Websites, hosting, and marketing for healthcare
Know what your marketing is doing without ever seeing who your patients are.
HIPAA compliant websites and patient portals, AWS hosting under a signed BAA, and ad tracking that keeps every bit of patient data away from Google and Meta.
We sign a BAA before any patient data moves. No contracts.
Websites, patient intake, hosting, SEO, and ads for practices that handle protected health information.
Home health agencies, clinics, med spas, therapists, dental and specialty practices.
We act as your Business Associate under 45 CFR 160.103 and sign a BAA before any work touches patient data.
You still get real numbers on which ads bring patients. The ad platforms just never learn who those patients are.
Most agencies either put the Meta pixel on your patient pages or turn tracking off and fly blind. We built a third way.
Healthcare marketing usually breaks one of two ways.
Either your patient data is leaking, or your ad money is a guess.
The pixel is on your patient pages
A regular agency installs the Meta pixel and Google Analytics everywhere. Now Meta knows a visitor looked at your addiction treatment page and booked. Hospitals have paid millions in settlements over exactly this.
Tracking turned off completely
The "safe" agency rips out all tracking. Nothing leaks, but nobody can tell you which ad brought in last month's patients, so the budget gets spent on faith.
Hosting that only claims to be safe
A $10 shared server with a "HIPAA secure" badge is not compliant. There is no such thing as HIPAA certified. Compliance is a signed BAA plus real controls, every day.
Build it right. Host it right. Track it without leaking it.
One team handles the website, the hosting, and the marketing, so nothing falls in the gap between vendors.
Forms and portals built for PHI
Marketing sites, intake forms, and patient portals built to the HIPAA Security Rule.
- Forms post straight to your EHR or our secured backend
- Role based access, MFA, and automatic logout
- Audit log of every view, change, and delete
AWS under a signed BAA, from $350 a month
Your patient data lives on HIPAA eligible AWS services covered by our BAA with Amazon.
- TLS 1.2 or higher on every connection
- AES-256 encryption at rest, backups included
- Your own isolated environment, never a shared server
Tracking that never sees a patient
Anonymous visitor IDs tell us which ads work. Google and Meta only ever hear "a lead happened."
- No pixels on condition or treatment pages
- No names, emails, or phones sent to ad platforms
- Ads built inside Google and Meta health policies
What a HIPAA ready vendor should be able to show you.
Ask any agency for these. We hand them over before we start.
-
A signed BAA
Reviewed and signed before any patient data enters anything we build or host.
-
Named infrastructure
AWS, HIPAA eligible services only, in data centers audited for SOC 2 and ISO 27001, covered by our own BAA with Amazon.
-
Your own environment
Each practice runs in its own isolated AWS environment. We patch the server, runtime, and CMS and watch it around the clock.
-
Encryption everywhere
TLS 1.2 or 1.3 in transit and AES-256 at rest, including backups.
-
Audit logging
Append only logs of who viewed, changed, or deleted a patient record.
-
Access controls
A unique login for every person, role based permissions, and required MFA. No shared admin accounts.
-
Automatic logout
Sessions time out after inactivity and force a fresh sign in.
-
Backups and recovery
Encrypted, checksummed backups and a written restore plan that we actually test.
-
48 hour incident notice
If we find a security incident, you hear from us in writing within 48 hours, leaving you time for any breach deadlines.
-
A tracking map
A written list of every script on your site, what it collects, and which pages it is allowed on.
-
A data handling statement
In writing: no patient data is sold or shared with ad networks or analytics tools.
-
A responsibility list
A written split of what we handle and what your team handles, so nothing falls in the gap.
More patients from the same ad budget, and nothing to explain to a lawyer.
When you can see which campaigns bring in patients, you stop paying for the ones that do not. When nothing identifiable leaves your site, there is nothing to report, settle, or apologize for. You get both.
- Lower cost per patient because the ads can actually be tuned
- Ad accounts that stay in good standing with Google and Meta health rules
- Far less exposure to pixel lawsuits and breach notices
- Ready answers when a hospital, payer, or referral partner sends a vendor security review
- One team and one BAA instead of a web person, a host, and an ad agency
We follow a ghost, not a patient.
Every visitor gets a random ID that is not built from anything about them. We see that a ghost came from a Google ad, read two pages, and filled out a form. The form itself goes to your system, not ours. Only you can connect that ID to a real person, and nobody else ever gets the key.
- Random visitor ID, never derived from personal info
- Form contents go to your backend, never to our analytics
- IP addresses dropped, not stored
- Ad platforms get a plain lead event and nothing else
You keep the numbers. The ad platforms lose the patient.
Turning tracking off keeps you safe and broke. Leaving the pixel on keeps you informed and exposed. Our setup gives you cost per patient by campaign, with nothing identifiable leaving your walls.
- Real cost per lead for every campaign
- Nothing that ties a person to a condition goes out
- No Enhanced Conversions or hashed emails sent to Google or Meta
- Same reporting our other clients get
Audit, sign, build, then turn the ads on.
Free audit
We check what your current site and ads are sending to Google and Meta right now. You get the findings either way.
Sign the BAA
Before we touch anything that holds patient data.
Build and move hosting
The site and forms go onto AWS with the controls above in place.
Launch tracking and ads
Anonymous tracking first, then campaigns, so every dollar is measured from day one.
HIPAA Web Design & Marketing FAQs
Are you HIPAA certified?
No one is. HHS does not issue HIPAA certifications to agencies, software, or hosts. Any badge that says so is a red flag. What matters is a signed BAA and the safeguards behind it, which we show you in writing.
Do you sign a BAA?
Yes. We sign one with every healthcare client before any patient data moves into a site, form, or server we manage.
Can I still run Google and Meta ads?
Yes. The pixels stay off any page that reveals a condition or treatment, and the ad platforms only receive a generic lead event. Remarketing to people based on health is against Google and Meta policy anyway, so we never build it.
Does signing a BAA make us HIPAA compliant?
No, and anyone who says so is overselling. A BAA covers specific services. Your practice still needs its own risk analysis, staff training, and policies. We give you the technical documentation for our part so your risk analysis is easier.
What about our email, scheduling, and form tools?
Each one needs its own BAA or has to stay away from patient data. Our BAA only covers what we host. We check every tool on your site and tell you which ones are safe and which need to change.
Is Google Analytics HIPAA compliant?
Google will not sign a BAA for Google Analytics, so it should not see patient data. Our anonymous tracking replaces it for anything sensitive.
Where does our patient data live?
Either in your existing EHR or practice system, where our forms send it directly, or on HIPAA eligible AWS services under our BAA if we build the backend for you.
Is your regular $10 hosting HIPAA compliant?
No, and we will not pretend it is. HIPAA sites run on a separate AWS setup starting at $350 a month.
Does my med spa even fall under HIPAA?
Only if you bill insurance electronically. Many cash only spas do not. Florida privacy law and the FTC still apply to health data, so we build every healthcare site the same careful way.
Do I own everything?
Yes. Domain, code, ad accounts, and data are yours. No contract, and nothing held back if you leave.
Find out what your site is telling Google and Meta right now.
We will audit your current tracking for free, show you anything that is leaking, and send you our BAA. You decide from there.