Doctors: Is Your Website and CRM Solution HIPAA Compliant?

Your appointment request form works. Your office manager receives the messages. Your marketing vendor says the website is secure, and somewhere in your files is a signed Business Associate Agreement. Does that mean your website and customer relationship management platform, or CRM, are HIPAA compliant?

Not necessarily. The important question is not whether a vendor uses the word compliant. It is whether your practice understands where patient information travels, who can access it, how it is protected, and what happens when something goes wrong.

For an independent podiatry practice operating two offices, that question reaches beyond the website. Requests may move into a CRM, shared email inboxes, text reminders, spreadsheets, and staff accounts. Each handoff deserves attention. A secure electronic health record does not automatically protect information collected elsewhere.

This article explains how HIPAA website compliance applies to those workflows, what evidence to request from vendors, and how to respond to a suspected incident. It provides general education, not a legal opinion or a determination that any particular system is compliant.

Does HIPAA Apply to Your Practice Website and CRM?

A public website is not automatically a protected health information system. Publishing office hours, physician biographies, and directions is different from collecting identifiable information about someone's care. The actual data and its context determine the risk, not the platform's label.

Consider a patient who submits a name, telephone number, and a message describing a diabetic foot wound while requesting an appointment. When handled for a HIPAA-covered practice, that information can be protected health information, or PHI. Moving it into a marketing CRM does not remove its protection.

Follow the information beyond the form

Map what happens after someone clicks submit. Does the form save a database record? Does it email the complete message? Does an automation send it to another service? Does a staff member download a spreadsheet to coordinate scheduling between offices?

• Inventory appointment forms, chat tools, patient messages, and uploaded documents.
• Identify every destination, including email, CRM records, backups, and exports.
• Record which employees and vendors can access each destination.

Reduce collection where possible. A scheduling request may not need a detailed medical history. Direct sensitive clinical communication into an appropriately configured patient communication system. Less unnecessary information means fewer copies to secure and fewer places to investigate if an incident occurs. Neither a privacy notice nor a patient checkbox substitutes for appropriate safeguards.

Does a Signed BAA Prove Your Website Vendor Is HIPAA Compliant?

A Business Associate Agreement, or BAA, establishes obligations when a vendor handles PHI on your practice's behalf. It does not prove that the vendor implemented those obligations. Treat the agreement as one component of your review, not a security certificate.

Determine which services the agreement actually covers. Website hosting, CRM management, support, messaging, and analytics may involve different providers. A BAA with your primary website agency does not automatically cover an unrelated scheduling tool contracted directly by your practice.

Ask for evidence, not reassurance

Request a written explanation of access controls, encryption, backups, incident reporting, and subcontractor arrangements. Ask who can read patient submissions and how access is removed when employees leave. Confirm whether the vendor maintains appropriate downstream agreements for subcontractors handling PHI.

• Identify the legal entity responsible for each service.
• Clarify incident notification expectations and escalation contacts.
• Review data export, retention, and account closure procedures.

Your practice retains its own responsibilities. Outsourcing hosting does not outsource staff access decisions or your response to known problems. Have counsel review contractual remedies separately: a BAA alone may not establish your audit rights, insurance protections, or reimbursement for incident costs. If a vendor cannot explain its safeguards plainly, that is a reason for further assessment, not automatic proof of a violation.

What Security Controls Should a HIPAA Website and CRM Have?

Start with the controls that protect the information your practice actually handles. The HTTPS padlock protects a connection between a browser and a server. It does not establish that stored submissions, database backups, emailed messages, or downloaded files are protected.

Ask the vendor to distinguish encryption in transit from encryption at rest. Also ask who controls encryption keys and whether support accounts can retrieve readable records. Encrypted storage provides limited reassurance if a compromised application account can display all patient information.

Verify access, passwords, and recovery

Use individual accounts rather than shared credentials, restrict access by job responsibility, and require multifactor authentication where supported. Ordinary login passwords should be stored using an appropriate salted password-hashing method, not plaintext. Password hashing and PHI encryption solve different problems.

• Review access for both offices, including former employees and contractors.
• Confirm security updates, useful logging, and tested recovery procedures.
• Check how exports, backups, and support access are controlled.

Under HIPAA's addressable encryption framework, addressable does not mean freely optional. The organization must evaluate whether the safeguard is reasonable and appropriate and document its decisions and alternatives as required. Obtain qualified advice about applicable requirements rather than accepting a vendor's claim that encryption is unnecessary. A documented risk analysis should connect safeguards to actual exposure, including downtime that could disrupt scheduling across both locations.

If you want an initial view of public-facing tracking, use Crandall Consulting's free website privacy and tracking scan. Its real-browser analysis identifies third-party activity and provides a prioritized checklist. It is a starting point, not a HIPAA audit, legal opinion, or compliance determination.

