HIPAA Compliance

HIPAA compliance concerns how certain organizations use, disclose, and protect protected health information (PHI). HIPAA is not a blanket rule for every website that collects a health-related question. It principally governs covered entities, such as qualifying health plans and healthcare providers, and business associates that handle PHI for them. Different HIPAA rules address privacy, electronic information security, breach notification, and other responsibilities.

A medical practice evaluating an online appointment form should determine what data enters the form, which company hosts or receives it, whether that vendor acts as a business associate, and whether appropriate agreements and safeguards are needed. Protecting electronic PHI involves administrative, physical, and technical measures; an HTTPS padlock alone is not a HIPAA compliance program. Nor should a generic website platform's marketing claim replace a contract and actual risk assessment.

A landscaping company taking routine service bookings is not ordinarily subject to HIPAA merely because a customer mentions a medical concern. Other privacy obligations can still apply. Businesses should establish their regulatory status, map data flows, limit access, train staff, and consult qualified counsel when the application of particular HIPAA obligations is uncertain. Compliance is an ongoing operational program, not a single website badge or plugin.