What HIPAA and COPPA Actually Require for Your Pediatric Dental Website-And What They Don't

Most healthcare websites worry about HIPAA. Most child-focused websites worry about COPPA. Pediatric dental practices need to address both-and the overlap creates complexity that general compliance guides miss.

HIPAA's scope on your website: For a HIPAA-regulated practice, website data becomes PHI when individually identifiable health information is created, received, maintained, or transmitted by the covered entity or a business associate. That can include appointment requests mentioning symptoms, new patient forms asking about medical history, or contact messages describing a child's dental concerns. HIPAA safeguards apply to ePHI, and a BAA is required when a vendor creates, receives, maintains, or transmits PHI on the practice's behalf.

COPPA's scope on your website: COPPA applies when a site or service is directed to children under 13 or the operator has actual knowledge that it collects their personal information. Child-completed forms, contests, or gamified features can create that exposure; merely making a parent-facing practice site welcoming to families does not by itself establish COPPA coverage.

Where they intersect: A child-completed pre-appointment questionnaire can implicate both frameworks when each framework's scope is met: the practice handles PHI in its regulated role, and the site is child-directed or the operator has actual knowledge that it is collecting the child's personal information. The compliance approach must then satisfy both sets of requirements.

This content is educational and does not constitute legal advice. Consult with a healthcare compliance attorney and your state dental board for guidance specific to your practice.

HIPAA does not specifically regulate websites; it regulates how covered entities and business associates handle PHI. A website therefore falls within a regulated practice's HIPAA program when it creates, receives, maintains, or transmits PHI.

Contact and appointment forms: Forms that handle ePHI need appropriate technical and administrative safeguards. Modern transport encryption is necessary but not sufficient: the receiving email, CRM, or practice-management system, access controls, retention, and downstream disclosures also matter. A consumer Gmail account is not an appropriate destination for ePHI; an eligible service must be configured within the scope of an applicable BAA and used consistently with the practice's risk analysis.

Business Associate Agreements (BAAs): A third-party service requires a BAA when it creates, receives, maintains, or transmits PHI on the practice's behalf. Depending on actual data flows, this can include:

• Website hosting providers that maintain ePHI
• Form-processing or CRM services that receive ePHI
• Email or messaging platforms used to transmit ePHI
• Live-chat tools that receive patient information
• Analytics or other vendors only when their role lawfully involves PHI; a BAA does not make an otherwise prohibited disclosure permissible

Access controls: Limit who can access PHI collected through your website. Document who has access, why, and review permissions regularly.

Breach notification procedures: Have a documented plan for what happens if your website or a connected service is compromised. Applicable HIPAA and state notification rules impose specific assessment and timing duties.

Privacy practices notice: Your website should link to your Notice of Privacy Practices, though the full HIPAA notice requirements apply to your practice overall, not just the website.

COPPA (Children's Online Privacy Protection Act) applies when a website or online service is directed to children under 13 or has actual knowledge that it's collecting personal information from children under 13. Pediatric dental websites often fall into gray areas.

What triggers COPPA:

• Interactive features designed for children (games, quizzes, virtual tours "for kids")
• Forms that children fill out directly (rather than parents filling out on their behalf)
• Content and design clearly targeting child users
• Collecting information like names, email addresses, or photos from children

What COPPA requires when triggered:

• verifiable parental consent before collecting any personal information from children
• A clear, comprehensive privacy policy describing what information you collect from children and how it's used
• Parental access to review and delete their child's information
• Data minimization-collect only what's necessary
• Reasonable security measures for children's data

The practical solution for most practices: Design your website so that parents-not children-submit all forms and interact with all data-collecting features. Make intake forms clearly addressed to parents/guardians. Avoid gamified elements that invite direct child interaction. This approach can reduce COPPA exposure when the site is not directed to children and the operator does not have actual knowledge that a child is submitting personal information, while still creating a welcoming, family-friendly site.

FTC enforcement of COPPA has resulted in significant penalties. When in doubt, consult with a privacy attorney familiar with children's online privacy requirements.

Most compliance violations are not obvious. They hide in third-party integrations, default settings, and features added without evaluating regulatory implications.

