Appointments Website. Calendar.

If your appointment website is for doctors and must collect contact information, you must encrypt stored data.

What laws you must assume

At minimum:

🇺🇸 HIPAA (if US healthcare providers)
🇪🇺 GDPR / UK GDPR (if EU/UK users)
🇨🇦 PIPEDA, 🇦🇺 Privacy Act, etc.

All of them share the same principle:

Use reasonable and appropriate safeguards.

For public-facing medical systems, encryption at rest is considered baseline, not optional.

Countries / regions where unencrypted storage is explicitly NOT acceptable

You should not deploy such a system here without database encryption:

🇪🇺 European Union (GDPR)

Encryption is not strictly mandatory, but strongly expected
Regulators treat unencrypted personal data as a security failure
Fines are common after breaches

Verdict: ❌ Not acceptable in practice

🇬🇧 United Kingdom (UK GDPR)

Same standard as EU
ICO expects encryption for stored personal data

Verdict: ❌ Not acceptable

🇺🇸 United States

No single privacy law, but:
- FTC enforces “reasonable security”
- State laws (CA, NY, MA) expect encryption
- Breach notification laws penalize plaintext storage

Verdict: ❌ High liability risk

🇨🇦 Canada (PIPEDA)

“Appropriate safeguards” required
Encryption is considered baseline for databases

Verdict: ❌ Not acceptable

🇦🇺 Australia (Privacy Act)

Reasonable steps to secure personal data
Plaintext databases fail audits

Verdict: ❌ Not acceptable

🇯🇵 Japan, 🇰🇷 South Korea, 🇸🇬 Singapore

Strong data protection laws
Encryption considered standard

Verdict: ❌ Not acceptable

Below is a case:

Medical appointment website
Collects age, sex, email, phone
Uses HTTPS
No database encryption at rest

What the law says, what regulators expect, and real enforcement risk.

🇷🇺 Russia (Federal Law No. 152-FZ “On Personal Data”)

Does the law apply?

Yes.
Email and phone number are personal data under Russian law, even without a name.

If the site is used by a medical organization, the data is also treated as medical-related personal data, which increases protection requirements.

Is database encryption legally mandatory?

Not explicitly mandatory, but…

Russian law requires:

“Necessary and sufficient organizational and technical measures”
Protection against unauthorized access, leakage, modification

Roskomnadzor guidance and court practice treat encryption as a standard technical measure for internet-facing systems.

Can you legally store unencrypted data?

⚠️ Formally possible, but high risk, especially if:

Public-facing website
Medical context
Cloud or internet-accessible database

After a breach, unencrypted storage is routinely considered inadequate protection.

Practical reality in Russia

Medical IT systems are expected to encrypt
Hosting providers and clinics usually require it contractually
Fines are modest, but service blocking is possible

Verdict (Russia):
⚠️ Technically possible, practically unsafe

🇦🇲 Armenia (Law on Protection of Personal Data, 2015)

Does the law apply?

Yes.

Email and phone number = personal data
Medical appointment context = higher protection expectation

Is encryption explicitly required?

No explicit encryption mandate in the law.

However, the law requires:

“Necessary technical means for protection”
Prevention of unauthorized access and dissemination

Armenian regulators do not prescribe exact technologies, but rely on a “reasonable security” standard.

Can you legally store unencrypted data?

✅ Yes, legally possible, if:

Access controls are strong
HTTPS is used
Minimal staff access
Clear internal security policy exists

⚠️ However:

In case of breach, lack of encryption weakens your legal defense
Medical data increases scrutiny

Enforcement reality

Enforcement is light
Fines are low
Focus is usually on absence of any safeguards, not encryption specifics

Verdict (Armenia):
✅ Legally possible today
⚠️ Weak future-proofing

🇬🇪 Georgia (Law on Personal Data Protection, updated 2023)

Does the law apply?

Yes.

Georgia’s law is now GDPR-aligned.

Email + phone = personal data
Medical services = special category data context

Is encryption required?

The law requires:

“Appropriate technical and organizational measures”
Protection proportionate to risk

The Georgian Personal Data Protection Service explicitly references:

Encryption
Pseudonymization

as expected safeguards for sensitive or high-risk processing.

Can you store data unencrypted?

❌ Strongly discouraged and hard to defend, especially for:

Medical appointments
Internet-facing systems

In a breach, plaintext storage would almost certainly be ruled non-compliant.

Enforcement reality

Active regulator
Administrative fines
Orders to suspend processing

Verdict (Georgia):
❌ Not realistically acceptable

Summary Table

Country	Law applies?	Encryption explicitly required?	Unencrypted DB legally defensible?
Russia	Yes	Not explicit	⚠️ Risky
Armenia	Yes	No	✅ Possible
Georgia	Yes	Expected	❌ No

Important strategic point

Even where legally possible (Russia, Armenia):

Doctors and clinics often require encryption contractually
Hosting providers may require it
One breach can retroactively turn “acceptable” into “non-compliant”

And encryption:

Is cheap
Has near-zero performance cost
Removes cross-border compliance headaches

Encryption

Armenia → You can legally deploy today without DB encryption (not recommended)
Russia → Legally gray, practically unsafe
Georgia → Not acceptable for medical appointments

Countries where unencrypted storage may be legally tolerated (lower enforcement / less explicit requirements)

⚠️ This does NOT mean “safe” or “best practice” — only lower legal exposure

Parts of:

🇮🇳 India (outside sensitive data scope)
🇵🇭 Philippines (weak enforcement)
🇮🇩 Indonesia (emerging enforcement)
🇻🇳 Vietnam (law exists, enforcement uneven)
🇹🇭 Thailand (PDPA exists, but limited enforcement)
🇧🇷 Brazil (LGPD exists, but enforcement still maturing)

