Wix, Squarespace, Shopify and HIPAA: How to Build a HIPAA-Compliant Practice Website

No website builder makes a site HIPAA compliant or non-compliant on its own. What matters is where protected health information (PHI) touches the site: contact and intake forms, booking widgets, chat widgets, tracking pixels, notification emails and stored submissions. Each of those points needs a vendor that signs a business associate agreement, or PHI has to stay off it. Below is how to check each builder's BAA position, what that means for its built-in forms, and a checklist you can work through this week.

Short answer: do Wix, Squarespace and Shopify sign a BAA?

Builder	Signs a BAA?	Native forms suitable for PHI?	Source	Date checked
Wix	Confirm in Wix's current documentation	Only if covered by a signed BAA	Wix help center	Record the date you check
Squarespace	Confirm in Squarespace's current documentation	Only if covered by a signed BAA	Squarespace help center or terms	Record the date you check
Shopify	Confirm in Shopify's current documentation	Only if covered by a signed BAA	Shopify help center or terms	Record the date you check

If a builder does not sign a BAA with your practice, its forms, stored submissions and notification emails should not receive PHI. That includes a "Reason for visit" field, an uploaded insurance card, or a message like "I need to reschedule my follow-up for my knee injection."

You can still build and host a practice website on any of these platforms. The site handles public content, and anything that collects patient information goes to a separate HIPAA-eligible service that signs a BAA. That service is usually an embedded form, a linked intake portal or a scheduling tool.

Vendor policies change. Before relying on this table, recheck each vendor's current documentation and note the date you checked.

What makes a website fall under HIPAA

HIPAA applies to covered entities, meaning healthcare providers, health plans and clearinghouses that conduct certain electronic transactions. It also applies to their business associates, which are vendors that create, receive, store or transmit PHI on the covered entity's behalf. When a vendor handles PHI for you, you need a signed business associate agreement (BAA) with it.

A public page that lists your hours, providers, services and parking directions holds no patient data, so it is generally low risk. Risk starts at the points where a patient can type, upload or reveal something about their health or identity. On a typical practice site, those points are:

• Contact and intake forms. These include "new patient" forms, medical history fields and insurance uploads.
• Appointment request forms and booking widgets. Name, date of birth, reason for visit and preferred provider together can identify a patient and their care.
• Patient portal links. The portal is usually run by your EHR vendor. Check what scripts sit on the page that links to it.
• Live chat widgets. Patients describe symptoms in chat, whatever the widget was meant for.
• Email notifications. Many builders email the full form contents to an inbox.
• Form storage. Submissions often sit in the builder's dashboard indefinitely.
• Analytics, ad and session-recording scripts. These can send page URLs, form events and identifiers to third parties.

Tracking technologies

HHS Office for Civil Rights (OCR) has issued guidance on tracking technologies such as analytics tags and ad pixels. The guidance covers both authenticated pages (behind a login, such as a portal) and unauthenticated pages (public pages, such as a "Book an appointment for cancer screening" page). OCR has revised that guidance since it was first published. A federal court later ruled on part of this guidance in American Hospital Association v. Becerra, so confirm which parts remain in effect and OCR's current position before relying on any summary. The legal picture is still moving. Treat pixels on pages tied to specific conditions, booking flows and portal logins as a question for your privacy officer or counsel, not a settled matter.

What does not make a site compliant

An SSL padlock means traffic is encrypted between the browser and the server. A privacy notice tells visitors how you handle data. A cookie banner asks for consent to cookies. All three are useful. None of them controls where form data goes after submission or whether the vendor holding it has signed a BAA.

Wix and HIPAA

Wix's stated position: Check Wix's help center for its current wording on HIPAA and BAAs, and record the URL and the date you checked.

Are Wix forms HIPAA compliant? The answer depends on Wix's BAA status above, because Wix Forms involves three PHI paths:

1. The form itself. Data entered by the patient is transmitted to Wix.
2. Submission storage. Entries are kept in the Wix dashboard.
3. Email notifications. Submissions are emailed to whoever is set as the recipient.

Before using any of these for patient information, confirm whether Wix offers any plan, app or add-on, including Wix Forms, Wix Bookings or Wix Chat, as HIPAA-eligible. If none is offered and no BAA is available, keep health details out of all three paths.

Wix Bookings and Wix Chat are PHI touchpoints too. A booking form that asks "What are you being seen for?" collects health information. A chat widget on your homepage will eventually receive "Is it normal to still have swelling three days after my procedure?" even if you labeled it "General questions."

