HIPAA compliance checklist for web developers

Your website’s HIPAA compliance rests on three layers of control: administrative safeguards, technical safeguards, and browser-based security, backed by documentation that proves each control works. Browser-based security is the layer most guides skip, and it’s where OCR investigations increasingly find gaps. The checklist below covers all three layers.

What this guide covers

• 30 plus checklist items across administrative, technical, browser-based, and ongoing compliance controls.
• The three OCR failure patterns behind most website-related HIPAA incidents.
• Why browser-based risk, not hosting or encryption alone, drives current enforcement activity.

Disclaimer: This guide supports educational purposes and operational readiness. It doesn’t constitute legal advice and doesn’t replace your organization’s HIPAA compliance program or counsel. Follow your legal department’s guidance and the current HHS and OCR rules and bulletins.

HIPAA website checklist for 2026

Administrative safeguards

Risk assessment

• Complete and record an annual website security risk assessment.
• Catalog all third-party scripts and vendors, including analytics, chat, tag managers, CDNs, and form handlers.
• Document a risk management plan with owners, timelines, and residual risk.

Business Associate Agreements (BAAs)

• Execute a BAA with your hosting provider.
• Execute a BAA with your analytics platform, or block analytics from any ePHI flows entirely.
• Execute a BAA with your chatbot or live-chat provider.
• Execute a BAA with the form handler, Customer Relationship Management (CRM) platform, or marketing platform that processes submissions.
• Document compensating controls for vendors that refuse a BAA, or remove them from the ePHI scope.

If Google Analytics can receive identifiers tied to health interactions, it functions as a business associate, and Google doesn’t sign BAAs for Google Analytics. Prevent ePHI from reaching Google Analytics entirely, or remove it from covered patient journeys and use an analytics provider that signs a BAA.

Access management

• Enforce role-based access with least privilege for your Content Management System (CMS), CDN, and tag manager.
• Complete HIPAA training for all staff with website or admin access.
• Enable and retain admin and audit logs for your CMS, CDN, tag manager, and single sign-on (SSO) or identity provider (IdP).

Policies and procedures

• Document website security policies covering tracking, cookies, browser-based code, and data flows.
• Include run-time and script-compromise scenarios and notification steps in your incident response plan.
• Define a vendor vetting procedure that covers security questionnaires, BAA review, and change control expectations.

Technical safeguards

Access controls

• Enforce unique user IDs and multifactor authentication for all admin and PHI-access accounts.
• Configure auto-logoff after 15 to 30 minutes of inactivity.
• Apply role-based access with least privilege across your CMS, database, tag manager, and SSO or IdP.
• Align your password policy with NIST SP 800-63B.

Encryption and data protection

• Enforce Transport Layer Security (TLS) 1.2 or later site-wide, with HTTP to HTTPS redirects.
• Configure HTTP Strict Transport Security (HSTS) headers.
• Enable database encryption at rest for all ePHI tables and volumes.
• Encrypt backups containing ePHI with managed keys.

Form protection

• Submit all PHI forms with POST, and never place PHI in URLs or query strings.
• Disable autocomplete on PHI fields to prevent local browser storage and unintended autofill.
• Exclude PHI responses from cache.

Audit and monitoring

• Enable access logs for every PHI access attempt.
• Configure failed-login monitoring and alerting.
• Retain security and audit logs for 6 years.
• Enable File Integrity Monitoring (FIM) for web and app binaries, configuration files, and script assets.

Browser-based security controls

Third-party script management

• Maintain a complete, current inventory of every script and tag loaded on patient-facing pages.
• Document BAA status for each vendor and script domain, including analytics, chat, and tag managers.
• Gate every new script behind a formal approval workflow before it reaches production.
• Audit script behavior on a set schedule.
• Configure continuous monitoring to alert on unauthorized script changes, additions, or domain shifts.

Analytics and session tools

• Enable IP anonymization, and exclude PHI form fields from analytics collection.
• Configure any session replay tool to mask or redact PHI by default.
• Evaluate and document privacy-preserving analytics alternatives when PHI risk exists.

Script security

• Enforce an allowlist-based Content Security Policy (CSP) for script-src, connect-src, frame-src, and frame-ancestors.
• Apply Subresource Integrity (SRI) hashes to static third-party JavaScript where feasible.

