A Wix site can collect patient data only on an eligible paid plan, after PHI protection is activated and a BAA is signed from the site dashboard. Free, Light and Core plans are not eligible, and third-party apps are outside the BAA.
Conditional As of the 2026-10-19 check, Wix makes a BAA available on the Business, Plus, Elite, Business Elite and Enterprise plans for sites with PHI protection activated; the main exclusion is third-party apps and services Wix does not control.
Short answer
Wix offers a BAA on eligible plans for forms, databases, apps, Inbox and Bookings, signed from the site dashboard. The Free, Light and Core plans are not eligible. Wix states that it is not HIPAA compliant by default and does not guarantee third-party apps:. For other vendors checked the same way, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Business | Available | Activate PHI protection, then sign in the dashboard | Not published by the vendor |
| Plus | Available | Activate PHI protection, then sign in the dashboard | Not published by the vendor |
| Elite | Available | Activate PHI protection, then sign in the dashboard | Not published by the vendor |
| Business Elite | Available | Activate PHI protection, then sign in the dashboard | Not published by the vendor |
| Enterprise | Available | Activate PHI protection, then sign in the dashboard | Not published by the vendor |
| Free | Not available | n/a | n/a |
| Light | Not available | n/a | n/a |
| Core | Not available | n/a | n/a |
Minimum seats for the BAA: Not published by the vendor.
On eligible plans, the steps are:
- Activate PHI protection from the desktop dashboard.
- Open Compliance, then the Privacy & Cookies page.
- Select Sign Now next to BAA.
- Confirm your authority to sign, then enter your name, the date and your signature.
The signed copy stays viewable afterward. For pricing, Wix lists Business from $39.77/month on a yearly subscription; prices vary by location.
What the BAA covers and what it excludes
Covered, on a site with PHI protection active:
- The Wix site itself
- New Wix Forms
- Wix CMS databases
- Wix Inbox, HIPAA-compliant channels only
- Wix Bookings
Excluded or restricted:
- Third-party apps and services Wix does not control.
- Old Wix Forms. Recreate them with the new version.
- Facebook and Instagram channels in Inbox. Disconnect them.
- Some analytics and features, which are restricted when PHI protection is active.
- Booking notes that may contain PHI.
A clinic intake form is the clearest example. A new-patient form built with New Wix Forms and stored in a CMS collection falls within the covered list. A form built with a third-party app, or an older form never rebuilt, does not.
For comparison, see the category pages for HIPAA-compliant website builders and HIPAA-compliant forms.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
This table reports statements the vendor has published. It is not an audit.
How to use Wix with PHI
The BAA covers Wix's services only. The practice stays responsible for the rest. Use this checklist; it is not legal advice:
- Confirm the site is on an eligible plan: Business, Plus, Elite, Business Elite or Enterprise.
- Activate PHI protection in the dashboard.
- Sign the BAA before collecting any PHI.
- Recreate old forms with New Wix Forms, and remove the old versions.
- Disconnect non-compliant Inbox channels, such as Facebook and Instagram, and review every third-party app on the site.
- Keep PHI out of booking notes. Tell front-desk staff not to type symptoms or diagnoses into free-text fields.
- Set staff access, policies and training for everyone who can open form submissions or the Inbox.
Compliance depends on the signed BAA, the configuration and the practice's own policies. For definitions of BAA and PHI, see the HIPAA glossary.
Alternatives with a BAA
Each verdict is conditional. These are not ranked.
- Bubble: Dedicated Enterprise HIPAA add-on.
- Formstack: Forms HIPAA add-on.
- GoDaddy: Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant.
- Google Forms: paid Workspace editions, administered in the Admin console.
- Hushmail for Healthcare: Healthcare Basic plan.
For other website platforms, see Is Squarespace HIPAA compliant? and Is WordPress HIPAA compliant?.
Sources
- HIPAA Compliance for Your Wix Site | Help Center | Wix.com — Help article, checked 2026-10-19. "HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans."
- HIPAA Compliance for Your Wix Site | Help Center | Wix.com — Help article, checked 2026-10-19. "Wix cannot guarantee HIPAA compliance for apps or services we do not control."
- HIPAA Compliant Hosting Solutions | Wix.com — Vendor page, checked 2026-10-19. "Wix is not HIPAA compliant by default. Certain Wix solutions can be configured to support HIPAA compliance only for eligible US healthcare providers and their business associates."
- HIPAA Compliant Hosting Solutions | Wix.com — Vendor page, checked 2026-10-19. "Protect all PHI with applicable encryption protocols during storage and transmission to ensure your HIPAA compliant cloud hosting remains secure."
- HIPAA Compliant Hosting Solutions | Wix.com — Vendor page, checked 2026-10-19. "Support your HIPAA compliance hosting with a signed BAA and detailed audit trails to track every system interaction."
- Wix Pricing Information | Upgrade to a Premium Plan | Wix.com — Pricing page, checked 2026-10-19. "Business Grow your brand $39.77 mo"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification (see Sources for the check date).
Are Wix Forms HIPAA compliant?
New Wix Forms are covered by the BAA on a site with PHI protection active. Old Wix Forms are not covered and need to be recreated with the new version. Forms built with third-party apps are also outside the BAA.
Does Wix sign a BAA, and on which plans?
Yes. A BAA is available on the Business, Plus, Elite, Business Elite and Enterprise plans. You activate PHI protection, then sign from the Compliance section of the dashboard (Privacy & Cookies page, Sign Now next to BAA).
Can I use a Free, Light or Core Wix plan for patient data?
No. A BAA is not available on those plans, so they should not be used to collect or store PHI.
Does the Wix BAA cover third-party apps?
No. Third-party apps and services Wix does not control are excluded, and Wix does not guarantee them. Review each app on the site before PHI is collected.