Healthcare website compliance in 2026

Four bodies of law touch a practice website. HIPAA, the Americans with Disabilities Act, the FTC Act, and a growing set of state health-privacy laws. Most agencies sell against one of them and ignore the other three. This page covers all four and says what each one asks of a website. It ends with the twelve checks we run on every site we take on.

A "HIPAA compliant" badge in a footer has the legal weight of a sticker on a laptop. Compliance is a set of decisions about forms, scripts, vendors and markup. You can see each one in the page source.

Last checked: 17 October 2026. We re-read the sources below every month and change the date when we do.

HIPAA

It is about the forms, not the brochure. HIPAA covers protected health information held by a covered entity or its business associates. A brochure site with no forms, no chat and no portal holds none. The moment a visitor types a symptom into a contact form, that form is in scope.

The Security Rule's technical safeguards, 45 CFR 164.312, ask for five things. Access control, audit controls, integrity, person or entity authentication, and transmission security. Encryption is listed as "addressable". That does not mean optional. It means you must decide, write the decision down, and be able to show it.

Three questions settle most practice websites. Where does a submitted form go, and is that vendor under a business associate agreement. Is the connection encrypted end to end, including the email hop at the end. Who can read the submissions, and is there a log of who did. If your form tool is a free plan with no agreement on file, you have a HIPAA problem no badge will fix.

Tracking pixels

The rule changed. The risk did not. HHS published a bulletin on tracking technologies. It treated an IP address plus a visit to a condition page as protected health information. Hospitals sued.

A federal court in Texas struck the part about public, unauthenticated pages in June 2024. HHS dropped its appeal in August 2024. The part about logged-in pages, such as patient portals, still stands.

Our position has not moved. Keep ad pixels off any page where a person can submit health information, and off every page behind a login. Analytics on the public pages is fine. Sending form field values to an ad platform is not, whatever the court said about IP addresses. Plaintiffs' lawyers file these cases under state consumer law now, not HIPAA.

ADA and WCAG

The yardstick is already set. Title III of the ADA applies to places of public accommodation, and a medical practice is one. Courts disagree on whether a website alone counts. Plaintiffs file anyway, and settle.

The Department of Justice set WCAG 2.1 Level AA as the standard for state and local government websites. The first compliance date is April 26, 2027. That rule does not bind a private practice. It is still the yardstick every demand letter uses.

The current version of the guidelines is WCAG 2.2, last updated 12 December 2024. Building to 2.2 AA covers 2.1 AA.

UsableNet counted over 4,000 web accessibility lawsuits in 2024. More than 1,000 of the companies sued had an accessibility widget installed, over 25% of all cases. A widget is a script that promises to fix a page it did not build. We do not install them. We fix the markup.

FTC: the rule for everything HIPAA does not cover

Healthtech products that handle health data outside HIPAA answer to the FTC instead. The Health Breach Notification Rule now names health apps and similar technologies. Under it, a disclosure to an ad platform without consent counts as a breach. The FTC has also used plain deception law against companies whose privacy policy said "we never share" while their pixels did.

For a practice, the FTC matters in one place. Your privacy policy must describe what the site does. If it says no third parties and your page loads six, that is the problem, not the pixels.

State law

Washington went first. Its My Health My Data Act applied to most businesses from March 31, 2024. Small businesses followed on June 30, 2024. It covers health data HIPAA does not. It requires a separate consumer health data privacy policy linked from the homepage. It gives individuals a private right of action. Nevada and Connecticut passed laws in the same family.

If you see patients from those states, or run ads there, treat the strictest one as the floor.

The 12-point check

Data and vendors first.

• Every form that can receive health information posts to a vendor under a signed business associate agreement.
• Transport encryption on every page, with HTTP redirecting to HTTPS and no mixed content.
• No ad pixel or session recorder on form pages, booking pages, or anything behind a login.
• A privacy policy that lists the third-party scripts actually on the site, checked against the page source.
• A separate consumer health data privacy policy if you serve Washington, Nevada or Connecticut.
• Form submissions stored where access is logged, with a named person who reviews that log.

Then access.

• Text contrast at WCAG AA ratios, including placeholder text and buttons.
• Every form field has a visible label. A placeholder on its own does not count.
• The whole site works from a keyboard, with a visible focus ring.
• Alt text on every image that carries meaning, and empty alt on the ones that do not.
• Captions on video and a transcript for audio.
• No accessibility widget standing in for the eleven items above.

What this costs to get right

Less than a demand letter. Most of the twelve are decisions, not features. The expensive one is usually the form vendor. The free plan has no agreement, and the plan with one costs money. Moving over takes an afternoon, not a project.

This is the list we build to. If you want to know which of the twelve your current site fails, send us the URL. We reply with the list, not a sales call.