Search this site
HIPAA website guide

Website builders and HIPAA · vendor documents read October 13, 2026

Is Wix, Squarespace or WordPress HIPAA compliant? Builder by builder, in the vendors' own words.

Wix offers a business associate agreement on its Business plan and above, signed inside the site settings after PHI Protection is switched on. Squarespace offers one for Acuity Scheduling only, and says its form blocks cannot be part of a compliant setup. WordPress.com publishes no agreement, and self-hosted WordPress has no vendor to sign: the host and each form or scheduling service answer separately. Webflow, Duda, GoDaddy's builder and Shopify forbid protected health information on their platforms. None of them is "HIPAA certified," because HHS certifies no product.

Every line below is quoted from the vendor's own help page, terms or pricing page as it read on October 13, 2026, with the plan each agreement needs and what each vendor forbids. For which pages of a practice site can carry PHI at all, use the four questions in the HIPAA-compliant website guide. This page is general information, not legal advice.

See the builder tableHow we build practice sites

Builder by builder

Who signs a business associate agreement, on which plan, for what.

Read the four columns together. A vendor that signs still names what the agreement covers and what it forbids, and that is where most practice sites go wrong.

Website builders, whether each offers a business associate agreement, the plan it needs, what it covers and what the vendor forbids
BuilderAgreement offered?Plan it needsWhat the vendor forbids
WixBAA offered, on five plans, after you switch on PHI Protection and sign it inside the site dashboard.Wix: "HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans." The agreement is signed from the Compliance, Privacy & Cookies settings: "Click Sign Now next to Business Associate Agreement (BAA).""Some features, apps, or tools on Wix may not be compatible with HIPAA and activating PHI protection could disable, restrict, or remove some functionalities of your site." Old Wix Forms must be replaced, connected Facebook and Instagram inbox channels must be disconnected, and "Wix cannot guarantee HIPAA compliance for apps or services we do not control." Cancel the plan and data stays protected "for 30 days," after which "your site will no longer be HIPAA-compliant." On bookings: "Should I add notes to bookings? No."
SquarespaceBAA offered for Acuity Scheduling only. The website, its form blocks and everything else on Squarespace are outside it.Squarespace: "You can make your Acuity account HIPAA-enabled on the Powerhouse or Premium plans." Acuity's own pricing page, read October 13, 2026, has no plan named Powerhouse: its plans are Starter, Standard and Premium, and only Premium ($49 a month billed annually, $61 monthly) lists "Sign BAA for HIPAA compliance." Standard at $27 a month does not.On form blocks: "Can I use form blocks as a HIPAA-compliant solution? No." The Terms of Service say you may not use the services to "collect, use, disclose, protect or otherwise handle 'protected health information'" unless the account is designated HIPAA-enabled under a separate agreement. Squarespace adds that enabling the Acuity features "alone isn't enough to make you HIPAA compliant."
WordPress.com (hosted by Automattic)No public BAA offer found. The Terms of Service, last updated October 6, 2026, contain no HIPAA, PHI or business-associate language.None published. If a practice wants to stay on WordPress.com, the only route is to ask Automattic in writing and keep the answer.The terms do not address health information either way. Treat silence as no agreement: HHS says a host that stores electronic PHI is a business associate even when the data is encrypted and the host holds no key, so a form that saves entries on WordPress.com needs an agreement the public terms do not offer.
Self-hosted WordPressThere is no vendor to sign. WordPress is software; the host, the form plugin, the scheduler and the email tool each answer for themselves.Choose a host that signs a BAA for the plan you are on, and a form plugin or form service that signs one too. Hosts that publish a BAA and hosts that publish a HIPAA disclaimer both exist; read the document for your plan, not the marketing page.Gravity Forms, the most common premium form plugin, publishes no BAA of its own: its HIPAA page is a listing for "HIPAA Web Forms," described as "a third-party plugin by Code Monkeys LLC," which sends entries to a separate service. That vendor, not Gravity Forms, is the one to ask for an agreement.
WebflowNo BAA. Webflow's terms forbid protected health information on the platform.None. No Enterprise exception is published.Terms section "HIPAA Non-Compliance": "you agree not to provide or enable End Users to provide Protected Health Information, as defined in HIPAA, in the Website Content or otherwise in connection with your use of the Platform." The same page: "Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time."
DudaNo BAA. Duda's terms prohibit personal health information, and Duda tells health clients not to use its own forms.None.Terms: "You are strictly prohibited from uploading to and/or using the Services in connection with Personal Data which constitutes Personal Health Information."
GoDaddy Website BuilderNo BAA for the website builder or hosting. GoDaddy's published agreement covers only its Microsoft 365 email.None for the site. The agreement's scope is "the Microsoft 365 email services sold and supported by GoDaddy."Moving PHI from the covered email into any other GoDaddy product, which includes the site builder and its forms.
ShopifyNo BAA. Shopify's acceptable use policy names PHI as an activity the platform does not support.None."Certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA."

