Summary

Penalties range from $100 to $50,000 per violation, with annual caps up to $1.9 million per violation category. Willful neglect violations carry mandatory penalties. Beyond fines, violations can result in reputational damage, loss of business partnerships, and civil lawsuits from affected individuals.

HIPAA Checklist for Ecommerce: What Online Retailers Need to Know

Most ecommerce businesses assume HIPAA doesn’t apply to them. After all, you’re selling products online — not running a hospital or medical practice. But the reality is more nuanced, and getting it wrong can expose your business to significant regulatory risk and financial penalties.

This guide breaks down exactly when HIPAA applies to ecommerce operations, what your obligations are, and provides a practical HIPAA checklist you can start using today.

Does HIPAA Apply to Your Ecommerce Business?

HIPAA (the Health Insurance Portability and Accountability Act) applies to covered entities and their business associates. For ecommerce, the trigger is usually one of the following scenarios:

You sell health-related products and collect Protected Health Information (PHI) during checkout or account creation
You operate a health and wellness marketplace or pharmacy
You process insurance claims or work with health plans on behalf of customers
You use third-party vendors (email platforms, analytics tools, CRMs) that handle PHI on your behalf
You offer subscription services tied to medical devices or telehealth

If any of these apply to your business model, HIPAA compliance isn’t optional — it’s legally required.

What Counts as Protected Health Information (PHI) in Ecommerce?

PHI is any individually identifiable health information. In an ecommerce context, this can include:

Prescription information collected at checkout
Medical conditions disclosed during product customization (e.g., custom orthotics, hearing aids)
Insurance information used for billing
Health history collected for supplement or diet recommendations
Diagnostic data from connected health devices

Even partial information — a name combined with a medical condition — can constitute PHI and trigger HIPAA obligations.

The HIPAA Checklist for Ecommerce Businesses

Use this checklist to assess your current compliance posture and identify gaps that need immediate attention.

1. Determine If You’re a Covered Entity or Business Associate

[ ] Identify whether your business qualifies as a covered entity (health plan, healthcare clearinghouse, or healthcare provider)
[ ] Determine if you function as a business associate to a covered entity
[ ] Document your determination with a written analysis
[ ] Review your contracts with clients and vendors to identify HIPAA-related obligations

2. Conduct a Risk Assessment

[ ] Identify all systems and processes that create, receive, maintain, or transmit PHI
[ ] Document potential threats and vulnerabilities to PHI
[ ] Assess the likelihood and impact of each identified risk
[ ] Implement security measures to reduce risks to a reasonable level
[ ] Review and update your risk assessment annually or after significant changes

3. Implement Required Administrative Safeguards

[ ] Designate a HIPAA Privacy Officer and Security Officer
[ ] Develop and implement written HIPAA policies and procedures
[ ] Train all employees who handle PHI on HIPAA requirements
[ ] Establish a process for managing workforce access to PHI
[ ] Create and test a contingency plan for PHI systems
[ ] Conduct periodic internal audits of HIPAA compliance

4. Put Technical Safeguards in Place

[ ] Implement unique user identification for all systems containing PHI
[ ] Enable automatic logoff for workstations accessing PHI
[ ] Encrypt PHI at rest and in transit (TLS 1.2 or higher for data in transit)
[ ] Implement audit controls to record access to PHI
[ ] Use multi-factor authentication for systems containing PHI
[ ] Regularly patch and update software used to store or process PHI

5. Establish Physical Safeguards

[ ] Control physical access to facilities and workstations where PHI is accessed
[ ] Implement workstation use policies for employees handling PHI
[ ] Establish device and media controls (disposal, reuse, and accountability)
[ ] Ensure servers and hardware containing PHI are physically secured

6. Execute Business Associate Agreements (BAAs)

[ ] Identify all third-party vendors that access, process, or store PHI on your behalf
[ ] Execute signed BAAs with every qualifying vendor before sharing PHI
[ ] Review BAAs annually and update when vendor relationships change
[ ] Common ecommerce vendors requiring BAAs include:
- Email marketing platforms (if they receive PHI)
- CRM systems storing customer health data
- Cloud hosting providers
- Payment processors handling health-related billing
- Analytics and customer data platforms

