Is Your Dental Website HIPAA-Compliant? 5 Risks You’re Probably Taking

Most dental practices think their website is compliant. Most are wrong.

If your website has a contact form, appointment request, or patient portal, you’re handling Protected Health Information (PHI). And if you’re not careful, you could be facing fines up to $50,000 per violation.

Let’s look at the 5 biggest HIPAA risks dental websites face — and how to fix them.

---

Risk #1: Your Contact Form Is NOT HIPAA-Compliant

The Problem:

Most dental websites use standard contact forms that collect:

• Patient name
• Email address
• Phone number
• Reason for visit (e.g., “I have a toothache”)

When a patient submits that form, they’re sharing PHI (Protected Health Information). Standard form builders like Google Forms, Typeform, and basic WordPress forms are NOT HIPAA-compliant.

Why It Matters:

PHI must be encrypted in transit AND at rest. Standard form submissions are often stored in plain text or sent via unencrypted email. That’s a violation.

The Fix:

Use a HIPAA-compliant form builder with:

• Signed BAA (Business Associate Agreement)
• Encrypted submissions (AES-256 minimum)
• Encrypted storage
• Audit logging

JotForm Healthcare, HIPAA-compliant Gravity Forms (with proper hosting), and Microsoft Forms (with Business account) are options.

Cost: $99-$200/month for HIPAA-compliant form plans.

---

Risk #2: You’re Using Gmail for Patient Communication

The Problem:

Many dental practices use Gmail, Yahoo, or Outlook for patient communication. When a patient emails about their appointment, treatment, or symptoms, that email contains PHI.

Why It Matters:

Standard email is NEVER HIPAA-compliant. Email is unencrypted, can be intercepted, and is stored on servers you don’t control.

The Fix:

Two options:

1. Patient Portal — Use a secure patient portal for all communication. Patients log in and message you securely.

2. Encrypted Email — Use a HIPAA-compliant email service like Paubox or Virtru. These encrypt emails end-to-end.

Cost: $50-$150/month for encrypted email; patient portals vary.

---

Risk #3: Your Hosting Doesn’t Have a BAA

The Problem:

If your website is on shared hosting (SiteGround, Bluehost, GoDaddy, etc.), your host does NOT offer a Business Associate Agreement (BAA).

Why It Matters:

HIPAA requires any vendor that handles PHI to sign a BAA. If your host touches patient data (which it does if you store form submissions), and they haven’t signed a BAA, you’re not compliant.

The Fix:

Migrate to HIPAA-compliant hosting:

• WP Engine Enterprise — Offers BAA
• Kinsta — Offers BAA
• Cloudways HIPAA Servers — Offers BAA

Cost: $100-$300/month for HIPAA-compliant hosting.

---

Risk #4: No Audit Logging

The Problem:

HIPAA requires you to track who accessed PHI and when. Most websites don’t have audit logging enabled.

Why It Matters:

If there’s a breach, you need to know:

• Who accessed the data
• When they accessed it
• What they did

Without audit logs, you can’t prove compliance or investigate incidents.

The Fix:

Enable audit logging on:

• Website admin panel — Track logins and changes
• Form submissions — Track who submitted what
• Patient portal — Track all access
• Hosting control panel — Track server access

Cost: Often free (enable in settings) or included in care plans.

---

Risk #5: No Privacy Policy or HIPAA Notice

The Problem:

Your website is missing required legal pages:

• Privacy Policy — How you handle data
• HIPAA Notice of Privacy Practices — Required by law

Why It Matters:

HIPAA requires you to provide a Notice of Privacy Practices to patients. If it’s not on your website, you’re not compliant.

The Fix:

Add these pages to your website:

• /privacy — Your privacy policy
• /hipaa-notice — Notice of Privacy Practices
• Form consent — Add privacy notice to all forms

Cost: $500-$1,500 to have these professionally written, or use templates with legal review.

---

The Cost of Non-Compliance

Violation Category	Fine Range
Unknowing violation	$100 - $50,000
Reasonable cause	$1,000 - $50,000
Willful neglect (corrected)	$10,000 - $50,000
Willful neglect (not corrected)	$50,000+

Maximum penalty: $1.5 million per year per violation category.

But the real cost is patient trust. A breach can destroy your reputation overnight.

---

What HIPAA-Compliant Looks Like

A HIPAA-compliant dental website has:

✅ SSL Certificate — HTTPS on all pages

✅ HIPAA-Compliant Forms — Encrypted, with BAA from provider

✅ HIPAA-Compliant Hosting — With signed BAA

✅ No Email for PHI — Patient portal or encrypted email only

✅ Audit Logging — Track all PHI access

✅ 2FA on Admin Panels — Two-factor authentication required

✅ Privacy Policy — Clear data handling explanation

✅ HIPAA Notice — Notice of Privacy Practices page

✅ Access Controls — Unique logins, role-based access

✅ Staff Training — Annual HIPAA training documented

---

How to Fix Your Website

Step 1: Audit

Get a HIPAA compliance audit to identify gaps. Many agencies offer free preliminary audits.

Step 2: Remediate

Fix the issues:

• Switch to HIPAA-compliant hosting
• Replace forms with HIPAA-compliant versions
• Stop using email for patient communication
• Add privacy policy and HIPAA notice

Step 3: Maintain

HIPAA isn’t a one-time fix. Ongoing compliance requires:

• Security updates
• Annual BAA renewals
• Staff training
• Audit log retention

---

Free HIPAA Compliance Audit

Not sure if your website is compliant?

We offer a free preliminary HIPAA compliance audit for dental practices. We’ll scan your website for gaps and send you a report — no commitment required.

What we check:

• SSL certificate
• Contact form compliance
• Email practices
• Hosting compliance
• Privacy policy
• Audit logging
• Access controls

Get Your Free Audit →

---

Conclusion

HIPAA compliance isn’t optional — it’s required by law. But more importantly, it protects your patients and your practice.

The 5 biggest risks:

1. Non-compliant contact forms
2. Using Gmail for patient communication
3. Hosting without a BAA
4. No audit logging
5. Missing privacy policy

The fix:

1. HIPAA-compliant forms (JotForm Healthcare)
2. Patient portal or encrypted email
3. HIPAA-compliant hosting
4. Enable audit logging
5. Add required legal pages

Your patients trust you with their health. Make sure your website honors that trust.

---

Carlos Cabrales is an IT consultant specializing in HIPAA-compliant websites for dental and medical practices. Learn more at cc3po.com.

---

Related Articles:

• Why Gmail Isn’t HIPAA-Compliant (And What to Use Instead)
• HIPAA Compliance Checklist for Dental Websites
• What Happens When a Practice Gets Fined for HIPAA Violations

---

Need a HIPAA-compliant website? Contact us at legal@cc3po.com for a free audit.