Can Website Tracking Tools Expose Patient Information?

A website can send information to third parties without an employee deliberately forwarding a patient record. Advertising pixels, session replay tools, chat widgets, and analytics scripts may collect page activity, identifiers, or information entered into forms, depending on their configuration.

Not every website visit is PHI, and HIPAA does not automatically apply to every public-page interaction. The analysis depends on the information, the relationship, and the circumstances. However, authenticated patient areas and forms containing identifiable care information deserve particularly careful review.

Test what tools actually receive

Ask your technical reviewer to inspect browser network activity while completing representative workflows with synthetic test information. Do not submit real patient details as a test. Review the destination, transmitted content, timing, and whether collection changes before and after privacy choices.

• Examine appointment, contact, and patient login pages.
• Check whether advertising tools receive form fields or sensitive URLs.
• Confirm that consent settings behave as described.

A cookie banner is not a substitute for HIPAA safeguards or a valid HIPAA authorization where one is required. Other privacy obligations may also apply independently. If a tool provides little operational value while collecting sensitive information, removal may be the simplest recommendation. Useful marketing measurement does not require placing every available tracking script on every page of your practice website.

What Should Your Practice Do After a Website or CRM Incident?

A vendor reports suspicious access, or your staff finds patient messages exposed in an unexpected location. Your first task is to coordinate containment and evidence preservation. Involve your privacy or security lead, qualified incident responders, and counsel. Avoid deleting logs or closing accounts before relevant evidence is preserved.

Request a written timeline, affected systems, potentially involved information, available logs, and containment actions. Record what your practice knew and when. Do not wait for the vendor to admit fault, finish every forensic step, or complete a contractual cure period before evaluating your responsibilities.

Separate a security problem from a reportable breach

A vulnerability alone does not prove a reportable breach. An impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or a documented assessment demonstrates a low probability of compromise. That assessment considers the information, unauthorized recipient, actual acquisition or viewing, and mitigation.

For reportable breaches of unsecured PHI, individual notification is generally required without unreasonable delay and no later than 60 calendar days after discovery. Business associates also have notification duties. Do not assume the vendor receives 60 days and your practice automatically receives another 60.

HHS reporting schedules differ for breaches affecting fewer than 500 versus 500 or more individuals; separate media requirements can apply. Smaller incidents still require timely individual notices when reportable. Review the HHS breach notification guidance with counsel, including discovery rules and applicable state requirements. Incomplete information is not an automatic deadline extension.

What We Look for When Auditing Practice Websites for HIPAA Risk

Our consulting approach follows the information rather than stopping at the homepage. The useful question is whether the technical workflow matches the practice's assumptions. Four patterns deserve particular scrutiny because they can hide behind otherwise professional-looking websites.

Disconnected ownership and unnecessary copies

First, responsibility can be fragmented. The website agency manages forms, another company hosts the CRM, and staff manage notification emails. We look for a named owner for each handoff and an escalation path that works across both offices.

Second, convenience can create unnecessary copies. A request may be retained in the website, CRM, and several inboxes. We examine whether each copy has a purpose, appropriate access, and a defined retention approach. Removing needless duplication can simplify both daily operations and incident investigation.

Controls that do not match the workflow

Third, reassuring labels can conceal unanswered questions. HTTPS, a signed BAA, and a secure-hosting description address different issues. Our review separates contractual commitments from configuration evidence and asks what each control actually protects.

Fourth, recovery planning can overlook vendor departure. We ask how the practice would retrieve records, preserve incident evidence, revoke access, and keep scheduling available if a service became unavailable. These are review priorities, not findings about your practice. A worthwhile assessment should identify what already works as clearly as what needs correction, then give your office manager a manageable list of actions.

How Can You Start Reviewing HIPAA Website Compliance?

You do not need to replace your website or CRM simply because the questions are uncomfortable. Start by identifying what information each system receives and requesting evidence that the safeguards match the workflow. Some problems may require configuration changes, better access management, or removal of unnecessary tracking rather than a major migration.

Give your office manager a defined assignment: inventory patient-facing forms, identify their destinations, collect applicable vendor agreements, and confirm incident contacts. Have a qualified technical reviewer validate the data flow, then bring unresolved legal questions to counsel. This division of work keeps you involved in decisions without making you the person inspecting every setting.

HIPAA website compliance is not a one-time badge. Revisit your review when you add a CRM feature, change vendors, introduce tracking, or alter how the two offices handle patient requests. Document decisions and assign follow-up responsibility.

The goal is confidence supported by evidence, not another administrative burden. To discuss where your website and CRM review should begin, schedule a strategy call.