Verdict: ⚠️ Possible, but risky and future-proofing is poor

Countries with minimal or no enforced data protection laws

🇦🇫 Afghanistan — no comprehensive law
🇧🇩 Bangladesh — no comprehensive law
🇧🇮 Burundi
🇨🇫 Central African Republic
🇨🇺 Cuba
🇩🇯 Djibouti
🇩🇲 Dominica (limited / no privacy law)
🇪🇷 Eritrea
🇸🇾 Syria
🇱🇷 Liberia
🇸🇱 Sierra Leone
🇬🇼 Guinea-Bissau
🇸🇩 Sudan
🇻🇪 Venezuela
🇵🇬 Papua New Guinea
🇹🇱 Timor-Leste (East Timor)
🇧🇳 Brunei
🇲🇻 Maldives (listed in some mappings as lacking a law/pending)
🇸🇴 Somalia — has a law passed, but enforcement and regulatory capacity are extremely weak in practice Wikipedia
🇲🇿 Mozambique — no clear data/implementation gaps in enforcement in some assessments
🇸🇿 South Sudan — lacking data and established enforcement bodies
🇿🇲 Zambia — pending regulator establishment (legislation passed but incomplete)

Additionally, some territories/places with no clear information or missing data include:

Western Sahara
North Korea

👉 Note: In some of the above, draft privacy bills exist but are not implemented or lack enforcement capacity. For example, many African and Asian countries have draft laws or pending regulatory action, but no active enforcement body. IAPP+1

⚠️ Important context

📌 Most countries do now have privacy laws

According to global data, around 144+ countries have enacted comprehensive privacy/data protection laws — a clear majority of the world’s jurisdictions. IAPP

📌 “No law” ≠ “safe forever”

Even where a comprehensive data protection law does not yet exist, other legal frameworks (like telecommunications. consumer protection., cybercrime, or health data rules) may still regulate how data like email and phone numbers are handled.

🇺🇸 USA

HIPAA applies to any website (even a small one) if it collects, stores, or transmits Protected Health Information (PHI) — including appointment calendars that include patient names, dates, reasons for visit, or contact info.

When HIPAA DOES Apply to a Appointments Website. Calendar Site

Scenario	HIPAA Applies?	Why
Patient books appointment with name, email, phone, reason for visit	YES	This is PHI (identifiable health data)
Calendar shows “John Doe – Knee Pain – 3 PM”	YES	Combines identity + health condition
You store data in a database or Google Sheet	YES	You’re a Covered Entity or Business Associate
You use WordPress + Appointments plugin (e.g., Bookly, Amelia)	YES	If PHI is collected/stored

When HIPAA Does NOT Apply

Scenario	HIPAA-Free?	Why
Anonymous booking (no names, no health info)	NO	Not PHI
Business services only (e.g., “Book a marketing consult”)	NO	Not healthcare
You delete data immediately after booking	NO (still applies during transmission)	Temporary PHI still protected

HIPAA Requirements for Small Appointment Sites (Even 1 Doctor)

Requirement	What You Must Do	Low-Cost Tools
Business Associate Agreement (BAA)	Sign with hosting, plugins, email, calendar tools	AWS, Google Workspace, HIPAA Vault
Encryption	Data in transit (SSL/TLS) + at rest	Let’s Encrypt (free SSL), encrypted DB
Access Controls	Login passwords, role-based access	WordPress user roles, 2FA
Audit Logs	Track who views/edits PHI	WP Activity Log, server logs
Risk Analysis	Annual security review	Free HHS template
Patient Rights	Allow access/deletion of their data	GDPR/CCPA plugins help
Secure Backup	Encrypted offsite backups	UpdraftPlus + encrypted storage

Real-World Example: WordPress + Bookly/Amelia

Plugin: Bookly Pro
Collects: Name, Email, Phone, Service ("Physical Exam"), Notes
→ This is PHI → HIPAA applies

You must:

Host on HIPAA-compliant server (e.g., HIPAA Vault: ~$84/mo)
Use encrypted forms (SSL + field encryption add-ons)
Sign BAAs with Bookly (if Pro), hosting, email (e.g., Google Workspace)

Cheapest HIPAA-Compliant Setup (2025)

Item	Cost
HIPAA Hosting (HIPAA Vault WP)	$1,008/yr
SSL (Let’s Encrypt)	FREE
Appointment Plugin (Bookly Pro)	$99/yr
BAA + Compliance Tools	$0–$360/yr
Total	~$1,100–$1,500/yr

Bottom Line for Small Clinics

If your appointment calendar collects any patient-identifiable health info → HIPAA applies — no exceptions for size.

Do this now:

Switch to HIPAA-compliant hosting (e.g., HIPAA Vault, AWS with BAA)
Add SSL + form encryption
Use plugins with BAA support (or avoid storing PHI)
Document your risk analysis (1-page is fine)

Pro Tip: Use anonymous booking links or patient portal logins (e.g., OpenEMR portal) to avoid PHI on the public site.

BAA Checklist (Print & Sign)

Vendor	BAA Status	Link
HIPAA Vault	Signed	hipaavault.com/baa
OpenEMR Host (AWS/GCP)	Signed	AWS BAA
Google Workspace	Signed	workspace.google.com/terms
Bookly/Amelia (if used)	Not needed (no PHI stored)	—

Action Plan (Do This Week)

Switch hosting → HIPAA Vault (sign BAA)
Enable SSL → Let’s Encrypt (free via hosting)
Sign BAAs → With hosting, Google, plugin (if Pro)
Add audit log → Install WP Activity Log (free)
Document risk analysis → Use HHS free template