7. Create and Publish a HIPAA-Compliant Privacy Notice

[ ] Draft a Notice of Privacy Practices (NPP) that explains how you use and disclose PHI
[ ] Post the NPP prominently on your website
[ ] Provide the NPP to customers at the point of first service
[ ] Update the NPP whenever your privacy practices change
[ ] Obtain written acknowledgment from customers that they received the NPP

8. Establish Breach Notification Procedures

[ ] Define what constitutes a breach of PHI under HIPAA rules
[ ] Create an internal breach response plan with clear roles and timelines
[ ] Establish procedures to notify affected individuals within 60 days of discovering a breach
[ ] Develop a process to notify the Department of Health and Human Services (HHS)
[ ] For breaches affecting 500+ individuals in a state, establish media notification procedures
[ ] Document all breaches and your response actions

9. Manage Patient Rights

[ ] Establish a process for customers to request access to their PHI
[ ] Create procedures to fulfill PHI amendment requests
[ ] Implement a system to track and honor PHI disclosure restrictions
[ ] Provide an accounting of disclosures upon request
[ ] Respond to all PHI-related requests within required timeframes (typically 30 days)

10. Maintain Ongoing Documentation

[ ] Retain HIPAA policies and procedures for a minimum of 6 years
[ ] Document all training sessions, including dates and attendees
[ ] Keep records of all risk assessments and remediation actions
[ ] Maintain logs of BAAs and vendor compliance reviews
[ ] Store breach documentation and response records

Common HIPAA Mistakes Ecommerce Businesses Make

Understanding where other businesses go wrong helps you avoid the same pitfalls.

Using standard email for PHI. Platforms like Gmail and standard Outlook are not HIPAA-compliant without additional configuration and a signed BAA with the provider.

Assuming a privacy policy is enough. A general website privacy policy does not satisfy HIPAA’s Notice of Privacy Practices requirements.

Skipping BAAs with SaaS tools. Many ecommerce platforms use dozens of integrated tools. Each one that touches PHI needs a signed BAA — no exceptions.

Failing to train staff. HIPAA training isn’t a one-time event. It must be ongoing and documented, especially when policies change or new employees join.

Neglecting mobile and app security. If your ecommerce app collects health data, it falls under the same HIPAA rules as your website and backend systems.

FAQ: HIPAA and Ecommerce

Is my ecommerce store automatically subject to HIPAA?

Not automatically. HIPAA applies when your business qualifies as a covered entity or business associate. If you collect or process PHI — such as prescription data, health conditions, or insurance information — then yes, HIPAA likely applies. If you sell general consumer goods with no health data involved, HIPAA probably does not apply.

What happens if my ecommerce business violates HIPAA?

Do I need a BAA with my ecommerce platform (Shopify, WooCommerce, etc.)?

It depends on whether PHI flows through the platform. Shopify, for example, does not sign BAAs and is generally not considered HIPAA-compliant for storing PHI. If your platform handles PHI, you need either a HIPAA-compliant alternative or a separate compliant layer for health data storage.

How often should I update my HIPAA policies?

At minimum, review your HIPAA policies annually. You should also update them whenever there are significant changes to your business operations, technology infrastructure, applicable regulations, or after any security incident or breach.

Can I use Google Analytics on a HIPAA-covered ecommerce site?

Standard Google Analytics is not HIPAA-compliant and should not be used on pages where PHI is collected or displayed. You would need a HIPAA-compliant analytics solution or configure your implementation to ensure PHI is never captured by the tool.

Start Your HIPAA Compliance Journey the Right Way

Working through HIPAA compliance from scratch is time-consuming, complex, and easy to get wrong. Missing a single element — an unsigned BAA, an outdated policy, or an undocumented risk assessment — can leave your business exposed to serious penalties.

Our ready-to-use HIPAA compliance template bundle gives you everything you need in one place, including:

Complete HIPAA Privacy and Security policies
Risk assessment worksheet
Business Associate Agreement templates
Notice of Privacy Practices template
Employee training acknowledgment forms
Breach notification response plan
Ongoing compliance audit checklist

These templates are written by compliance professionals, formatted for immediate use, and designed to be customized for your specific ecommerce business. Stop starting from a blank page and start with a proven framework.

[Download the HIPAA Compliance Template Bundle →] and get your ecommerce business compliant with confidence.