Best CMS for Healthcare in 2026
Most CMS vendors will not sign a Business Associate Agreement, and several forbid health data in their contracts. These are the platforms that will, and what each one asks of you in return.
The short answer
HubSpot Content Hub and Kontent.ai are the best CMS platforms for most healthcare organizations in 2026. HubSpot because its Enterprise tier signs a Business Associate Agreement automatically, with an independent HIPAA report and the easiest editor for marketers. Kontent.ai because it documents PHI handling under a BAA with an accessible authoring interface. Contentful is the headless alternative. Salesforce Experience Cloud and Adobe Experience Manager carry the deepest HIPAA attestations for patient portals and large health systems, at suite prices.
Key takeaways
- The Business Associate Agreement is the whole decision. HIPAA's Privacy Rule requires a signed BAA before a vendor touches protected health information (PHI) on your behalf. A platform without one is not a healthcare platform, whatever its security page says. Ten of the platforms we score offer a BAA; most of the rest do not, and several contractually prohibit health data.
- HIPAA readiness is scoped, not blanket. Adobe limits PHI to production and excludes its newest editing tools, Optimizely strips features such as database export from its HIPAA-enabled variant, and HubSpot and Contentful sign a BAA only on their Enterprise tier. Read the scope before you read the price.
- Compliance is more than HIPAA. A healthcare website also answers to the HHS Section 504 and Section 1557 accessibility rules (WCAG 2.1 AA), the Breach Notification Rule, the FTC Health Breach Notification Rule for non-covered apps, state health privacy laws and, for EU patients, GDPR's special category rules for health data.
- The tracking pixel is the live risk. HHS guidance on website analytics and advertising pixels was partly vacated in court in 2024, but private lawsuits under wiretap and state privacy laws continue. The platform you choose must let you run the site without third-party trackers on authenticated and condition-specific pages.
- Underneath the compliance paperwork, the editors still need a usable CMS. The suites carry the deepest attestations and the heaviest cost and upkeep. HubSpot Content Hub and Kontent.ai show that a BAA and a marketer-friendly editor can come in the same product at a fraction of the price.
Our picks at a glance
Salesforce Experience CloudA named HIPAA covered service with PHI controls.
Adobe Experience ManagerAttested HIPAA readiness and multi-site governance.
AcquiaHIPAA environment, FedRAMP and Site Factory.
HubSpot Content HubAutomatic BAA on Enterprise, easiest editor.
Optimizely PaaS DXPA HIPAA-enabled variant with published exclusions.
ContentfulEnterprise BAA and the strongest audit logging.
Our analysts’ take
A hospital system, a payer, a medical device company or a digital health startup shops for a CMS like everyone else, until the first conversation with legal. Then the question changes from which platform has the best editor to which platform will sign a Business Associate Agreement, where the data lives, who holds the encryption keys, what the audit log captures and whether the vendor's own analytics are collecting something a court would call protected health information. Most CMS vendors have never had that conversation and do not want it. Their contracts say so.
That leaves a short list. Among the platforms we score, a documented BAA or HIPAA-enabled offering exists at Salesforce, Adobe, Acquia, Optimizely, HubSpot, Progress, Contentful and Kontent.ai, and at Sitecore for its SaaS products. Beyond that list the picture is worse than most buyers assume: Storyblok, Contentstack, Craft CMS, Squiz and Jahia Cloud forbid health data in their terms, Webflow states it is not HIPAA compliant, and Sanity, Hygraph, Prismic and the self-hosted open-source platforms simply offer no vendor path at all. Running them inside your own HIPAA boundary is possible, but every control, risk assessment and BAA in the chain becomes your problem.
This guide rates the ten platforms that will sign. Compliance carries the heaviest weight, because it is the gate, but it is not the only lens: a platform that satisfies the security officer and defeats the marketing team is a different kind of failure. The ratings below blend the compliance evidence in our scorecards with how well each platform serves editors, how much it takes to run and what it costs, so the shortlist reflects a healthcare organization that still has a website to publish.
What to look for
- 1
A BAA, and what it covers
Ask for the Business Associate Agreement and the scope document behind it. The right answer names the product you are buying, lists the features excluded from PHI use, and says which environments may hold PHI. A BAA that exists only through a sales representative, on one tier, or for a different product in the same family is a smaller promise than it looks.
- 2
Independent attestations
A SOC 2 Type 2 report with HIPAA Security Rule mapping, a HITRUST certification or a third-party HIPAA assessment shows someone outside the vendor tested the controls. ISO 27001 and FedRAMP matter for payers, public health and anything serving the VA or HHS. Ask for the reports under NDA; a badge on a trust page is not a report.