Workaround: Keep Wix for the public site. Embed or link a third-party HIPAA-eligible form or booking tool that signs a BAA for intake, appointment requests and anything clinical. Before choosing one, confirm the vendor's current BAA terms and which plan includes the BAA. Set Wix's own contact form to non-clinical questions only, and remove any free-text "message" field that invites health details.

Squarespace and HIPAA

Squarespace's stated position: Check Squarespace's help center or terms for its current wording on HIPAA and BAAs, and record the URL and the date you checked.

Are Squarespace forms HIPAA compliant? Form blocks can deliver submissions to more than one place. Each destination is a separate PHI path. Check the storage and delivery settings on each form block; depending on setup, destinations can include:

• Stored in Squarespace. This path depends on Squarespace's BAA status.
• Sent to email. The inbox becomes a PHI touchpoint. A personal Gmail account is not covered by a BAA. A Google Workspace account may be, depending on your agreement and setup. See Gmail and HIPAA.
• Sent to connected storage. That storage vendor needs its own BAA, and you have to confirm it covers the specific service you use.

Squarespace Scheduling (Acuity) is a separate product, and its HIPAA options may differ from the site builder's. Confirm whether it offers a BAA and on which plan, checking this on its own rather than assuming it from the Squarespace answer. For alternatives, compare HIPAA-compliant scheduling tools.

Workaround: Link or embed HIPAA-eligible intake and scheduling tools for anything patient-specific. Keep the general contact form free of health details with clear labels. For example, label the field "Questions about hours, directions or billing (please do not include medical information)" and drop the open "How can we help?" field.

Shopify and HIPAA

Practices use Shopify to sell supplements, compression garments, skincare, home devices, membership plans or cash-pay services such as IV therapy packages or weight-loss programs.

Shopify's stated position: Check Shopify's help center or terms for its current wording on HIPAA and BAAs, and record the URL and the date you checked.

When an order can reveal health information. A plain retail order of sunscreen from a dermatology practice's shop is different from an order that only makes sense for a patient with a specific condition or prescription. Examples include a post-surgical recovery kit tied to a procedure you performed or a refill of a provider-prescribed product. Once an order is linked to an identifiable patient's care, checkout data, customer accounts, order history and order confirmation emails can become PHI touchpoints. Where exactly that line falls is a question for your privacy counsel.

Payments add another vendor to evaluate. For how processors approach HIPAA, see Stripe, Square, PayPal and HIPAA.

Workaround: Separate patient-specific services from the storefront. Keep the Shopify store for general retail products. Run prescription, treatment and program enrollment through a HIPAA-eligible system with a BAA, and avoid product names, tags or customer notes that record a diagnosis.

How to make your website HIPAA compliant: step-by-step checklist

Step 1 (first step): Inventory everything. List every page, form, widget, embedded script and pixel on the site. Include old landing pages from past campaigns and anything an agency added. For each item, mark whether a patient could enter or reveal PHI there and where the data goes.

Step 2: Get a BAA or remove PHI from each path. For every touchpoint you marked, do one of two things:

• Move it to a vendor that signs a BAA covering that specific service, or
• Strip PHI from it. Rewrite form fields, remove free-text boxes, and add a "do not include medical information" notice.

Check form automations too. A form that pushes entries through an automation platform into a spreadsheet creates two more vendors in the chain. See Zapier and HIPAA.

Step 3: Review tracking tools. Check analytics, ad pixels and session-recording tools against current tracking-technology guidance, and confirm OCR's current position, because this guidance has changed. Pay closest attention to booking pages, condition-specific service pages and portal login pages. Decide with your privacy officer or counsel which tags stay, which get configured differently and which come off.

Step 4: Secure the basics.

• Use HTTPS on every page, not only the form pages.
• Limit builder admin accounts to the people who need them.
• Turn on two-factor authentication for the builder account and connected email.
• Offboard former staff, freelancers and agencies, including shared logins.

Step 5: Document and recheck. Record your decisions in your security risk analysis, which the HIPAA Security Rule requires (45 CFR 164.308(a)(1)(ii)(A)). Recheck after every site redesign, new plugin, new widget or new marketing tag. A printable version of this checklist is in our free HIPAA templates and checklists.

