HIPAA Compliant Dental Website Design
We scanned 1,631 dental practice websites. 88.3% produced at least one finding and 11.2% came back clean. What that means for how a dental site should be built, and why it does not stay built.
Most dental website design is sold on how the site looks and how many new patients it will bring. Both matter. Neither is what this article is about.
This is about the part of a dental site that handles patient information, which is usually built last, by whoever was cheapest, and never looked at again.
What the scan data says about dental
In July 2026 we scanned 4,601 independent healthcare practice websites across seven specialties. Dental was by far the largest group, at 1,631 sites.
88.3% of dental practice websites produced at least one finding. 11.2% came back with nothing to report. Trackers are the most discussed problem and they are not the only one: 46.0% had a third-party tracker firing on a page that carries a patient form, and the rest of the failures were forms served by companies that will not sign, or data paths that could not be confirmed at all.
| Specialty | Sites | Any finding | Tracker on a form page | Clean |
|---|---|---|---|---|
| Med spa | 855 | 89.5% | 43.7% | 8.8% |
| Oral surgery | 111 | 89.2% | 52.3% | 8.1% |
| Dental | 1,631 | 88.3% | 46.0% | 11.2% |
| Chiropractic | 715 | 88.0% | 45.6% | 10.2% |
| Optometry | 537 | 87.9% | 47.9% | 11.2% |
| Physical therapy | 579 | 86.2% | 38.2% | 12.1% |
| Dermatology | 173 | 84.4% | 46.8% | 13.3% |
Dental sits mid-table, and we would rather show you that than pretend otherwise. Five points separate the best specialty from the worst. We went looking for the specialty with a problem and did not find one, which is more useful than a league table would have been.
What makes dental worth its own article is not that it is the worst. It is that it is the most heavily marketed specialty in the set, and marketing is how the tags get there. More agencies, more campaigns, more conversion tracking, and more tags added to pages over a decade by people measuring form submissions rather than thinking about what was in them.
The tracking is a side effect of doing marketing seriously, which is why the practices that invest most in growth tend to have the most of it.
What a dental site actually collects
Four things, usually:
The appointment request. Name, phone, and a reason. "Chipped tooth," "cleaning overdue," "emergency, in a lot of pain." That last one is health information the moment it is typed.
New patient intake. Medical history, medications, allergies. Unambiguous.
The open message box on the contact page, which collects whatever the patient decides to tell you and cannot be predicted in advance.
The scheduler, if it captures a visit reason.
Each of those needs a path where every company that touches it has signed for it. The site design does not change that, but the site design determines where those forms live.
What we see on dental sites specifically
Forms on the hosting rather than beside it. A form built into the website builder, submissions stored by the builder or emailed onward. Whoever hosts the site is now handling patient information, and in our scan 39.0% of practices overall were on a host whose published position is that it will not sign a BAA.
Marketing tags on the intake page. Conversion tracking is usually placed on the page that indicates a conversion, which is the form page. Sensible from a marketing standpoint, and it puts the tag exactly where the patient is typing.
Session recording. Less common but the most serious when present. Tools that replay what a visitor did on a page, including keystrokes, were on 5.4% of the sites we scanned.
A form tool on a plan that is not covered. Several popular products sign BAAs only on higher tiers. The practice reads the vendor's HIPAA page, which is accurate, and is not covered by any of it.
How the site should be built instead
Keep patient data off the website. The strongest structural choice available. The marketing site holds no patient information at any point; forms post to a separate system that is built for it. Then the website is just a website, and a problem with it is a marketing problem rather than a breach.
One accountable chain. Every company between the patient and the stored submission has signed something, and somebody can show you the whole chain on request. If nobody can draw it, it does not exist.
Marketing that measures without collecting. You can know how many people submitted a form without a third party watching them fill it in. This is the part practices assume they have to give up and do not.
Ownership that survives your agency. Your domain, your content, your ability to leave. Unrelated to HIPAA, and the thing that causes the most pain when a relationship ends.
Why a dental site does not stay fixed
Almost none of the 1,631 dental sites we scanned launched broken. They launched fine, and then a year of ordinary practice growth happened.
A new associate joined, so a new bio page went up with a booking form copied from the old one. The marketing agency ran an implant campaign and added a conversion tag to the appointment page, which is where a competent agency puts a conversion tag. The front desk started using a scheduling tool that was easier than the old one and nobody re-asked whether it signs a BAA. Somebody turned on call tracking. The site got a refresh and the new theme loaded its own analytics.
Every one of those is a practice doing well and a vendor doing their job. None of them looks like a compliance event to anyone in the building. And each one moves a dental practice out of the 11.2% and into the 88.3%.
This is why "we had it built properly" and "it is currently proper" are different statements, and why the second one has a date attached. A dental site is not a document you file. It is a surface that several people edit, indefinitely.
What to ask a dental web designer, and what we answer
Five questions, and you can ask them before signing anything. We have put our own answers next to them, because a list of questions we do not answer ourselves is not much use to you.
1. Where do form submissions go, and who stores them? Ours never touch the marketing site. Patient information goes directly to a covered path we operate, so there is no copy sitting on the website's host, in a plugin table, or in an inbox.
2. Will you sign a BAA, and does it cover the form path specifically? Yes, and yes. The form path is the part it exists to cover.
3. What third-party scripts will be on the page where patients type? None that can see what is typed. You still get your marketing measurement, including conversion data for campaigns, through a setup that reports the conversion without a third party watching the patient.
4. If we part company, what do I keep? Your domain, your content, your patient data, and your ad accounts. The compliance platform is the part that does not travel, because it is a service rather than a file.
5. Who checks that answers one through four are still true next year? This is the question that separates a build from a plan, and most agencies have no answer to it because it is not what they sold you. Ours is that the site is rescanned on a schedule and the vendor chain is rechecked, which is a subscription rather than a project because the work never actually stops.
An agency that builds dental sites regularly will answer the first four immediately. Very few will have anything at all for the fifth.
Where your site stands today
Our scan reports what is loading on your pages, which of it sits alongside a patient form, and whether the companies behind your forms and hosting will sign for what they receive. It takes under a minute and needs nothing from you but the address.
If you are in the 88.3%, it will say so. If you are in the 11.2%, it will say that too.
And if you already know what it will say, our Managed Plan is the build and the fifth answer together: the site, the hosting, the form path, the agreements and the monitoring as one relationship, priced up front.