- 3
Encryption, residency and audit logging
The HIPAA Security Rule's technical safeguards (45 CFR 164.312) expect access controls, audit controls, integrity checks and transmission security. Confirm encryption at rest and in transit, who manages the keys, which regions can hold the data, how long audit logs are retained and whether you can export them to your own security tooling.
- 4
Accessibility built into authoring
HHS rules under Section 504 and Section 1557 require WCAG 2.1 AA for websites, patient portals and apps of organizations receiving federal health funds. The platform should enforce alternative text, heading structure and contrast at authoring time, and the editing interface itself should be usable by staff with disabilities.
- 5
Control over trackers and forms
You need to run pages without third-party analytics or advertising pixels, keep form submissions that may contain health information inside the HIPAA boundary, and prevent the vendor's own AI or personalization features from processing PHI unless they are covered. Check what the platform injects by default and what it lets you switch off.
The ratings at a glance
Ranked by Fit score for this topic. Dots run from one (Limited) to five (Excellent); each review below spells the ratings out.
| Platform | Fit | Compliance | Self-service | Upkeep | Budget | Speed | Growth tools |
|---|---|---|---|---|---|---|---|
1 Kontent.ai | 7.1/10 | Strong | Good | Good | Good | Good | Limited |
| 2HubSpot Content Hub | 7.1/10 | Strong | Strong | Fair | Good | Good | Strong |
| 3Contentful | 7.1/10 | Strong | Good | Fair | Fair | Good | Fair |
4 SitecoreAI | 6.7/10 | Strong | Strong | Fair | Limited | Fair | Strong |
| 5Optimizely PaaS DXP | 6.5/10 | Good | Strong | Fair | Limited | Fair | Good |
6 Optimizely SaaS CMS | 6.4/10 | Good | Good | Good | Limited | Fair | Good |
| 7Acquia | 6.3/10 | Strong | Good | Fair | Limited | Limited | Good |
| 8Salesforce Experience Cloud | 6.2/10 | Strong | Fair | Fair | Limited | Limited | Fair |
| 9Adobe Experience Manager | 6.2/10 | Strong | Strong | Limited | Limited | Limited | Strong |
10 Progress Sitefinity | 6.1/10 | Good | Good | Fair | Limited | Fair | Good |
- 1Kontent.ai7.1/10
- Security & compliance
- Strong
- Marketer self-service
- Good
- Low IT upkeep
- Good
- Budget predictability
- Good
- Speed to launch
- Good
- Campaign & growth tools
- Limited
- 2HubSpot Content Hub7.1/10
- Security & compliance
- Strong
- Marketer self-service
- Strong
- Low IT upkeep
- Fair
- Budget predictability
- Good
- Speed to launch
- Good
- Campaign & growth tools
- Strong
- 3Contentful7.1/10
- Security & compliance
- Strong
- Marketer self-service
- Good
- Low IT upkeep
- Fair
- Budget predictability
- Fair
- Speed to launch
- Good
- Campaign & growth tools
- Fair
- 4SitecoreAI6.7/10
- Security & compliance
- Strong
- Marketer self-service
- Strong
- Low IT upkeep
- Fair
- Budget predictability
- Limited
- Speed to launch
- Fair
- Campaign & growth tools
- Strong
- 5Optimizely PaaS DXP6.5/10
- Security & compliance
- Good
- Marketer self-service
- Strong
- Low IT upkeep
- Fair
- Budget predictability
- Limited
- Speed to launch
- Fair
- Campaign & growth tools
- Good
- 6Optimizely SaaS CMS6.4/10
- Security & compliance
- Good
- Marketer self-service
- Good
- Low IT upkeep
- Good
- Budget predictability
- Limited
- Speed to launch
- Fair
- Campaign & growth tools
- Good
- 7Acquia6.3/10
- Security & compliance
- Strong
- Marketer self-service
- Good
- Low IT upkeep
- Fair
- Budget predictability
- Limited
- Speed to launch
- Limited
- Campaign & growth tools
- Good
- 8Salesforce Experience Cloud6.2/10
- Security & compliance
- Strong
- Marketer self-service
- Fair
- Low IT upkeep
- Fair
- Budget predictability
- Limited
- Speed to launch
- Limited
- Campaign & growth tools
- Fair
- 9Adobe Experience Manager6.2/10
- Security & compliance
- Strong
- Marketer self-service
- Strong
- Low IT upkeep
- Limited
- Budget predictability
- Limited
- Speed to launch
- Limited
- Campaign & growth tools
- Strong
- 10Progress Sitefinity6.1/10
- Security & compliance
- Good
- Marketer self-service
- Good
- Low IT upkeep
- Fair
- Budget predictability
- Limited
- Speed to launch
- Fair
- Campaign & growth tools
- Good
The shortlist, reviewed
Kontent.ai
Kontent.ai publishes a healthcare industry page and a HIPAA compliance resource stating that PHI handling operates under a BAA, with role-based access guidance and Azure HIPAA-eligible infrastructure. It combines that with one of the most accessible authoring interfaces we score, which matters for health organizations under Section 504.
