Website Builder Solutions

Wix is a popular website builder. Passive scanning is done periodically, but customers don’t have access to real-time monitoring to protect against hacking.Certain Wix features can be HIPAA friendly when paired with other services. Wix partners with Google Workspace to integrate email hosting. When purchasing Wix services, you may meet HIPAA requirements for email if you use specific security settings and sign a BAA with Google.

According to the virtual Help Center assistant on the Shopify website, Shopify doesn’t directly support HIPAA compliance. There is no mention of Business Associate Agreements on the main Shopify site or in the Help Center.Those looking for an e-commerce platform may want to consider a different service.

Squarespace offers a variety of software services. Its scheduling tool appears to meet the requirements for the HIPAA Security Rule.Protections for HIPAA accounts include email notification privacy, a shortened browser session timeout, and limited access for uploading intake forms. Also, customers can disable third-party integrations that don’t support HIPAA.Squarespace’s Powerhouse Player or Enterprise plan may be used to access HIPAA compliance features for your Scheduling account. Each Scheduling account must be HIPAA friendly before using the service for PHI.Covered entities should obtain a signed business associate agreement (BAA) from Squarespace.

WordPress offers a variety of website security features, but it’s unclear whether the controls are sufficient to meet HIPAA regulations.It is possible to meet specific HIPAA standards in WordPress, but this process is complicated. Controls must be in place to prevent unauthorized access to the administration control panel and PHI. Additionally, transmission security controls are necessary to encrypt data in transit and secure information at rest.If covered entities choose WordPress for website design and content management, they should be careful before considering uploading PHI to the site.

In its terms of service, SiteGround has stated in a HIPAA disclaimer section that customers are prohibited from using its services to store PHI.Covered entities that need web hosting services should choose a provider that offers digital and physical HIPAA-compliant safeguards. While most hosting providers provide HTTPS protocol and SSL certification for security, these features alone aren’t sufficient to meet HIPAA requirements. For a hosting account to be HIPAA compliant, it must include physical safeguards to protect equipment and servers. Audit controls and access controls are other digital security features that help with HIPAA compliance.