HIPAA Compliance for Your Wix Site

1. Click the dropdown and select Get a copy of their data.

2. Click Continue.

3. Verify that the email or phone number belongs to the customer who made the request:

   1. Enter their phone number.

   2. Enter their email address.

      Important: Make sure to enter the email address exactly as it is saved in your contact list.

4. Click Submit Request.

1. Click the dropdown and select Delete their data.

2. Click Continue.

3. Verify that the email or phone number belongs to the customer who made the request:

   1. Enter their phone number.

   2. Enter their email address.

4. Click Submit Request.

5. Click Submit to confirm the deletion.

PHI protection can only be activated for upgraded Wix sites. If you cancel your supported Premium or Studio site plan, your clients’ data will continue to be protected under HIPAA standards for 30 days. During this period your site remains HIPAA active and data requests may still be made.

After 30 days, the data falls back within normal Wix security protocols. This means your site will no longer be HIPAA-compliant.

HIPAA-compliant Wix apps can be found in a dedicated page in the Wix App Market. Once you activate PHI protection, non-compliant Wix apps are automatically hidden from your App Market searches.

You can activate PHI protection on your site even if non-compliant Wix apps are installed. However, this may cause certain flows or functionalities within those apps to break. For this reason, we recommend removing any non-compliant apps before activating PHI protection on your site.

You are responsible for making sure any third-party app you connect to your site meets HIPAA requirements. Always confirm compliance directly with third-party providers before you install their apps. Wix cannot guarantee HIPAA compliance for apps or services we do not control.

To help inform your app choices, all apps which collect personally identifiable information (PII) are labeled as such within the Wix App Market.

Note: We may update the list of Wix's HIPAA-compliant apps over time.

Yes. Where applicable, HIPAA compliance from Wix also meets the international healthcare information security standard of ISO 27799.

ISO 27799 helps healthcare providers meet the strict data protection requirements of the General Data Protection Regulation (GDPR).

Collaborators with access to your HIPAA-compliant site may have access to PHI data. As such, we recommend that you only give collaborators permissions that are strictly necessary to their role, and to remove those permissions as soon as the collaboration is no longer required.

When you activate PHI protection for your Wix site, only HIPAA-compliant communication tools are available to connect to your Wix Inbox Channels.

If you have non-compliant channels, such as Facebook and Instagram, already connected, you’ll be prompted to disconnect them.

Message history from non-compliant channels are still viewable, but you’ll no longer be able to initiate a conversation through Wix Inbox for these channels.

Go to your channels page to view which communications channels are HIPAA-compliant. All channels are marked as compliant or not, as appropriate.

Note: Upon creating your site, we provide a generic email address generated by Wix (e.g. e88...619f@ascend.wix.com) to help manage communications with your site.

HIPAA users are provided with a HIPAA-compliant generic email. Once you connect your own business email (e.g. Gmail), your preset email is no longer in use.

If your site has PHI protection activated, the site may still be transferred. The new owner requires a Business Associate Agreement (BAA), and must sign a new BAA contract. The previous contract is no longer valid following transfer to a new site owner.

When you activate PHI protection for your Wix site, extra steps are taken to ensure the anonymity of your site visitors.

Among those steps is the hiding of visitor data that might be directly or indirectly used to identify that visitor. This includes personal information such as a name or location. As such, you lose analytic data that might previously have been available to you.

If you disable PHI protection, visitor data will be available once again. However, historical data from the protected period remains unavailable.

No. If your site is HIPAA-compliant, be aware that adding a note to a booking may contravene HIPAA regulations, as the note may relate to personal health information.

However, you can add notes to client profiles on the contact list and remain HIPAA-compliant.

No. Currently, PHI protection can only be activated from the desktop version of your Wix site.

If your site has old Wix Forms, your PII and PHI data may not be as securely handled as the latest version.

It is not currently possible to switch an existing form built with old Wix Forms to new Wix Forms. Delete the form built using old forms and recreate the form with new forms features.

Yes. If, for any reason, you need to deactivate PHI protection, you can do so.

1. Log in to your Wix account on desktop.

2. Go to HIPAA Compliance in the Compliance, Privacy & Cookies page of your site's dashboard.

3. Click the Manage next to PHI protection.

4. Click Deactivate PHI Protection.

5. Choose an action:

   • Deactivate Now: PHI protection is immediately deactivated on your Wix site.

   • Deactivate After 30 Days: Your site remains PHI protected for an additional 30 days, during which you may export or delete sensitive data, if necessary.

Yes, you can use Wix Invoices to secure your client's information by sending invoices protected by an access code.

To share an invoice and access code:

1. Go to Invoices in your site's dashboard.

2. Click the More Actions icon

   

   next to the relevant invoice.

3. Click Share link & access code.

   

4. Click Copy Message to copy both the link and access code to send to your client.

5. Send the invoice details to your client.