Louisville Web LabLouisville Web Lab

    Compliance

    HIPAA & ADA compliance in every website we build

    Healthcare marketing has two non-negotiables: patient information stays protected, and everyone can use your website. We build to both from day one, not as a bolt-on.

    Book a Diagnostic CallHealthcare Practice Hub

    HIPAA-aware builds

    No PHI in analytics, encrypted transport, BAA-ready vendors.

    WCAG 2.1 AA

    Keyboard nav, contrast, focus states, screen-reader labels.

    Protected Information

    How we handle patient information

    A marketing website should not be a place patients type in symptoms, diagnoses, or medication lists. We build for that reality.

    What we do

    • Strip PHI from every analytics event and ad conversion.
    • Encrypt every form submission in transit (TLS) and at rest.
    • Route intake to BAA-covered vendors when clinical data is involved.
    • Scope CRM tags and audience lists so PHI never enters a marketing pixel.
    • Log access, honor deletion requests, and keep retention windows short.

    What we do not do

    • No chatbots that ask patients to describe symptoms.
    • No PHI in retargeting audiences, custom audiences, or lookalikes.
    • No unencrypted intake forms, no plain-text email of patient data.
    • No EHR access, no clinical records, no telehealth video.
    • No standalone BAA for a marketing-only engagement.

    Accessibility

    WCAG 2.1 AA on every page we ship

    Accessibility is a launch checklist, not a plugin. Every page is reviewed against the same standard before it goes live.

    • Color contrast that meets or beats 4.5:1 for body text.
    • Full keyboard-only navigation, no keyboard traps.
    • Visible focus states on every interactive element.
    • Descriptive alt text on informative images, empty alt on decoration.
    • Semantic HTML: proper headings, landmarks, and lists.
    • Screen-reader labels on every form field and icon-only button.
    • Reduced-motion preference respected sitewide.
    • Skip-to-content link and consistent navigation on every route.

    What This Means For Your Practice

    Three things you get out of this

    Patient trust

    A site that visibly respects patient data and works for every visitor sends the right signal before the first appointment.

    ADA claim protection

    A documented WCAG 2.1 AA build closes the most common issues that drive demand letters and gives you a defensible standard.

    Audit-ready

    When your compliance officer, attorney, or BAA partner asks how the marketing site handles data, we hand you the answers.

    What we cannot do for you

    We are a marketing agency, not a law firm or a compliance consultancy. We do not give legal opinions, we do not sign a BAA for a marketing-only build, and we do not touch clinical systems. When your project needs any of those, we tell you and point you to the right partner.

    FAQ

    Compliance questions we get from practice owners

    We build websites and marketing systems in a HIPAA-aware way. That means our forms, analytics, CRM, and SMS setups are configured so they do not collect or transmit protected health information (PHI) at the marketing layer. We are not a covered entity or business associate for clinical records. For any workflow that would touch PHI (like intake forms or patient portals), we route data through vendors that will sign a BAA and we scope the setup with your practice ahead of time.

    We do not sign a standalone BAA for a marketing-only engagement, because a marketing site should not be storing PHI in the first place. If your build includes a workflow that will touch PHI (for example, an authenticated patient intake connected to your EHR), we will spec the vendor stack, connect BAA-covered tools, and put the BAA in place with the correct party before that workflow goes live.

    We build to WCAG 2.1 Level AA. That means keyboard-only navigation on every interactive element, sufficient color contrast, visible focus states, alt text on informative images, semantic HTML, screen-reader labels on form fields, and respect for the user's reduced-motion preference. Every new page we ship is reviewed against this checklist before launch.

    No website can promise total lawsuit immunity, and we are not attorneys. What a WCAG 2.1 AA build does is close the most common issues that drive demand letters: missing alt text, unlabeled forms, poor contrast, keyboard traps, and inaccessible dialogs. It also gives you a documented, defensible standard to point to if a claim ever arrives.

    We do not handle EHR integrations, patient portals with clinical records, or telehealth video. We do not use PHI in ad targeting, retargeting audiences, or CRM tags. We do not run chatbots that ask patients to describe symptoms. And we do not provide legal or compliance opinions — those come from your attorney or compliance officer.

    Written and reviewed by Dustin Hobbs, Founder of Louisville Web Lab. Last updated: July 8, 2026.

    Ready for a website that is both trusted and usable?

    Book a 20-minute diagnostic call. We will walk through your current setup and flag the compliance and accessibility gaps before they cost you a patient.

    Book a Diagnostic Call

    The Louisville Practice Growth Brief

    One short email a month: what is working in patient acquisition for private practices. No pitch, unsubscribe anytime.

    Email is required.

    Book a Diagnostic Call