- Best for
- Healthcare content teams that want a governed headless CMS with strong workflow and an accessible editor, on Microsoft Azure.
- Watch out for
- The BAA is arranged through a customer representative rather than published as a standard offering, there is no HITRUST, and a headless platform still needs a developer-built front end for every channel.
- What it costs
- An interactive calculator by seats and content volume leads to a sales-gated quote; only the free Developer plan has a published price.
HubSpot Content Hub
HubSpot signs a BAA automatically once an Enterprise account identifies itself as a covered entity or business associate and marks the properties that hold PHI, backed by an independent HIPAA report refreshed in June 2026. Sensitive data controls cover CRM properties and form submissions, and the editor is among the easiest for marketers to run alone.
- Best for
- Clinics, specialty practices, digital health companies and mid-sized providers whose website, forms and patient communication should live in one marketer-run system.
- Watch out for
- The BAA is Enterprise-only, several reporting and data-sharing features are excluded from PHI use, and HubSpot's strength is marketing automation rather than large multi-site governance or deep asset management.
- What it costs
- Content Hub Enterprise from $1,500 a month with five seats, the only tier where the BAA applies. No onboarding fee for Content Hub.
Contentful
Contentful offers a BAA on its Enterprise tier and runs on HIPAA-eligible AWS infrastructure, with the strongest audit logging among the platforms we score and mature roles and permissions. It is the leading headless option for healthcare teams that want to build their own patient-facing front end.
- Best for
- Digital health companies and provider innovation teams with developers who want structured content delivered by API to web and mobile apps.
- Watch out for
- HIPAA documentation is thinner than the suites, with no healthcare reference architecture, and the content APIs expose data to every consumer you connect, so access control is your implementation. The BAA requires an enterprise agreement.
- What it costs
- Free and Lite at $300 a month are published; Enterprise, where the BAA lives, is custom priced. Personalization and Studio are separate quotes.
SitecoreAI
A third-party auditor attestation from October 2024 made SitecoreAI (then XM Cloud), Content Hub, CDP and Personalize HIPAA-ready, and Sitecore's compliance page states it implements PHI safeguards when acting as a business associate. Multi-site brand governance and the composable personalization stack are strong for large provider marketing programs.
- Best for
- Large health systems and pharmaceutical marketers with a Sitecore history who want brand governance and personalization inside one vendor.
- Watch out for
- The compliance page now describes HIPAA as an alignment rather than a certification, no BAA template or healthcare implementation guide is published, and the attestation covers the SaaS products only. Sitecore XP, the installed product many healthcare customers still run, has no vendor BAA.
- What it costs
- Quote-only, driven by modules, traffic, site count and users. Third-party estimates place typical contracts in the low to mid six figures.
Optimizely PaaS DXP
Optimizely documents a distinct HIPAA-enabled CMS variant for its PaaS product, with added auditing and security controls, an Optimizely-approved BAA required before any PHI is processed, and a published list of excluded features that defines the compliance boundary. It keeps one of the best visual editors among the platforms we score and a .NET codebase healthcare IT teams already know.
- Best for
- Provider and payer organizations with .NET developers that want a mature visual editor, commerce or member self-service and a documented HIPAA scope.
- Watch out for
- The HIPAA-enabled variant removes SendGrid email, production database exports, content sync-down, edge log exports and project migration, and cannot exchange data with non-HIPAA Optimizely products. HIPAA-compliant application code remains your responsibility.
- What it costs
- Quote-only. Procurement data puts the median Optimizely contract near $83,000 a year, with entry deals around $36,000 and enterprise programs well above $250,000.
Optimizely SaaS CMS
The SaaS CMS has its own HIPAA-enabled configuration with developer documentation describing PHI-safe infrastructure, restricted integrations and BAA availability, and Optimizely acts as business associate for healthcare and life sciences customers. It is the lighter, fully hosted way into the same compliance program as the PaaS product.
- Best for
- Healthcare marketing teams that want a hosted, visually edited CMS with a documented HIPAA variant and no servers to run.
- Watch out for
- The same feature exclusions apply as on PaaS, HITRUST is not held, and the SaaS product is younger with a thinner ecosystem than the PaaS line. Experimentation and personalization are separate HIPAA-enabled products.
- What it costs
- Quote-only, with no published tiers. Expect enterprise contract terms rather than self-serve plans.
