Is There a HIPAA Compliant Website Builder? What Squarespace, Wix, and WordPress Say

No website builder is HIPAA compliant by itself. If you searched for a HIPAA compliant website builder, the question worth asking is narrower. It’s whether the vendor will sign a business associate agreement (BAA) for the specific feature that touches client information.

Squarespace will, for Acuity Scheduling only. Wix will, on five named plans, once you activate PHI protection. WordPress can’t: it’s free software with no vendor behind it, so the question moves to your host and your form plugin.

Here’s what each company’s own documentation says, checked on September 30, 2026, and what to do about it.

What “HIPAA compliant website builder” really means

The phrase is shorthand for a platform whose vendor will sign a business associate agreement covering the feature that handles client information. HHS doesn’t endorse or recognize private “certifications” of Security Rule compliance, and it requires a written agreement before a vendor handles protected health information (PHI) for you.

Two HHS pages sit behind that answer. In its Security Rule FAQ on certification, HHS says a certification from a private organization doesn’t remove a practice’s own legal obligations. Its business associate guidance says a practice covered by HIPAA may share PHI with a vendor only after getting written assurances, in a contract, that the vendor will safeguard it. That contract is the BAA. A separate HHS FAQ adds that a vendor can’t self-certify in place of a contract.

So a badge on a pricing page proves very little. A signed agreement, for a named product on a named plan, is something you can check.

Most guides on this topic rank five builders and call the winners compliant. That’s the wrong frame. We’ve built 500+ websites for therapists and coaches, and we don’t sell a “HIPAA compliant website” on any platform. No such product exists.

Stop asking whether the platform is compliant. Ask what information your site collects, and where it goes.

Is Squarespace HIPAA compliant?

Squarespace websites aren’t covered by a BAA. The company signs one for Acuity Scheduling only, on the Premium or Powerhouse plan. Its help center says PHI shouldn’t be kept or sent through the rest of the platform, and that the form block can’t be part of a HIPAA-compliant solution.

All of that comes from one Squarespace help article on Acuity Scheduling and HIPAA. It adds that an Acuity account becomes HIPAA-enabled only after a separate BAA is entered into for that specific account.

Acuity is its own subscription on top of your website plan. Its pricing page lists the BAA under Premium, at $49 a month billed annually or $61 month to month. (Prices were checked on September 30, 2026, and they change often.)

The form block is the part therapists miss. Squarespace says contact form features like it “can’t be used as part of a HIPAA compliant solution.”

Say you’ve paid for Acuity Premium and signed the BAA. Your booking flow is covered. Two clicks away, your contact page still has a form block with a “What brings you to therapy?” box, and every answer lands in your email. That form sits outside the agreement.

So on Squarespace, cut the form block down to name, contact details, and a preferred time, and send anything clinical somewhere else. The five steps further down cover where.

Is Wix HIPAA compliant?

Not by default, in Wix’s own words. Wix offers a BAA on its Business, Plus, Elite, Business Elite, and Enterprise plans. You sign it in the site dashboard and activate PHI protection there. Wix also says you’re responsible for how you configure the site and for any third-party apps you connect.

The phrase “not HIPAA compliant by default” is from Wix’s HIPAA page, which adds that only certain Wix tools can be configured for HIPAA, and only for eligible US healthcare providers and their business associates. Wix’s help article on enabling HIPAA compliance has the plan list and the signing steps. Light and Core, the two lowest-priced plans in Wix’s own plan rundown, aren’t on the list.

Three details in that help article deserve a slow read:

• Old Wix Forms have to be deleted and rebuilt with the new Wix Forms. Wix says PHI in the old version may not be handled as securely.
• Turning on PHI protection can switch off or limit some features and apps.
• For Wix Bookings, Wix says a note on a client’s profile in the contact list stays HIPAA-compliant, while a note added to a booking may not.

Of the general-purpose builders we checked, Wix is the only one offering a BAA that reaches beyond a single add-on product. It still leaves the setup to you. If your half-finished Wix site sits on a Light or Core plan, none of this applies to it yet.

Is WordPress HIPAA compliant?

WordPress is free, open-source software, so there’s no vendor to sign a BAA and nothing to be “compliant” by contract. The question moves to the company hosting your site and to every plugin that collects or stores what visitors submit. Each one answers separately, and some answer no.

Start with the host. Hostinger’s hosting agreement says its services aren’t intended to provide a HIPAA-compliant environment and shouldn’t be used as one. SiteGround’s position on hosting is one we couldn’t verify: its terms page wouldn’t load for us, and the one HIPAA article we found in its knowledge base covers Google Workspace email only.

Then the form plugin. Gravity Forms’ documentation says the company won’t sign a BAA, because it doesn’t host or store your form data. Entries stay on your own site’s hosting, and Gravity Forms notes that by default they aren’t encrypted in storage.

Say your WordPress site runs on a Hostinger plan, and an intake form built with Gravity Forms saves every entry to that hosting account. The plugin maker has said it won’t sign, and the host’s terms say the service isn’t a HIPAA environment. Nobody in that chain has agreed in writing to safeguard what your client typed.

WordPress.com, the hosted service, is a different case again. Its terms of service don’t mention HIPAA, and we found no page offering or refusing a BAA. That’s silence, which isn’t the same as a no. Ask before you collect anything sensitive there.

A limit on our side: our own site runs on WordPress, and we build on it for clients. For pages of text and photos, nothing above gets in the way. It matters the day intake answers start landing on that server.

