bring the filled table, so counsel can answer about your own forms and vendors.
Planning a rebuild? Map the data before the design
A redesign is a good time to delete form fields you never needed. If booking is in your plan, read how online booking should work first. Groups can start with DSO website design, and other specialties can use this map too; see healthcare websites.
WTM Studio builds custom websites for dental practices and groups nationwide from Miramar, Florida, and founder Ray Hussain leads every project. You see a free homepage concept, then one flat quote. Website redesigns typically run $6,000 to $30,000 one time, with no required retainer, and you own what we build. After the design direction is approved, most sites launch in 2 to 4 weeks. Comparing proposals? Use our quote comparison guide and see pricing and terms. Ask us the questions in the table, in writing, as you would any vendor.