The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law passed in 1996 that sets national standards for protecting sensitive health information. If your website or app collects, stores, or transmits health data — appointment bookings, patient portals, telehealth visits, intake forms — HIPAA likely shapes what you can and cannot do with that information.
One thing worth being upfront about: HIPAA is a privacy and data-security law, not an accessibility law. It does not contain rules about screen readers, color contrast, or keyboard navigation. But in practice, the two worlds overlap constantly. A patient portal that protects data beautifully but cannot be used by a blind patient creates real legal exposure under other laws — the Americans with Disabilities Act (ADA) and Section 504 and 508 of the Rehabilitation Act — and real harm to patients. Smart healthcare organizations treat privacy and accessibility as two halves of the same obligation.
This guide explains what HIPAA actually requires, who it applies to, and how to build digital experiences that are both secure and accessible.
Privacy law, not accessibility law
HIPAA governs how protected health information (PHI) is used, disclosed, and secured. Accessibility obligations for healthcare websites come from the ADA and the Rehabilitation Act — but the two intersect wherever patients interact with health data online.
Applies to covered entities and business associates
Health plans, healthcare providers, and healthcare clearinghouses are directly covered. Vendors that handle PHI on their behalf — including web hosts, analytics tools, and widget providers — become business associates with their own obligations.
Enforced by HHS with real penalties
The U.S. Department of Health and Human Services Office for Civil Rights investigates complaints and breaches. Civil penalties are tiered by culpability and can reach into the tens of thousands of dollars per violation, with annual caps in the millions for repeated violations.
Accessible privacy is part of good compliance
Privacy notices, consent forms, and patient portals only fulfill their purpose if every patient — including those using assistive technology — can actually read, understand, and complete them.
What HIPAA is and why it exists
HIPAA was enacted in 1996, originally to help people keep health insurance between jobs. Its lasting legacy, though, is its privacy and security framework. The HIPAA Privacy Rule (2003) governs how protected health information can be used and disclosed. The Security Rule (2005) requires administrative, physical, and technical safeguards for electronic PHI. The Breach Notification Rule requires organizations to notify affected individuals and regulators when unsecured PHI is exposed.
Protected health information is any individually identifiable health information held or transmitted by a covered entity — names tied to diagnoses, appointment records, billing details, even IP addresses or device identifiers when connected to a person's health care. If your website touches that kind of data, HIPAA is in scope.
Who must comply
HIPAA applies to two groups. Covered entities are healthcare providers who transmit health information electronically (hospitals, clinics, dentists, therapists, pharmacies), health plans (insurers, HMOs, employer health plans), and healthcare clearinghouses.
Business associates are third parties that create, receive, maintain, or transmit PHI on behalf of a covered entity — cloud hosts, billing services, email providers, chat tools, and yes, third-party scripts embedded on patient-facing pages. Covered entities must sign a business associate agreement (BAA) with these vendors, and the vendors themselves are directly liable for Security Rule compliance.
Notably, HIPAA does not cover everyone who handles health data. A fitness app you download yourself, or a general wellness blog, typically falls outside HIPAA — though other privacy laws may still apply.
- Healthcare providers that bill or transmit records electronically
- Health plans and insurers, including employer-sponsored plans
- Healthcare clearinghouses that process health data
- Business associates: any vendor handling PHI for a covered entity
What HIPAA means for your website
For a typical healthcare website, HIPAA compliance is mostly about controlling where PHI flows. Contact forms, appointment schedulers, patient portals, and telehealth tools must transmit and store data securely — encryption in transit and at rest, access controls, audit logs, and session timeouts are standard expectations under the Security Rule.
A common trap is third-party tracking. HHS has made clear in guidance that sending identifiable visitor data from patient-facing pages to advertising and analytics platforms can constitute an impermissible disclosure of PHI. Before adding any third-party script to pages where users interact with health information, ask whether that vendor will sign a BAA and what data the script actually collects.
Every third-party tool on a patient-facing page deserves this scrutiny — including accessibility tooling. Reputable vendors, AccessWiser among them, design their widgets to avoid collecting health information, but the responsibility for vetting what runs on your pages stays with you.
