Skip to content
When a practice website leaks patient data, HIPAA places the primary obligation on the practice as the covered entity, even if an agency or web vendor built the site. Vendors that handle protected health information (PHI) are business associates with direct duties of their own, and those duties sit alongside the practice’s own obligations.
Who is the covered entity, and who is a business associate?
The covered entity is the practice, when it is a provider that HHS describes as transmitting information electronically in a standard transaction, such as insurance billing. A business associate is a vendor that creates, receives, maintains, or transmits PHI on the practice’s behalf. The HHS Office for Civil Rights (OCR) bulletin on online tracking says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.”
OCR’s July 2025 settlement with a behavioral health provider began with a website exposure caused by a technical mistake: a coding error in a discontinued patient portal pilot left discharge summaries for 35 people publicly accessible online. The provider paid $225,000 and agreed to a two-year corrective action plan.
“An accurate and thorough HIPAA risk analysis can minimize the exposure of ePHI from both malicious actors and inadvertent errors.” Paula M. Stannard, Director of the HHS Office for Civil Rights, in that settlement announcement
What does a business associate agreement transfer to the vendor?
A business associate agreement (BAA) sets the vendor’s permitted uses of PHI and its duty to protect and report. It adds a second party with obligations, and the practice’s own obligations stay in place. OCR’s fact sheet on business associate liability lists what vendors answer for directly, including “Impermissible uses and disclosures of PHI” and “Failure to provide breach notification to a covered entity or another business associate.”
The practice still has to act on what it knows. Under 45 CFR 164.504(e)(1)(ii), a covered entity that knew of a pattern of a vendor’s material breach is out of compliance unless it took reasonable steps to cure it or, if those failed, ended the contract where feasible.
Beacon’s earlier post, What Is a Business Associate Agreement and When Do You Need One?, covers when a BAA is required.
Who notifies patients when a vendor causes the leak?
The practice notifies patients, because HHS’s Breach Notification Rule summary places that duty on covered entities. They notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. They also notify the Secretary, and prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Breaches affecting fewer than 500 people can be reported to the Secretary annually.
A business associate that has a breach must notify the covered entity without unreasonable delay and no later than 60 days from discovery. For a practice owner, the practical question is whether each website vendor would report a tracking problem quickly, and whether the contract says how fast.
What does this answer not cover?
This page describes how HIPAA divides responsibility between a practice, its agency, and its web vendors. It does not address who pays for a breach, whether a practice can recover costs from a vendor, or how insurance responds, which turn on contracts and state law.
This page also does not cover practices that are not HIPAA covered entities, substance use disorder programs under 42 CFR Part 2, or duties under FTC and state privacy laws, which can apply on separate terms. It does not assess any specific website or predict the outcome of any pending case. No vendor or tool makes a practice compliant; the obligation stays with the practice.
This page is general information about how HIPAA assigns responsibility for website data and what regulators have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Frequently asked questions
Is a web developer always a business associate?
Under HHS’s definition, a web developer is a business associate only if it creates, receives, maintains, or transmits PHI for the practice. A developer who builds a brochure site with no forms or tracking may not be. One who hosts intake forms or manages tags that capture patient information likely is.
Does a signed BAA protect the practice if the vendor makes a mistake?
A signed BAA gives the practice contractual promises and makes the vendor’s duties explicit. The practice’s obligations as covered entity remain, including breach notification to patients. Under 45 CFR 164.504(e), the practice must also act if it knows of a pattern of material breach by the vendor.
What should a practice ask its agency about website tracking?
Beacon’s working standard is to ask for a written list of every tag on the site, what each sends, and which pages it fires on. The agency should also confirm that tracking stays off booking, intake, and portal pages, exactly what reaches an ad platform and what is hashed or removed first, and which vendors have signed BAAs.
The case for treating these choices as the owner’s decision is made in The Tracking Code on Your Website Is a Legal Decision.
