Free Tool

HIPAA Website Audit

Paste a URL. We scan the public homepage for the most common HIPAA and state-privacy violations on medical practice websites — tracking pixels without a BAA, forms posting to non-compliant vendors, live chat leaks, missing privacy notices. PDF report in under a minute.

What we check

Tracking pixels (Meta, Google Ads, GA, TikTok, LinkedIn, Hotjar, FullStory) without a BAA.
Forms posting to Mailchimp, HubSpot, Typeform, Google Forms and other non-BAA vendors.
Live chat widgets (Drift, Intercom, Tawk, Zendesk) deployed on patient-facing pages.
Cookie consent — whether trackers fire before the visitor opts in.
Privacy policy and HIPAA Notice of Privacy Practices links.
Security response headers (CSP, Referrer-Policy, X-Frame-Options, HSTS).
TLS / HTTPS enforcement.
Third-party script and iframe inventory.

We scan the home page plus up to 5 internal pages we expect to be sensitive (contact, appointment, intake, patient forms). Authenticated portals and pages behind a login are out of scope for the free tool — those are part of a paid engagement.

Scanning… this usually takes 5–20 seconds.