A small independent dental office came to us with a site built and maintained by a family friend — a setup common across the specialty. The site looked fine. Underneath, it was a compliance liability waiting to happen. Here's what we found and what we rebuilt.
We never publish the names of clinics we work with — our clients came to us because their site exposed patients, and naming them would defeat the purpose of the engagement. Every identifying detail on this page is either removed or generalized. Technical and regulatory facts are accurate. Read our case-study confidentiality policy.
Nothing about the site was unusual — which is exactly the problem. This is what a typical small healthcare website in 2025 actually looks like under the hood.
Tracking visitors across service pages that described specific procedures — the exact pattern OCR has been fining since the 2022 tracker guidance.
The host had unrestricted access to every form submission and every database row. No Business Associate Agreement was ever signed.
Patient name, phone, and reason-for-visit submitted through a non-HIPAA form service and delivered by plain email.
Full CMS admin access from a personal laptop. No 2FA, no access log, no documented handoff procedure.
Only a generic template privacy page. MHMDA requires a dedicated, separate notice — and the site didn't have one.
Referral-source and patient-name query parameters appearing in URLs, then forwarded to analytics and ad pixels.
The goal wasn't a redesign. The site stayed visually the same. Every piece of infrastructure underneath it changed.
Washington's Consumer Health Data law isn't a one-time fix. A site can be audit-clean today and non-compliant next quarter because a new tracker shipped with a plugin update. This is what the monthly plan actually does for this client.
Hosting, forms, analytics, email — every vendor that could touch PHI has a signed BAA on file.
Consent flow, deletion request handling, and Consumer Health Data Privacy Policy operational and maintained.
Every tracking script and embed passes a monthly review. Nothing new reaches the site without a BAA check.
The practice owner stopped being the person personally accountable for a web infrastructure they never signed up to manage.
What this looks like from the patient's side: nothing changed. The site looks the same. The difference is that every form, tracker, and cookie on that page has a BAA — or doesn't exist at all.
Get a free audit and find out which of these violations are on your site right now. No commitment — just a prioritized PDF you can act on.
Request Free Audit