HIPAA Compliance for Dental Websites: What Your Practice Needs to Know

Most dental practice owners think of HIPAA compliance as a back-office concern — training staff, locking file cabinets, handling records requests. The website is an afterthought. That assumption is expensive.

Your website is a point of contact between prospective patients and your practice. It collects names, phone numbers, appointment requests, insurance information, and in many cases, the reason a patient is seeking care. Under HIPAA, your practice is a covered entity. That means the Health Insurance Portability and Accountability Act applies to every system that touches protected health information — including your website.

What Counts as Protected Health Information on a Website

Protected health information (PHI) is any individually identifiable information that relates to a person's past, present, or future health, healthcare, or payment for healthcare. On a dental website, PHI can appear in several places that practices routinely overlook.

Contact forms and appointment request forms are the most obvious example. When a patient submits a form with their name, phone number, and a note that they need a root canal, that submission contains PHI. The question is where that data goes — and whether the vendor receiving it has signed a Business Associate Agreement (BAA) with your practice.

A BAA is a contract required by HIPAA whenever you share PHI with a third-party vendor. Your hosting provider, your form submission service, your email marketing platform — if any of them receive, process, or store PHI, a BAA is required. Most off-the-shelf website builders and hosting providers do not offer BAAs by default. Some don't offer them at all.

The Tracking Pixel Problem

In December 2022, the HHS Office for Civil Rights (OCR) issued guidance on the use of online tracking technologies — cookies, web beacons, tracking pixels, and session replay scripts — by HIPAA-covered entities. The guidance clarified that when these tools collect information that meets the definition of PHI, the HIPAA Rules apply.

The practical implication for dental websites: if your site has a Google Analytics tag, a Facebook Pixel, or any other third-party tracking script, and that script collects information from a form where a patient entered their name and the reason for their visit, you may be transmitting PHI to a third party without a BAA. That is an impermissible disclosure under the Privacy Rule.

A federal court narrowed part of this guidance in June 2024, vacating the specific theory that connecting an IP address with a visit to an unauthenticated public webpage about health conditions constitutes PHI. But the core rule remains: if your appointment request form, patient portal login page, or symptom checker tool has tracking code on it, and that code captures identifiable patient information, HIPAA applies. Most dental websites have not been audited for this.

What Violations Actually Cost

HIPAA violations are assessed in four tiers based on culpability, ranging from violations the covered entity was unaware of to willful neglect that goes uncorrected. Per-violation penalties range from roughly $100 to over $50,000, with annual caps per violation category that can reach into the millions.

In 2024, OCR imposed 22 financial penalties totaling $9.94 million. Nine of those penalties came from complaint investigations — meaning a patient filed a complaint, OCR investigated, and the practice paid. The most common complaint category was impermissible uses and disclosures, followed by Right of Access violations.

For dental practices specifically, the enforcement record is consistent. In 2022, eight dental practices settled with HHS for a combined $305,500, mostly over right-of-access violations. In October 2024, OCR imposed a [$70,000 civil monetary penalty against Gums Dental Care](https://www.hhs.gov/about/news/2024/10/17/hhs-office-civil-rights-imposes-70000-civil-monetary-penalty-against-gums-dental-care-failure-provide-timely-access-patient-records.html), a solo Maryland practice, for failing to provide a patient with timely access to records. That was OCR's 50th Right of Access enforcement action — and it was triggered by a single patient complaint.

What a Compliant Dental Website Looks Like

HIPAA-compliant dental websites share several characteristics that most practices currently lack. Hosting is provided by a vendor that offers a signed BAA, meaning the hosting company contractually agrees to protect PHI in accordance with HIPAA. Forms are encrypted in transit and at rest, and form submissions are not routed through non-BAA email services. Third-party tracking scripts are either absent from pages that collect patient information or have been replaced with HIPAA-compliant analytics alternatives.

SSL encryption is a baseline requirement, not a differentiator. Every page of a dental website should be served over HTTPS. Patient portal login pages and appointment request pages require particular attention: OCR guidance explicitly notes that tracking technologies on these pages may capture PHI even before a user logs in.

Regular audits matter too. The website you launched three years ago may have accumulated tracking scripts, third-party integrations, and form plugins that were never reviewed for HIPAA compliance. A one-time audit is not sufficient — the site needs to be reviewed whenever new tools are added.

Why Most Dental Web Companies Ignore This

The honest answer is that HIPAA compliance adds cost and complexity to website builds. Signing BAAs requires legal review. HIPAA-compliant hosting costs more than shared hosting. Removing tracking pixels from form pages can complicate marketing attribution. For agencies building dental websites at volume, these are friction points that are easier to skip.

The liability, however, falls on the practice — not the web company. If OCR investigates your practice and finds that your website was transmitting patient data to a third-party vendor without a BAA, the fact that your web agency set it up that way is not a defense.

Every site we build at Dental Authority Sites is built with compliance as a baseline requirement, not an add-on. That means HIPAA-compliant hosting with a signed BAA, encrypted form submissions, a tracking pixel audit before launch, and documentation you can produce if OCR ever comes asking. For more detail on how we handle compliance, see our [HIPAA compliance overview](/compliance).

If you want to know whether your current site has compliance gaps, that's a conversation worth having before a patient complaint makes it a more expensive one.