Where HIPAA meets web accessibility
HIPAA itself will not fine you for an inaccessible website. But healthcare organizations face accessibility obligations from adjacent laws: the ADA applies to places of public accommodation (courts have frequently applied this to healthcare websites), Section 504 covers recipients of federal funding like Medicare and Medicaid providers, and a 2024 HHS rule under Section 504 explicitly requires many federally funded health programs to make web content and mobile apps conform to WCAG 2.1 Level AA.
The intersection matters most where privacy and usability meet. A privacy notice that a screen reader cannot parse fails its purpose. A consent checkbox that cannot be reached by keyboard means some patients cannot lawfully authorize their own care. A patient portal with unlabeled form fields forces users to hand credentials to a family member — itself a privacy failure.
The practical takeaway: build patient-facing experiences to WCAG 2.1 AA (or the current WCAG 2.2) as your accessibility baseline, and treat that work as reinforcing your HIPAA program, not competing with it.
Enforcement and penalties
HIPAA is enforced by the HHS Office for Civil Rights (OCR), which investigates complaints, conducts audits, and responds to reported breaches. State attorneys general can also bring actions. There is no private right to sue directly under HIPAA, though breaches often trigger state-law claims.
Civil penalties are tiered based on the level of culpability, from violations the organization could not reasonably have known about up to willful neglect left uncorrected. Per-violation penalties can reach into the tens of thousands of dollars, with annual caps in the millions for repeated violations of the same provision. Criminal penalties, handled by the Department of Justice, apply to knowing misuse of PHI. Beyond fines, OCR resolution agreements typically impose multi-year corrective action plans — often more costly than the penalty itself.
Practical steps toward compliance
HIPAA compliance is a program, not a checkbox. For your web presence specifically, these steps cover the most common gaps.
- Conduct a security risk assessment covering every system that touches PHI, including your website and forms
- Encrypt PHI in transit (TLS) and at rest, and enforce role-based access controls and audit logging
- Inventory every third-party script and pixel on patient-facing pages; remove trackers that could disclose PHI, and get BAAs from vendors that handle it
- Make privacy notices, consent flows, and patient portals accessible to WCAG 2.1 AA — keyboard operable, screen-reader friendly, clearly labeled
- Train staff on handling PHI and establish a breach response plan with notification procedures
- Review and update policies annually, and document everything — OCR expects evidence, not intentions
Frequently asked questions
Does HIPAA require my website to be accessible?
Not directly — HIPAA is a privacy and security law. But healthcare organizations typically also fall under the ADA and Section 504, which do require accessible digital experiences. A 2024 HHS rule requires many federally funded health programs to meet WCAG 2.1 Level AA, so in practice accessibility and HIPAA compliance travel together.
Does HIPAA apply to my health-related blog or wellness app?
Usually not. HIPAA only covers healthcare providers, health plans, clearinghouses, and their business associates. A general wellness site with no ties to a covered entity is outside HIPAA — though FTC rules and state privacy laws may still govern how you handle health data.
Can I use analytics or an accessibility widget on my patient portal?
Carefully. HHS guidance warns that third-party scripts on patient-facing pages can impermissibly disclose PHI to vendors. Vet what each script collects, avoid sending identifiable data to ad platforms, and where a vendor does handle PHI, get a signed business associate agreement. Tools that collect no health information present far less risk, but the vetting duty is yours.
What are the penalties for a HIPAA violation?
Civil penalties are tiered by culpability and can reach into the tens of thousands of dollars per violation, with annual caps in the millions for repeated violations. Willful neglect draws the highest tiers, and OCR settlements usually include corrective action plans lasting years.
Is an accessibility widget enough to make my healthcare site compliant?
No single tool guarantees compliance with HIPAA or accessibility laws. A widget like AccessWiser can help you move toward WCAG conformance and improve usability for patients with disabilities, but it should sit alongside secure engineering, accessible design, manual testing, and a documented privacy program.
This article is provided for general information about accessibility regulations and standards. It is not legal advice — consult a qualified professional about your specific compliance obligations.