Vulnerability management

• Run external vulnerability scans at least quarterly for web assets in scope.
• Complete annual penetration testing that covers the website, patient portals, and browser-based attack paths.
• Apply security patches for web stacks and libraries within 30 days.
• Keep your CMS, plugins, and tag manager templates current, and remove or isolate unsupported components.

Ongoing compliance

Business continuity

• Perform daily encrypted backups, and retain verification logs.
• Run and document quarterly restoration tests in a clean environment.
• Complete an annual disaster recovery test, and record Recovery Time Objective (RTO) and Recovery Point Objective (RPO) results.

Breach preparedness

• Keep breach detection tools active with alert triage procedures.
• Define roles, evidence handling, and regulator timelines in your incident response runbook.
• Maintain current, pre-approved patient and provider notification templates.

Regular reviews

• Complete quarterly HIPAA self-assessments, and track remediation.
• Update assets, threats, and vendor inventories in your annual risk assessment.
• Capture BAA status, change logs, and incident history in formal vendor reviews.

Applied together, these controls prevent five common gaps: marketing teams adding tags without a security review or BAA, website redesigns going live without re-assessment, orphaned CMS or Secure File Transfer Protocol (SFTP) accounts remaining active after staff turnover, session replay tools recording PHI due to misconfiguration, and third-party script or CDN changes deploying without integrity checks or a CSP.

The four HIPAA rules behind these controls

HIPAA organizes its requirements into four rules that govern how covered entities and business associates handle PHI. Each checklist category above maps back to one or more of these.

Privacy rule. Defines when covered entities can use or disclose PHI. It requires a Notice of Privacy Practices, establishes patient rights, and sets the “minimum necessary” standard for disclosures related to treatment, payment, and healthcare operations.

Security rule. Covers electronic PHI (ePHI) and requires administrative, physical, and technical safeguards. For websites, this means strong authentication and authorization, session controls, encryption, monitoring, minimal admin privileges, and vetting of third-party code.

Enforcement rule. Sets OCR’s process for investigations and penalties, including civil money penalty tiers, resolution agreements, and corrective action plans. It governs how OCR enforces the Privacy, Security, and Breach Notification Rules.

Breach notification rule. Requires organizations to notify affected parties, the Department of Health and Human Services (HHS), and in some cases the media, no later than 60 days after discovering a breach. Business associates must notify covered entities, and every incident requires a risk assessment.

Why browser-based risk matters right now

In September 2025, OCR settled a HIPAA case with Cadia Healthcare over gaps in access and authorization controls. The case shows that web-facing controls remain an active enforcement target.

HTTP Archive’s Web Almanac documents how widely modern sites rely on third-party scripts and tracking tools, which extends the compliance surface beyond your own servers. If your site loads marketing tags, analytics, appointment schedulers, CAPTCHAs, chat widgets, or a CDN, browser-based code runs in each patient’s browser, often from many external domains that server-side tools don’t detect.

Failure patterns OCR sees most often

OCR investigations into website incidents tend to surface three recurring patterns.

Ungoverned script additions. A marketing or UX team adds a tag, such as an ad pixel, analytics snippet, or session-replay plugin, without a security review or BAA. The tool starts capturing form fields or page context tied to care interactions, and PHI reaches a third party outside your controls. Gate every new script behind a lightweight approval step, document data access for each one, and require a BAA or block the tool from any PHI path.

Uncleaned launch settings. Redesigns and launches ship with temporary settings that never get removed. Treat each go-live as a change to a regulated system: run pre-launch checks for CSP configuration and PHI-in-URL exposure, confirm replay and analytics exclusions on PHI pages, and verify post-deploy that production matches what you tested.

Lingering access. Orphaned admin accounts and shared credentials after staff turnover leave exports, backups, and submission inboxes exposed. Close this gap with identity hygiene: use your SSO or IdP as the source of truth, apply role-based access with least privilege, automate off-boarding, and run periodic access attestations.

Each pattern traces back to a routine process gap. Continuous run-time monitoring, an up-to-date script inventory, and disciplined change control help you catch and remediate these gaps quickly.

Next steps

Baseline your site against the checklist above this week. A HIPAA-compliant website demonstrates control over who accesses ePHI, how that data moves, and what code runs in each patient’s browser, and the checklist gives you the evidence to demonstrate it. Follow the baseline with a browser-based security audit to validate the results and close any remaining gaps.