On the sites we build, including our private practice website design projects, contact forms are set up through providers that sign a BAA. That doesn’t make the website a compliant product. It puts the one piece that might carry client information under a contract.

What the other website platforms say about PHI

Shopify, Webflow, and Framer all say no in writing. Shopify’s Acceptable Use Policy lists uploading PHI as an activity the platform doesn’t support. Webflow’s Acceptable Use Policy tells customers not to use the service for PHI at all. Framer’s help center says Framer isn’t currently designed to comply with HIPAA.

GoDaddy has a BAA, but its scope is the Microsoft 365 email GoDaddy sells. The website builder isn’t in it.

The therapist-specific builders each handle it differently. Brighter Vision’s terms prohibit storing HIPAA-regulated data on its services; its HIPAA email and forms run through Hushmail, and that BAA is between you and Hushmail. TherapySites’ terms incorporate a BAA. SimplePractice includes a one-page Professional Website on all plans, and you agree to its BAA when you create your trial account.

If you’re still choosing a platform, our review of website builders for therapists compares them on cost and portability.

Does a therapist website even need a BAA?

A website made of text and photos holds no client information, so there’s nothing for a BAA to cover. The question starts the moment a visitor submits something. From there it depends on two things: what they submit, and which company stores or forwards it.

HHS publishes no sentence that settles this for website inquiry forms. The closest language is in its de-identification guidance. Names, addresses, and phone numbers alone wouldn’t necessarily be PHI, it says. The same details listed with health information, such as an indication that someone was treated at a certain clinic, would be. That example describes past treatment and doesn’t mention prospective clients or contact forms.

Here’s our interpretation, and please read it as exactly that. A name and phone number sent to a therapy practice already hints that the person wants care, so we treat even a bare inquiry as a gray area. Once a message describes symptoms, a diagnosis, medication, or the reason for seeking therapy, we treat it as PHI. And if a vendor stores that message for you, the cautious reading of HHS’s business associate guidance is that you’d want a BAA with that vendor.

This is general information, not legal advice, so confirm how it applies to your practice with your own attorney or compliance resource.

A site that collects nothing sensitive is the simplest setup to defend.

Five steps that keep client information off your website

1. Keep the website itself free of client data. Pages, photos, fees, your bio. No client records and no intake answers sitting in the site’s dashboard.
2. Shrink the native contact form. Name, email or phone, and a preferred time to talk. Add one line above the button: “Please do not include health details in this form.”
3. Send anything clinical through a tool that has signed a BAA with you. Our review of HIPAA form builders lists which vendors sign and on which plans.
4. Book through your EHR’s client portal or a scheduler covered by a BAA. On Squarespace, that’s HIPAA-enabled Acuity. Online payments get their own post: HIPAA and payment processing for therapists.
5. Look at what else loads on your form pages. Analytics scripts and ad pixels can run on contact and booking pages too.

Say a prospective client fills out your contact form at 11 p.m. Give them a message box and they may write three paragraphs about the hardest year of their life, which then sit in a form inbox no vendor has agreed to protect. With three fields and that one-line note, you get a name, a number, and “weekday mornings.”

There’s a cost. A form with no “reason for reaching out” box means one more step for the client before you know why they’re contacting you. We’d still make that trade.

Where HHS’s online tracking bulletin stands today

Step five has a federal backstory. HHS’s Office for Civil Rights published a bulletin on how HIPAA applies to online tracking technologies such as cookies and tracking pixels.

The bulletin is still posted on hhs.gov. A notice at the top says that on June 20, 2024, a federal district court in Texas issued an order vacating a portion of it, and that HHS “is evaluating its next steps in light of that order.” The page shows it was last reviewed on June 26, 2024.

We’re reporting that status and drawing no legal conclusion from it. The practical step is the same whichever way it resolves: list every script that loads on the pages where people submit information, and take that list to whoever advises you on compliance.

Questions therapists ask about HIPAA and website platforms

What website builders are HIPAA compliant?

None of them, by themselves. Of the platforms we checked, Wix offers a BAA on its Business, Plus, Elite, Business Elite, and Enterprise plans, and Squarespace offers one for Acuity Scheduling only. TherapySites’ terms incorporate a BAA, and SimplePractice’s applies from account creation. A BAA covers the vendor’s side. How you set up and use the site is still yours to get right.

Is Acuity Scheduling HIPAA compliant?

Squarespace says an Acuity account becomes HIPAA-enabled only when a separate BAA is entered into for that account, which requires the Premium or Powerhouse plan. Acuity’s pricing page lists the BAA under Premium only. The agreement doesn’t extend to the rest of your Squarespace site.

Can I use Google Forms or Jotform for intake on my website?

Both vendors offer a BAA under conditions. Google’s covers Forms when your practice is a Google Workspace customer and a super admin has accepted the BAA in the Admin console. Jotform’s comes with its Gold and Enterprise plans after HIPAA features are enabled. We go through each in Is Google Forms HIPAA compliant? and Is Jotform HIPAA compliant?

Does a “HIPAA certified” badge mean a tool is safe to use?

No. HHS says it doesn’t endorse or recognize private organizations’ certifications of Security Rule compliance, and a separate HHS FAQ says a vendor can’t self-certify in place of a contract. Ask for the agreement, then read which product and plan it names.

The search for a HIPAA compliant website builder ends somewhere less exciting than a product page: pick the platform you can actually run, collect as little as possible on it, and put a BAA under anything clinical. If you’d like a second pair of eyes on what your current site collects, get a custom quote through the Website Inquiry Form. The consultation is free.