Every row was read on October 13, 2026 on the vendor's own page; the source for each builder is linked in the detail cards below. Prices and plan names change; the vendor page is the record.

What each agreement covers

The same builders, with what the agreement does and does not reach.

Wix says its agreement covers eligible US health care providers and the Wix tools that stay on after PHI Protection; Squarespace says its addendum covers Acuity and nothing else. Those boundaries are the vendor's own words, quoted here so the practice can hold the vendor to them.

Wix

Agreement: BAA offered, on five plans, after you switch on PHI Protection and sign it inside the site dashboard.

Covers: The Wix site and the Wix tools that stay enabled after PHI Protection is on. Wix's hosting page: "Wix is not HIPAA compliant by default" and "Certain Wix solutions can be configured to support HIPAA compliance only for eligible US healthcare providers and their business associates."

Wix Help Center: HIPAA compliance for your Wix site (read October 13, 2026) Wix: HIPAA hosting page Wix press release on the HIPAA solution Wix blog: Is Wix HIPAA compliant?

Squarespace

Agreement: BAA offered for Acuity Scheduling only. The website, its form blocks and everything else on Squarespace are outside it.

Covers: "Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations." "Your Business Associate Addendum (BAA) doesn't cover other Squarespace features."

Squarespace Help: Acuity Scheduling and HIPAA (updated January 20, 2026) (read October 13, 2026) Squarespace Help: Form blocks (updated September 28, 2026) Squarespace Terms of Service (effective March 27, 2025) Acuity Scheduling pricing

Self-hosted WordPress

Agreement: There is no vendor to sign. WordPress is software; the host, the form plugin, the scheduler and the email tool each answer for themselves.

Covers: Only what each signed agreement names. A host's agreement covers storage and transmission on its servers; a form service's agreement covers the submissions it processes; the practice's own plugins and theme are outside both.

Gravity Forms: HIPAA Web Forms add-on listing (read October 13, 2026) HHS: HIPAA and cloud computing

Form and scheduling layers

The services that sign, which a builder page can embed or link to.

A builder that forbids PHI can still hold the public pages while a covered service holds the form. The agreement then belongs to the form vendor, on the form vendor's plan.

  • HIPAAtizer

    BAA on every paid tier; the form lives on HIPAAtizer's servers and embeds into Wix, WordPress or Webflow.

    Pricing page: Gold $34 a month ($29 billed annually), Gold Plus $45 ($39), Platinum $125 ($99), each listing a Business Associate Agreement. The embed makes the form a separate vendor's form, which is the point: a builder that forbids PHI still hosts the page, and only the form's contents go to the covered service. HIPAAtizer's pricing page says a site is "always HIPAA Compliant" with it. Read that narrowly: the agreement covers the form, not the site around it.

    HIPAAtizer pricing (read October 13, 2026)

  • Jotform

    BAA for accounts that enable the HIPAA features, which Jotform ties to its Gold and Enterprise plans.

    Jotform: covered-entity customers "that have enabled HIPAA compliance features in their account will also receive a signed Business Associate Agreement (BAA)." The pricing page says the Gold plan "provides optional HIPAA compliance features." Jotform's own agreement adds that the practice may "only use Third Party Integrations if Covered Entity has a BAA or equivalent agreement" with each of them, so a Jotform form that pushes entries to a spreadsheet or a CRM needs agreements on that side too.

    Jotform: HIPAA compliance (read October 13, 2026) Jotform pricing (Gold plan HIPAA features) Jotform Business Associate Agreement (third-party integrations clause)

  • Hushmail for Healthcare

    BAA on all three healthcare plans; forms are on Essentials and Growth, not on Basic.

    Hushmail's healthcare plans start at $11.99 per user per month. The Basic plan is described as "HIPAA-compliant email" with a Business Associate Agreement and "Does not include forms"; Essentials and Growth add "HIPAA-compliant forms" and e-signatures. Hushmail forms are hosted by Hushmail and linked from the practice site, so they work with any builder, including the ones above that forbid PHI on their own pages.

