I'm starting my first website for a doctor's office and I'm wondering if the website needs to be on a HIPAA compliant server, even if no patient health information is collected or stored on the server? There would be no storing or even collecting of any patient health information.


An ordinary website, such as one advertising office hours, contact information and related media should be fine, so long as it is completely separate from the HIPAA-compliant network & systems that serve the doctor's office.

This also means that you cannot use this webserver for any remote-access services (ie: VPN portal), regardless of the fact that the webserver itself will not be "storing" any PII.


To add some additional info. I would post a warning on the contact us section that no medical information is to be transmitted and provide a safe method if one exists. Also, the practice's Notice of Privacy Practices has to be posted on the site per HIPAA requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.