Website content rules for medical practices

Patient testimonials and photos. Before-and-after photos, video testimonials and quoted reviews from patients generally require written authorization before you publish them. A patient's enthusiasm in the exam room does not count. Have counsel review your authorization form. Store signed authorizations where you can find them if a patient later withdraws consent.

Review replies. When replying publicly to an online review, do not confirm that the reviewer is a patient or mention their visit, treatment or records. Use a neutral reply such as "We take all feedback seriously. Please call our office manager at [number]."

Notice of Privacy Practices. If your practice maintains a website with information about its services, post your Notice of Privacy Practices on the site where patients can find it. A footer link is a common placement. The requirement is in 45 CFR 164.520.

Other rules can apply alongside HIPAA. Website accessibility requirements and state privacy or consumer health data laws can affect forms, tracking and data retention. Raise these with counsel for the states where you operate.

After the form is submitted: keeping internal follow-up compliant

Compliance does not end at the website. A new patient fills out a secure intake form, and then a front desk coordinator texts a screenshot of it to the office manager's personal phone. Or someone pastes the details into a WhatsApp group to ask who can call the patient back. Or the submission is forwarded around a shared inbox. Each of those creates a new PHI exposure the website work did nothing to prevent.

A safer internal pattern:

1. The submission lands in a HIPAA-eligible intake or scheduling tool covered by a BAA.
2. Staff coordinate the follow-up in a staff chat covered by a BAA, not in personal texts. For example: "New referral from the website, needs insurance verification before Thursday."
3. The follow-up gets a named owner and a deadline, so it does not sit unanswered over a weekend.

Chanty is internal team chat for staff. It is not a website builder, form tool or patient messaging channel, and it does not receive website submissions. It supports HIPAA compliance with a signed BAA on the Business and Enterprise plans. Front desk teams can turn a message about a new request into an assigned task with an owner and a due date. Learn more about HIPAA-compliant chat for staff.

Checking other tools in your stack? See more HIPAA tool checks.

FAQ

Is Wix HIPAA compliant in 2025?

No website builder is "HIPAA compliant" as a whole. The question is whether Wix signs a BAA and which of its features that BAA would cover. Check Wix's current help center wording and note the date you checked. Without a BAA, keep PHI out of Wix forms, bookings, chat and stored submissions.

Are Wix forms HIPAA compliant?

Only if Wix signs a BAA that covers Wix Forms, its submission storage and its email notifications. Confirm whether any Wix plan or add-on is offered as HIPAA-eligible. If not, use an embedded HIPAA-eligible form from a vendor that signs a BAA.

Will Wix, Squarespace or Shopify sign a BAA?

Vendor positions change, so check each builder's current documentation, as described in the verdict table at the top of this page. Confirm against each vendor's current documentation before deciding.

Are Squarespace forms HIPAA compliant?

That depends on Squarespace's BAA status and on where submissions go. Storage in Squarespace, delivery to email and connected storage are each separate paths, and each needs BAA coverage. Check Squarespace's current policy and your form settings.

Is Shopify HIPAA compliant for selling health products?

General retail products may not involve PHI. Orders tied to an identifiable patient's condition, prescription or treatment can, and then checkout, accounts and order emails become PHI touchpoints. Check Shopify's current documentation for its BAA position. Confirm the e-commerce question with privacy counsel.

Can I use Google Analytics or a Meta pixel on a medical practice website?

This is a gray area. HHS OCR guidance on tracking technologies has been revised and partly challenged in court. Confirm OCR's current position before relying on any summary. Review tags on booking, condition-specific and portal pages with your privacy officer or counsel before deciding.

Does an SSL certificate make my website HIPAA compliant?

No. SSL encrypts data in transit between the browser and the server. It does not control where submissions are stored, who receives notification emails or whether those vendors have signed a BAA.

Do I need a BAA with my web designer or agency?

If the agency can access PHI, it may be a business associate. Access could come through form submissions, the builder dashboard or connected inboxes. Confirm with counsel whether your agency or hosting provider needs a BAA. The simplest fix is to design the site so the agency never has access to PHI.

Can a practice website that only shows information and no forms still have HIPAA issues?

Yes, though the risk is lower. Tracking pixels, embedded chat widgets, unauthorized patient testimonials or photos, and public review replies that confirm someone is a patient can all raise issues.

What is the first step to creating a HIPAA-compliant website?

Inventory every page, form, widget, script and pixel, and mark each place where PHI could enter or leave the site. Every other decision depends on that list.