Is your healthcare site HIPAA compliant?
Get a free scan in 30 seconds.

No. Our scanner identifies publicly visible compliance gaps in your website's privacy disclosures, terms of service, and publicly-facing policies. A HIPAA risk assessment under 45 CFR §164.308(a)(1)(ii)(A) requires a comprehensive, organization-wide evaluation of all ePHI systems — something that requires access to your internal infrastructure, not just your public website. Use our scanner as a first line of defense; follow with a full risk analysis for complete compliance.

A covered entity (45 CFR §160.103) includes health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically. A business associate is any person or organization that performs functions involving the use or disclosure of PHI on behalf of a covered entity (e.g., billing companies, cloud providers, IT vendors). BAAs are required under 45 CFR §164.504(e). Healthcare websites often use dozens of third-party vendors (analytics, chat, payment processors) who may qualify as business associates — our scanner flags vendors that appear to handle patient data without contractual HIPAA protections.

OCR enforcement data shows that organizations are penalized for gaps that existed at the time of a breach — not just at the time of audit. Scan quarterly at minimum, and always after: (1) adding new third-party vendors or scripts, (2) updating your privacy policy, (3) launching new patient-facing features. The Montefiore breach occurred undetected for 6 months; Lafourche's breach began in March 2021. A recurring scan catches drift before it becomes an OCR fine.

Under 45 CFR §164.402, any impermissible use or disclosure of unsecured PHI that compromises its security or privacy is presumed a breach. Exceptions exist only if a documented risk assessment shows low probability of compromise — which OCR requires organizations to prove, not just assert.

Yes. Substance use disorder (SUD) patient records are governed by 42 CFR Part 2, which provides stricter confidentiality protections than HIPAA. OCR launched its Part 2 Civil Enforcement Program in February 2024 (CARES Act §3221) and is actively investigating Part 2 violations. If you treat SUD patients, your Notice of Privacy Practices must specifically address Part 2 restrictions.