WordPress Security for Healthcare Sites

Healthcare websites handle some of the most sensitive data on the internet—patient health information (PHI). WordPress can power healthcare sites effectively, but requires strict security measures to protect patient data and comply with regulations like HIPAA.

Understanding HIPAA Requirements

The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting patient health information:

• Access controls - Limit who can view PHI
• Audit trails - Log all access to patient data
• Encryption - Protect data at rest and in transit
• Physical security - Secure server infrastructure
• Risk assessments - Regular security evaluations

WordPress Security for Healthcare

1. SSL/TLS Encryption

All healthcare sites must use HTTPS. This encrypts data in transit between the user's browser and your server.

// Force HTTPS in WordPress
define('FORCE_SSL_ADMIN', true);

// Redirect HTTP to HTTPS in .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

2. Access Control Implementation

Implement role-based access control to limit PHI access:

// Restrict PHI access by role
function restrict_phi_access($query) {
    if (!is_admin() || !is_user_logged_in()) {
        return $query;
    }

    $user = wp_get_current_user();
    $phi_roles = array('administrator', 'physician', 'nurse');

    if (!array_intersect($phi_roles, $user->roles)) {
        // Exclude PHI posts for unauthorized roles
        $query->set('post__not_in', get_phi_post_ids());
    }

    return $query;
}
add_action('pre_get_posts', 'restrict_phi_access');

3. Audit Logging

HIPAA requires logging all access to patient information:

// Log PHI access
function log_phi_access($post_id, $post) {
    if (!is_phi_content($post_id)) {
        return;
    }

    global $wpdb;
    $wpdb->insert(
        $wpdb->prefix . 'phi_access_log',
        array(
            'user_id' => get_current_user_id(),
            'post_id' => $post_id,
            'action' => 'view',
            'ip_address' => wpfs_get_client_ip(),
            'timestamp' => current_time('mysql'),
            'user_agent' => sanitize_text_field($_SERVER['HTTP_USER_AGENT'])
        ),
        array('%d', '%d', '%s', '%s', '%s', '%s')
    );
}
add_action('the_post', 'log_phi_access', 10, 2);

4. Session Security

Implement strict session controls for healthcare staff:

// Auto-logout after inactivity
function healthcare_session_timeout() {
    $timeout = 15 * MINUTE_IN_SECONDS; // 15 minutes

    if (isset($_SESSION['last_activity'])) {
        if (time() - $_SESSION['last_activity'] > $timeout) {
            wp_logout();
            wp_redirect(wp_login_url() . '?timeout=1');
            exit;
        }
    }
    $_SESSION['last_activity'] = time();
}
add_action('init', 'healthcare_session_timeout');

Healthcare-Specific Security Measures

Secure Patient Forms

• Use encrypted form submissions
• Never send PHI via email
• Implement secure patient portals
• Use secure file upload for medical documents

Database Encryption

Encrypt sensitive fields in the database:

// Encrypt before storing
$encrypted_ssn = openssl_encrypt(
    $patient_ssn,
    'AES-256-CBC',
    HEALTHCARE_ENCRYPTION_KEY,
    0,
    HEALTHCARE_ENCRYPTION_IV
);

// Decrypt when retrieving
$decrypted_ssn = openssl_decrypt(
    $encrypted_ssn,
    'AES-256-CBC',
    HEALTHCARE_ENCRYPTION_KEY,
    0,
    HEALTHCARE_ENCRYPTION_IV
);

Business Associate Agreements

Ensure all service providers sign BAAs:

• Hosting provider
• Email service
• Backup services
• Analytics tools
• Payment processors

Security Checklist for Healthcare Sites

• [ ] SSL certificate installed and forced
• [ ] Role-based access control implemented
• [ ] Audit logging enabled
• [ ] Session timeouts configured
• [ ] Database encryption for PHI
• [ ] BAAs signed with all vendors
• [ ] Regular security assessments
• [ ] Incident response plan documented

Conclusion

Healthcare WordPress sites require extra security layers to protect patient data and comply with HIPAA. Implement encryption, access controls, audit logging, and work only with HIPAA-compliant service providers.