Analytics and tracking pixels: Google Analytics does not offer a HIPAA BAA and must not receive PHI. IP anonymization alone does not resolve disclosures created by page context, events, URLs, identifiers, or other data. A regulated practice should map each tag and data flow, keep Analytics off HIPAA-covered pages, and prevent PHI from reaching Google or advertising platforms.

Live chat and chatbots: If a tool creates, receives, maintains, or transmits PHI on the practice's behalf, the vendor is a business associate and an appropriate BAA and safeguards are required. Encryption alone does not make an otherwise unsuitable chat tool compliant.

Third-party review widgets: Embedding a patient-authored public review does not by itself establish that the practice disclosed PHI. The practice can still create a disclosure by confirming the reviewer is a patient, revealing treatment details in a response, or republishing a testimonial without the authorization required for its own marketing use.

Photo galleries and testimonials: A HIPAA-regulated practice's marketing use or disclosure of identifiable patient photos generally requires a valid HIPAA authorization. For a minor, the authorization must come from the person legally authorized to act for the child under HIPAA and applicable state law.

Email marketing integration: An email vendor requires a BAA when it creates, receives, maintains, or transmits PHI on the practice's behalf. A message discussing a health topic is not automatically PHI; assess the sender, recipient, identifiers, context, and data flow, and do not send PHI through a platform that lacks the required agreement and safeguards.

Social media login: Avoid "login with Facebook" or similar features for any patient-facing functionality. These create unnecessary data sharing with third parties.

Use this framework to evaluate your current website. Each item represents a potential compliance gap:

Technical security:

• SSL certificate installed and forcing HTTPS on all pages
• Modern TLS for encrypted connections
• Form data protected in transit and through every downstream system
• Hosting controls documented in the practice's risk analysis

Business Associate Agreements:

• Determine whether the hosting provider creates, receives, maintains, or transmits ePHI on the practice's behalf; execute a BAA if it does
• Apply the same PHI-role test to form, CRM, chat, messaging, and email vendors
• Document the permitted PHI flows and safeguards covered by each applicable BAA
• Do not send PHI to Google Analytics; it does not offer a HIPAA BAA

Privacy documentation:

• HIPAA Notice of Privacy Practices linked from website
• Website privacy policy addressing data collection practices
• COPPA disclosures and verifiable parental consent when the site is child-directed or the operator has actual knowledge it collects personal information from children under 13
• Cookie consent mechanism for visitors from jurisdictions where it is required

Form and feature design:

• All intake forms addressed to parents/guardians, not children
• No gamified features inviting direct child data submission without a COPPA analysis
• Photo/video content has documented authorization when required
• Testimonials have the consent or authorization required for the practice's use and comply with advertising rules

Vendor review:

• Inventory of all third-party tools with website access
• Documentation of which tools touch PHI
• Periodic review of vendor role, agreement, configuration, and data flow

For practices implementing SEO alongside compliance, see our guide on HIPAA-compliant SEO for pediatric dental practices for strategies that improve visibility without creating regulatory exposure.

Beyond federal HIPAA and COPPA requirements, state dental boards regulate how dental practices advertise-and your website is advertising. Rules vary significantly by state, but common requirements include:

Credential representation: How you list specialties, certifications, and qualifications must comply with state-specific rules. Some states prohibit using "specialist" unless you hold specific board certifications. Pediatric dentistry has defined specialty credentials, but how you communicate them online matters.

Testimonial restrictions: Some states limit or prohibit patient testimonials in dental advertising. Others require specific disclaimers. Before adding a reviews section or video testimonials, verify your state's current rules.

Before-and-after photos: State rules can impose specific requirements for clinical photography. Separately, if an atypical result could imply performance consumers generally can expect, FTC guidance calls for a clear disclosure of the generally expected performance; a generic “results vary” disclaimer may be insufficient.

Fee advertising: Rules about advertising prices, "free" services, and comparative pricing claims vary by jurisdiction.

Required disclosures: Some states require specific information (license numbers, office addresses, etc.) to appear on practice websites.

How to stay current: State dental board rules change. Bookmark your state board's advertising regulations page and review annually. If you practice in multiple states or near state borders (serving patients from neighboring jurisdictions), you may need to comply with multiple sets of rules.

Verify current advertising regulations with your state dental board. Rules change, and this general guidance may not reflect your jurisdiction's current requirements.