Squarespace and Wix Will Never Be HIPAA-Compliant. Here's Why.

If you’re a therapist, dentist, or med spa owner considering Squarespace or Wix for your practice website, there’s a compliance problem you need to understand before you start building.

Neither Squarespace nor Wix signs Business Associate Agreements. Neither offers HIPAA-compliant form handling. Neither provides BAA-covered hosting. And neither gives you the ability to implement the technical safeguards HIPAA requires for handling Protected Health Information.

This isn’t a limitation they’re planning to fix. It’s a fundamental architectural constraint of how template platforms work.

The Four Compliance Gaps

1. No Business Associate Agreement

HIPAA requires a BAA between your practice and any vendor that may access PHI on your behalf. Squarespace and Wix explicitly do not sign BAAs. If patient data touches their servers — through a contact form, scheduling request, or intake form — you have an impermissible disclosure to a vendor without a BAA.

Regulation: 45 CFR § 164.308(b)(1) and 45 CFR § 164.502(e).

2. No Encrypted Form Handling

Standard forms on template platforms transmit data without end-to-end encryption designed for PHI. While HTTPS provides transport-layer encryption, HIPAA requires that the form submission system itself is designed for PHI handling — including encryption at rest, access controls, and audit logging. Template form builders aren’t built for this.

3. Shared Hosting Infrastructure

Template platforms host your site on shared infrastructure alongside thousands of other websites. You have no control over the server environment, no ability to implement server-level encryption, and no BAA covering the hosting itself. HIPAA requires that you know where PHI is stored and that the storage environment meets security requirements.

4. Default Google Analytics Integration

Both Squarespace and Wix make it easy to add Google Analytics — and many practice owners do so without realizing the HIPAA implications. As the FTC and HHS warned in their July 2023 joint letter to 130 hospital systems, Google Analytics on healthcare websites can create impermissible PHI disclosures.

Source: FTC.gov, July 20, 2023

“But I Only Need a Simple Website”

This is the most common response we hear, and it’s worth addressing directly.

If your website is truly informational only — no contact forms, no scheduling, no intake forms, no chat widgets, no patient portal links — then HIPAA compliance requirements are minimal, and a template platform could work.

But almost no practice operates this way. At minimum, you need a contact form where patients can reach you, and many practices need online scheduling, intake forms, and treatment-specific landing pages. The moment you add any of these features on a template platform, you’re creating compliance exposure.

The Compliant Alternative: Public/PHI Zone Separation

The architecture we use for every healthcare practice website is built around a hard separation between two zones:

• Public Zone — your marketing website. Static content, fast-loading, optimized for search engines. No PHI ever touches this system. Hosted on a standard CDN for maximum speed.
• PHI Zone — all patient interactions route through purpose-built, BAA-covered platforms (SimplePractice, Dentrix, IntakeQ, JotForm HIPAA, etc.). These systems have their own BAAs, encryption, access controls, and audit logging.

The marketing site links to the PHI zone but never stores or processes patient data itself. This means your website loads fast, ranks well in search engines, and stays fully compliant — because there’s nothing to be compliant about on the marketing side.