Healthcare organizations love WordPress for the same reasons everyone else does: it is flexible, editor friendly and open. But the moment a website collects protected health information, the rules change. An appointment request form, a patient intake questionnaire or a portal login can bring a site into HIPAA scope. That affects how the site is hosted, built and operated.
AlphaWeb offers HIPAA compliant WordPress hosting, and a Business Associate Agreement is available on request. This post explains how we think about HIPAA on WordPress so you can ask the right questions of any provider. It is not legal advice; your compliance and legal teams should always be part of the conversation.
First, find where PHI actually lives
Many healthcare websites do not need to handle protected health information at all. A hospital marketing site with service pages, locations and physician bios contains no PHI. The risk appears with features that collect or display health information tied to a person:
- Appointment request and contact forms that ask about symptoms or conditions
- Patient intake, registration or pre visit forms
- Patient portals, messaging or account areas
- File uploads of records, insurance cards or images
- Email notifications that include form contents
We start every healthcare engagement by mapping these flows. Often the safest design keeps PHI out of WordPress entirely, sending sensitive submissions straight to a HIPAA ready system such as an EHR or secure form service. When PHI must pass through WordPress, hosting and configuration have to be built for it.
Hosting safeguards
HIPAA compliant WordPress hosting starts with infrastructure that supports the administrative, physical and technical safeguards in the HIPAA Security Rule. In practice that means:
- Encryption in transit everywhere, with modern TLS and HSTS
- Encryption at rest for databases, file storage and backups
- Isolated environments, not shared hosting
- Restricted, logged server access with multi factor authentication
- Automated patching of the operating system and server software
- Backups that are encrypted, access controlled and tested
- A Business Associate Agreement with the hosting provider
Application safeguards
Hosting alone is not enough. WordPress itself must be configured carefully:
- Forms that handle PHI should encrypt stored entries or avoid storing them, and never email PHI in plain text
- Two factor authentication and single sign on for every user who can see submissions
- Least privilege roles so only authorized staff can view sensitive data
- Activity logging for logins, data access and configuration changes
- Automatic session timeouts for privileged users
- Careful review of every plugin that touches form data or user accounts
Watch analytics and tracking
Tracking technologies have become a major HIPAA concern for healthcare websites. Pixels and analytics scripts on pages where patients log in, book appointments or describe conditions can send information to third parties. We audit every script, remove tracking from sensitive pages and work with your compliance team on which tools are appropriate where. This is one of the most common issues we find in a site audit.
Operations and incident response
Compliance is an ongoing practice. We monitor uptime and security events, review access regularly, keep plugins patched through a tested process and maintain an incident response plan that fits your breach notification procedures. Documentation of these controls helps your risk assessments.
Performance and patient experience
None of this has to make a site slow or hard to use. The same caching, CDN and Core Web Vitals work we apply to every site still applies to public pages. Sensitive areas are excluded from caching and handled separately, so patients get a fast site and their data stays protected. Clear, accessible forms also reduce abandoned appointment requests.
Vendors and plugins in scope
Every third party service connected to a site that handles PHI becomes part of the conversation: form tools, email delivery, chat widgets, analytics, scheduling systems and backup storage. For each one, ask whether it will receive PHI and, if so, whether the vendor will sign a BAA. When the answer is no, the integration must be redesigned so PHI never reaches it. We keep a written inventory of every plugin and service on a healthcare site with notes on whether it touches sensitive data, and we review it whenever something is added. That inventory is one of the most useful documents a compliance team can have when they perform their own risk analysis.
HIPAA WordPress checklist
- Map every form, portal and integration that could touch PHI
- Keep PHI out of WordPress where you can
- Host in isolated, encrypted environments with a BAA
- Encrypt or avoid storing PHI form entries; no PHI in email
- Two factor authentication, least privilege roles and logging
- Remove tracking scripts from sensitive pages
- Tested backups, patching and an incident response plan
Frequently asked questions
Is WordPress HIPAA compliant?
Software alone is not compliant or noncompliant. Compliance depends on how WordPress is hosted, configured and operated, and on your policies. WordPress can be part of a compliant setup.
Do you sign a Business Associate Agreement?
Yes, a BAA is available on request for our HIPAA compliant WordPress hosting.
Can you move our existing site?
Yes. We audit it first, address PHI flows and tracking, then migrate it with no downtime.
Learn more about our WordPress security and hosting services or contact us to talk through your requirements.
