Healthcare website security measures to consider

Your healthcare organization’s website is one of the most critical elements of your marketing strategy. By now, you likely understand that your website serves as your digital front door, sharing information about your services, providers, locations, and more.

While your practice or healthcare organization’s website has likely been a foundational element of your public-facing presence for many years, you may have found that its role has evolved drastically over the past couple of years and the onset of the COVID-19 pandemic. The latter changed work in nearly every industry and those in healthcare found themselves responsible for providing credible, timely information to the community in addition to being on the frontlines of providing care.

Over the past year and a half, many providers rushed to implement telemedicine offerings, new processes and procedures for office visits, and more. Similarly, non-healthcare industry businesses implemented new technologies for online ordering, curbside pickup, local delivery, and seemingly countless other services.

Simply put, the pandemic necessitated a rapid shift toward ensuring customers could interact with businesses safely and easily from afar.

How does this all relate to your healthcare organization’s website? It all boils down to the fact that healthcare consumers expect the same ease of use they’ve grown to enjoy in other aspects of their lives: things like online appointment scheduling and chat features. But in the healthcare space, these elements of convenience may open you up to HIPAA compliance violations.

With proper planning, your healthcare website can serve as a powerful marketing tool while still protecting patient data. Below, we’ll walk you through the things you should be thinking about while building or revamping your healthcare organization’s website.

1. Always be thinking about data separation.

There are two general architectures for most healthcare websites:

1. Your website is a HIPAA-Compliant web application itself
2. Your website is a marketing website that is the digital front door into one or many HIPAA-compliant ERP systems.

The following advice is speaking to the latter scenario (2), which we have found is the most common situation.

If I was to impart one piece of advice that sticks with every healthcare marketer, practice owner or manager reading this article, it would be this: Your website should never harvest and/or store leads. In many other industries, this practice is commonplace. You put a form on a landing page and collect as many leads as you possibly can. This can be a great strategy for healthcare marketing too, but to remain HIPAA compliant, the information you collect should notbe housed inside your website unless you follow stringent rules for dedicated storage, which can become unnecessarily complex and costly to manage.

The fundamental rationale behind HIPAA regulations surrounding protected health information (PHI) on the web is to protect patients from potential security breaches. In the current digital climate, the risk of a breach should be considered more of a “when” than an “if.” In fact, one recent report estimates there is an average of 58.8 healthcare data breaches and 3.70 million exposed records per month. If your healthcare website is housing patient information — even simple things like appointment requests or event signups — in an unsecured environment, you are putting your practice, your patients, your employees, and your vendors at risk.

Instead, look for HIPAA-compliant third-party integrations. These tools have been built with HIPAA compliance in mind, can be seamlessly integrated into your existing platform, and ensure your website data and PHI remain completely separate from one another. A few tools I like include JotForms, Cognito Forms, and CallTrackingMetrics.

2. Don’t cut corners to save a buck.

A great-looking, affordable, plug-and-play solution may be as simple as a few clicks in the backend of your website, but it probably won’t be secure. HIPAA-compliant solutions often come with a higher price tag than non-compliant alternatives. In the long run, they’re much more cost-effective than a security breach.

Another pushback I often hear is that remaining HIPAA compliant on the web is more time-consuming than implementing non-compliant tools. That may be true until you’re dealing with the aftermath of a breach. Putting in the time and effort required to build a secure system and workflow will pay dividends in the long run.

3. Invest in ongoing training and process development.

When it comes to common HIPAA violations on the web, most seem harmless. These actions may not seem egregious at all, like an employee sharing private information about a patient on social media; we’re talking about seemingly simple actions, such as creating an event signup form for prospective patients to register for an educational event about bariatric surgery. This person may not be a patient and may never be a patient, and they also may not have submitted any information about their health condition into the form. But by signing up for the event, that individual has signaled a health need and pushed that PHI into your marketing team’s hands. (Although this is a gray area when it comes to HIPAA, I always recommend that healthcare marketers play it safe and consider this type of information just as private as any other PHI.)

It’s critical that this type of event registration data be housed in a HIPAA-compliant environment. Without proper, ongoing training, your marketing team may be unaware of these requirements and unknowingly choose one of the unsecured solutions I referenced in tip #2 above.

4. Remember: Your website is a website.

At the end of the day, your website is a really robust marketing brochure. It’s not an ERP or EHR and it shouldn’t begin to house the types of information these systems are built to store. Instead, your website should share pertinent information about your providers, your services, your locations, and possibly some educational materials to help your patients and prospective patients become informed healthcare consumers. Anything else you do on your website will likely toe the waters of necessitating HIPAA compliance and should be approached with this requirement in mind.

HIPAA Compliance Helpers

If you’ve read through to the end of this article and feel overwhelmed—or maybe you’re excited about the opportunity to integrate more powerful tools into your website but aren’t sure where to start—fear not! A HIPAA-compliant digital marketing agency can serve as a great, trusted resource. Not only do these folks work day in and day out with healthcare marketers and organizations to implement safe, effective solutions that drive leads and yield tangible ROI, but they’re also equipped to sign Business Associate Agreements to share the burden of HIPAA compliance responsibilities alongside your organization.

_{About the Author}

_{Kevin West is a founding partner, Executive Vice President, and Chief Technical Officer for Full Media}