Whether a website can touch PHI depends on what the site collects and on whether the platform will sign a business associate agreement (BAA) for the plan you use. Of eight website builders and hosts checked, none signs a BAA on every plan. Four are conditional, three do not sign, and one is unknown.
HIPAA-compliant websites: vendors with a BAA compared
This page reports the published BAA terms of eight vendors as verdicts: yes, conditional, no or unknown. Each verdict comes with the plan, the route to the BAA and a verification date. Wix, Squarespace, Bubble and GoDaddy are conditional. Shopify, Webflow and WP Engine do not sign. WordPress.com is unknown. Every "yes" is tied to a named plan or add-on.
This directory is published by Chanty, Inc., and that ownership is disclosed on every page. Placement in the table does not depend on payment. The page reports vendors' published terms. It does not audit vendors and is not legal advice. For other categories, see HIPAA-compliant software by category.
Quick answer: which website builders and hosting sign a BAA, and from which plan
- Wix: conditional. Business plan, on a supported Premium or Studio plan.
- Squarespace: conditional. Only through Acuity Scheduling Premium (Powerhouse). No Squarespace website plan allows a BAA.
- Bubble: conditional. Dedicated Enterprise with the HIPAA add-on.
- GoDaddy: conditional. Microsoft 365 email plans only. This does not extend to GoDaddy's website builder or hosting.
- WordPress.com: unknown. No BAA source was found.
- Shopify: no.
- Webflow: no.
- WP Engine: no.
Comparison table
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Wix | Conditional | Business | On a supported Premium or Studio plan, activate PHI protection from the desktop dashboard, then on the Compliance, Privacy & Cookies page click Sign Now next to Business Associate Agreement (BAA), confirm authority, enter name, date and signature and submit; the signed copy stays viewable there. | $39.77/month (Business plan, yearly subscription; prices vary by location) | Yes | Yes | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Squarespace | Conditional | Acuity Scheduling Premium (Powerhouse) | On a qualifying Acuity plan, open the BAA link below the account language dropdown in Acuity settings, review the BAA and your obligations, and submit the required information; each Acuity account must be HIPAA-enabled separately. | $55/month (Acuity Scheduling Premium, billed annually; $69/month billed monthly) — no website plan allows a BAA | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Bubble | Conditional | Dedicated Enterprise (HIPAA add-on) | Via sales as an add-on to the Dedicated Enterprise plan; Bubble signs the BAA and provisions a dedicated HIPAA environment | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-28 |
| GoDaddy | Conditional | Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant) | Electronic acceptance of the HIPAA Business Associate Agreement for the Microsoft 365 email services | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| WordPress.com | Unknown | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Shopify | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Webflow | No | — | — | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-28 |
| WP Engine | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
A dash means no plan is covered by a BAA. Verification dates are shown only in this table.
Vendors that do not sign a BAA
WordPress.com: unknown. No BAA source was found. Until the vendor publishes one, treat it as not approved for PHI. A clinic that has already put intake forms on a WordPress.com site should ask the vendor in writing before any patient data is collected.
Shopify, Webflow and WP Engine: no. None of the three signs a BAA. Without one, the platform cannot be the place where PHI is entered, stored or transmitted.
Webflow's SOC 2, SSO and audit-log flags do not change its verdict. A security report is evidence of controls, not an agreement to carry HIPAA obligations. Only a signed BAA does that.
For vendors outside this category, see all vendors checked for HIPAA status.
What counts as HIPAA-compliant website builders and hosting
No website is HIPAA compliant because of the builder it was built on. A site platform becomes eligible to handle PHI only when it signs a BAA for the plan you use, and you then configure and operate the site correctly. For the full definition, see what HIPAA compliant means.
When a BAA is needed. A vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. For a website, that means intake forms, appointment requests with health details, patient logins and chat that patients type into. A brochure site with office hours, provider bios and a phone number collects no PHI and does not need a BAA. A "request an appointment" form that asks for a reason for visit changes that.
How builders differ. Some sign on a named plan or add-on. Wix, Bubble and Acuity Scheduling Premium (Powerhouse) do. Some sign only for a product that is not the website, as GoDaddy does for Microsoft 365 email. Others do not sign at all, and some leave the question unstated.
Typical exclusions. Look for the following in each vendor's terms:
- Starter and lower-tier plans, which are usually outside the BAA.
- Features outside the covered service, such as forms, chat widgets and e-commerce.
- Separate products from the same company, which can have a different BAA position from the website itself.
For form tools that sign a BAA, see HIPAA-compliant forms.
Plugins, themes, designers and CMS. No WordPress theme or plugin makes a site compliant. The BAA with the platform does that work, together with a BAA with each third-party service that touches PHI. A "HIPAA-compliant" theme sold by a designer is a layout. It does not create a BAA with your host or with your form provider. The same applies to custom web design and development: an agency that builds your site and then has access to PHI needs a BAA of its own.
How to choose
- Decide what data the site will collect. If it will collect none, skip the BAA question and keep PHI off the site.
- Confirm the BAA is signed before any PHI enters the site. Check that the plan you will actually use is the one covered, not a cheaper tier. The business associate agreement guide explains what to look for in the agreement.
- Check which features sit outside the BAA. Forms, chat widgets, payments and analytics are the usual gaps.
- Get a separate BAA for every third-party plugin, form or chat tool that touches PHI. A signed BAA with the site platform does not cover them.
- Review the controls the vendor publishes. These are encryption at rest, audit log, SSO and availability of a SOC 2 report. Where a vendor publishes nothing, record that rather than assuming.
- Plan for access and offboarding. The customer owns this: who can edit the site, who sees submissions, and how access is removed when a front-desk employee or contractor leaves.
Related
FAQ
Does my website need a BAA?
Only if the site collects or stores PHI. Intake forms, appointment requests with health details, patient logins and chat all qualify. A brochure site with no patient data does not need a BAA. If you add any PHI-collecting feature later, get the BAA signed first.
Which website builders will sign a BAA, and from which plan?
Of the eight vendors checked, none signs on every plan.
- Wix signs on its Business plan, on a supported Premium or Studio plan.
- Bubble signs on Dedicated Enterprise with the HIPAA add-on.
- Squarespace signs only through Acuity Scheduling Premium (Powerhouse), not for website plans.
- GoDaddy signs for Microsoft 365 email plans only.
- Shopify, Webflow and WP Engine do not sign.
- WordPress.com is unknown.
Can I use Squarespace or WordPress.com for patient intake forms?
Not on the published terms. No Squarespace website plan allows a BAA. The only Squarespace route is Acuity Scheduling Premium (Powerhouse), which is a scheduling product, not the website. WordPress.com has no BAA source on record and is unknown. Treat it as not approved for PHI until the vendor publishes one.