    Hushmail pricing (read October 13, 2026)

  • Google Forms (Google Workspace)

    Covered by the Google Workspace Business Associate Amendment once an administrator accepts it; not on a free Gmail account.

    Google's HIPAA services list (last updated August 31, 2025) includes "Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)" among the Workspace services the agreement covers. Google's Workspace help adds that "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" and that "Third-party applications including add-ons are not included." A free @gmail.com account has no agreement to accept.

    Google: HIPAA compliance on Google Cloud and Google Workspace (read October 13, 2026)

  • Typeform

    BAA only on Enterprise or Growth Custom plans.

    Typeform's help center: "we can currently provide a BAA for customers on our Enterprise or Growth Custom plans." Its usage policy forbids health data on plans without one. A Typeform embedded in a builder page is still Typeform's form, so the agreement follows the Typeform plan, not the builder plan.

    Typeform: Business Associate Agreement (read October 13, 2026)

The vendors' own edge

A builder's agreement covers the builder. It does not cover what you add.

Every signed agreement on this page draws the same line: the vendor's own product, on the named plan, used the way the vendor says. Six things sit outside that line on almost every practice site.

The apps you add on top

Wix says it "cannot guarantee HIPAA compliance for apps or services we do not control," and Jotform's agreement makes the practice responsible for agreements with every integration. A chat widget, a review tool or a CRM sync is its own vendor with its own answer.

Wix Help Center: HIPAA compliance for your Wix site

Analytics and advertising pixels

A builder's agreement does not change what a tracking script sees. HHS gives the example of a clinic website that sends appointment details and an IP address to a tracking vendor: that vendor is a business associate and an agreement is required. Google says it offers no agreement for Google Analytics.

HHS OCR: Use of Online Tracking Technologies

Social inboxes and chat channels

Wix requires connected Facebook and Instagram channels to be disconnected before PHI Protection turns on, because messages that arrive through them leave the covered system. The same logic applies to any builder: a patient who messages through Instagram has sent PHI to Meta, not to the practice site.

Wix Help Center: HIPAA compliance for your Wix site

Email notifications of form entries

A covered form that emails each submission to a practice inbox has just moved the PHI into an email system. Google covers Gmail under its Workspace amendment once accepted; a personal Gmail, an ISP mailbox or a GoDaddy site-builder mailbox is not covered by the form vendor's agreement.

Google Workspace: HIPAA compliance

The practice's own obligations

Squarespace says enabling the Acuity features "alone isn't enough to make you HIPAA compliant," and Wix calls its product support for compliance, not compliance itself. The Security Rule risk analysis, staff training, policies and the decision about which pages carry PHI stay with the practice and its counsel.

Squarespace Help: Acuity Scheduling and HIPAA

A certificate that does not exist

No builder on this page says it is "HIPAA certified," because HHS does not certify products; the Office for Civil Rights says it does not endorse, certify or recommend specific technology. Any badge, on a builder or on a practice site, is the vendor's own claim.

HHS: HIPAA and cloud computing

Which pages carry PHI at all

The builder question comes second. The page question comes first.

A practice that keeps its public site to hours, directions, physicians, conditions and a contact form that asks for contact details only may never put protected health information on the builder at all. The four questions in the HIPAA-compliant website guide sort that out page by page: is the practice a covered entity, does the page sit behind a login, can the visitor type something about themselves, and does the page address a condition or provider. The page-type table on the same guide shows what a third-party script can see on each kind of page.

One court order changed part of that picture. On June 20, 2024, in American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas vacated the HHS tracking bulletin to the extent it said HIPAA is triggered when a tracker connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. The HHS page carries that notice at its top and says HHS is evaluating its next steps; the order's own footnote says the vacatur is not intended to limit the rest of the guidance. The bulletin's example of an appointment page sending details to a tracking vendor, which makes that vendor a business associate, still stands. A builder's agreement does not touch any of this.

HHS OCR bulletin, with the court-order notice at the top AHA v. Becerra, opinion and order of June 20, 2024 (PDF)

Builder questions practice owners ask

Short answers, each one traceable to a vendor page above.

01

Does Wix offer HIPAA compliance?

Wix offers a business associate agreement on its Business, Plus, Elite, Business Elite and Enterprise plans. The practice turns on PHI Protection in the site's compliance settings and signs the agreement there. Wix says the site is "not HIPAA compliant by default," that some apps and features may be disabled or restricted when protection is on, and that it cannot guarantee compliance for apps and services it does not control. The agreement covers Wix's own tools for eligible US health care providers; the practice's remaining obligations stay with the practice.

02

Is Squarespace HIPAA compliant?

