Website operations for healthcare organizations
Patient-facing websites need careful decisions about tracking, forms and links to clinical systems. We help implement the approved website configuration and maintain records of its operation.
When teams ask for help
A compliance review may ask what tracking runs, what forms collect and which services receive the information. Teams may also need accessibility findings or a record of changes made to the site.
Relevant website requirements
These topics may be relevant to your website. Applicability depends on your organization, the services it offers and the information it handles.
ADA web accessibility
How ADA accessibility requirements relate to websites and the tasks people need to complete.
Session replay and wiretapping
Questions to review before adding recording tools, chat widgets and similar tracking.
Breach notification
How incident-response and notification requirements depend on the data and jurisdiction.
Cookie consent
How storage, tracking, consent and opt-out rules vary by region and purpose.
Sector-specific considerations
These areas also need to be considered when planning the website and its forms.
- HIPAA and online tracking technologies
Review whether the organization is a covered entity or business associate, what information the site handles and how information reaches other services. Public information pages, patient portals and appointment workflows may need different treatment.
Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (opens in a new tab)US Department of Health and Human Services
- The HIPAA Security Rule
Where electronic protected health information is involved, the applicable safeguards and agreements need to be established before implementation. Review current HHS guidance and obtain advice on the actual data flow.
HIPAA Security Rule (opens in a new tab)US Department of Health and Human Services
Steadwatch's role
- We document approved third-party tools and their permitted data flows.
- Tracking is enabled only under the approved configuration, and site controls are checked as the website changes.
- Session recording and other optional tracking are off by default. If you add them, they run only for visitors who consent.
The managed platform also includes accessibility checks, consent controls, data-request tracking and monthly reporting.
Your responsibilities
- Whether your site should handle protected health information at all. We can build it so it does not, which is usually the right answer for a marketing site, but that is a clinical and legal decision.
- Your patient portal, scheduling system or electronic records, which are separate systems with their own obligations.
- Business associate agreements with anybody who does touch protected health information.
This page provides general information. Your obligations depend on your business and jurisdiction. Consult a qualified adviser about your circumstances.