Squarespace offers a business associate addendum for Acuity Scheduling only, on what its help page calls the Powerhouse or Premium plans; Acuity's pricing page today lists the agreement on Premium alone. Squarespace says Acuity is the only Squarespace feature designed to offer services consistent with HIPAA obligations and that the addendum does not cover other Squarespace features. Form blocks cannot be used as part of a HIPAA-compliant solution, and the Terms of Service forbid handling protected health information outside a HIPAA-enabled account. A Squarespace site can still link to a covered form or scheduler hosted elsewhere.

03

Is WordPress HIPAA compliant?

WordPress is software, so the question moves to the vendors around it. WordPress.com, the hosted service from Automattic, publishes no business associate agreement in its terms as of October 6, 2026. A self-hosted WordPress site needs a host that signs an agreement for its plan and a form or scheduling service that signs one too; Gravity Forms itself points to a third-party add-on rather than offering an agreement. Each signed agreement covers only the vendor that signed it.

04

Is Webflow HIPAA compliant?

No. Webflow's terms include a section headed "HIPAA Non-Compliance" in which the customer agrees not to provide or let end users provide protected health information on the platform, and its security page says Webflow "is not HIPAA compliant by default and is not designed to store or process protected health information." A Webflow site can host public pages and link to a covered form service such as HIPAAtizer or Hushmail.

05

Can I use my website builder's contact form for patient intake?

On Squarespace, no: form blocks "can't be used as part of a HIPAA-compliant solution." On Duda, no: its own blog says health clients should not use its first-party forms. On Webflow, Shopify and GoDaddy's builder, the terms forbid PHI on the platform. On Wix, the forms that remain enabled after PHI Protection is on are inside the agreement, and old Wix Forms must be replaced. On any builder, a form that asks for contact details only and tells the visitor not to include medical details is the usual public-page answer; intake belongs on a covered form or scheduler.

06

Is Wix HIPAA compliant, or just HIPAA-ready?

Wix's own wording is that it "provides the infrastructure and features to support HIPAA compliance, including PHI protection and a BAA." No builder on this page calls itself HIPAA compliant as a finished state, and none is HIPAA certified, because HHS does not certify products. The practice becomes compliant through its own risk analysis, policies and vendor agreements; the builder is one of those vendors.

07

Is a note telling patients not to type health details enough?

It is the right note on a public contact form, and it is not a substitute for an agreement where PHI is expected. HHS treats what a visitor enters on an appointment request, symptom checker or registration page as individually identifiable health information once it reaches a vendor. If the page's purpose is to collect health details, the form has to sit with a vendor that has signed an agreement.

08

Can a Squarespace, Webflow or Duda site link to a HIPAA form?

Yes, and that is the route those vendors themselves point to. Squarespace recommends "linking to an external, compliant service" for patient information outside Acuity, and Duda tells health clients to keep PHI off its first-party forms. HIPAAtizer, Hushmail and Jotform host the form on their own servers under their own agreement, so the builder holds the public page and the covered service holds the entry. The practice signs with the form vendor, on the form vendor's plan.

09

What happens to a Wix agreement if the plan is cancelled?

Wix says that if you cancel a supported plan, "your clients' data will continue to be protected under HIPAA standards for 30 days," and after that "your site will no longer be HIPAA-compliant." Wix also answers "Should I add notes to bookings? No." Plan changes are a compliance event on a builder: the practice's record should note the date the agreement was signed, the plan it is on, and the date any downgrade takes effect.

10

What does a builder's business associate agreement cost?

On the builders and services that publish prices: Wix includes the agreement on its Business plan and above; Acuity's pricing page lists the BAA on its Premium plan only ($49 a month billed annually, $61 monthly); HIPAAtizer's tiers run $29 to $125 a month; Hushmail's healthcare plans start at $11.99 per user per month; Jotform ties its HIPAA features to the Gold plan and Enterprise; Typeform to Enterprise or Growth Custom; Google Workspace includes the amendment on its business plans. Prices were read on October 13, 2026 and change; the vendor page is the record.

When the builder is the wrong tool

A practice site built with the vendor list written before the design.

Multi-location practices, sites with portals or integrations, and rebuilds that carry search visibility usually outgrow a builder's plan. The page inventory, the per-page script list, the vendor agreements and the release checks for that kind of site are on the medical and healthcare website design page. The public intake route remains intentionally unavailable while routing and operating boundaries are finalized, so nothing on this site asks for personal or medical information.

Medical & healthcare website designHIPAA-compliant website guide