Acquia
Acquia Cloud Platform sells a documented HIPAA offering: a logically separated environment with encrypted file and database volumes, a BAA signed through Acquia, and a SOC 2 Type 2 report that maps controls to the HIPAA Security Rule. Add FedRAMP Moderate, HIPAA, PCI DSS and Site Factory for large site portfolios and it is the strongest open-source route for regulated healthcare.
- Best for
- Health systems, public health agencies and academic medical centers with Drupal skills in house or at their agency, and a portfolio of sites to govern.
- Watch out for
- The BAA covers Acquia's infrastructure only; application-level HIPAA controls in Drupal modules and custom code are yours. Personalization and search are partner engines sold as add-ons, and Drupal specialists are mandatory and expensive.
- What it costs
- Enterprise tiers are quote-only, with extra contract language required to process PHI. Budget for a Drupal agency on retainer alongside the subscription.
Salesforce Experience Cloud
Experience Cloud is named as a HIPAA covered service on Salesforce's BAA restrictions page, so a patient or member portal can hold PHI under a signed agreement. Shield Platform Encryption, Event Monitoring and Field Audit Trail supply the technical safeguards, and Health Cloud adds healthcare data models. It is a portal and community platform first, a marketing CMS second.
- Best for
- Payers, provider networks and life sciences companies building authenticated patient, member or provider portals on data that already lives in Salesforce.
- Watch out for
- The BAA must be contracted per service, all PHI must be encrypted (in practice Shield, a paid add-on), and Einstein and Agentforce features carry extra data masking requirements. Public marketing sites are a weaker fit than the portal use case.
- What it costs
- Quote-only. External user licenses are not published; Shield encryption is a separate add-on on top of the platform subscription.
Adobe Experience Manager
Adobe Experience Manager as a Cloud Service is HIPAA-ready under a signed BAA, with a SOC 2 plus HIPAA attestation covering both Experience Cloud and Managed Services. Sites, Assets, Forms and Edge Delivery are in scope with the Extended Security for Healthcare add-on. It pairs that with the deepest multi-site governance and asset management among the platforms we score.
- Best for
- Large health systems and pharmaceutical companies running many sites and brands, especially those already on Adobe Analytics, Target or Real-Time CDP.
- Watch out for
- PHI is barred from development and staging environments, and the Universal Editor, Sites Optimizer, Content Hub, Dynamic Media and the LLM Optimizer are not HIPAA-ready, so the newest authoring surface cannot touch patient data. Implementations run six to fourteen months with scarce Java specialists.
- What it costs
- Quote-only. Partner guides put Sites entry near $30,000 a year and full enterprise deployments at $200,000 and up, before the healthcare security add-on and implementation.
Progress Sitefinity
Progress provides a BAA that names Sitefinity among its covered Health Cloud offerings, hosts a HIPAA Type 1 report in its Trust Center, and documents PHI tooling such as field mapping, PII and PHI removal workflows and data obfuscation on non-production restores. It is a practical .NET choice for mid-sized providers.
- Best for
- Regional health systems, medical groups and associations on the Microsoft stack that need a signed BAA without enterprise suite pricing.
- Watch out for
- The HIPAA report is a point-in-time Type 1 assessment rather than an ongoing Type 2, and there is no healthcare-specific product or implementation guide. The authoring experience trails the hosted headless and visual platforms.
- What it costs
- Quote-only across Self-Hosted and Sitefinity Cloud. The DX and DX plus Enterprise editions and the Cloud base inclusions (one million page views, ten back-end users, five languages) are documented without dollar figures.
The rules a healthcare website actually answers to
HIPAA is the headline, but a healthcare CMS decision touches a stack of regulations, and the platform is responsible for a different slice of each. These are the ones that shape the shortlist, and what to ask the vendor about each.
HIPAA Privacy Rule and the Business Associate Agreement
A covered entity may share protected health information with a vendor only under a signed BAA that binds the vendor to HIPAA's safeguards. A CMS that stores form submissions, portal logins, appointment requests or any identifiable health data on your behalf is a business associate. No BAA, no PHI. That single rule removes most of the market.
HIPAA Security Rule and HITECH
The Security Rule's administrative, physical and technical safeguards (45 CFR 164.308 through 164.312) set the expectations for access control, audit logs, integrity, transmission security and risk analysis. HITECH extended liability directly to business associates and raised penalties. HHS proposed a stricter Security Rule update in late 2024 that would make encryption, multifactor authentication and asset inventories explicit requirements; ask vendors how their roadmap tracks it.
Breach notification, federal and FTC
The HIPAA Breach Notification Rule requires covered entities and business associates to report breaches of unsecured PHI, so the BAA should fix the vendor's notification window in hours, not just say 'without unreasonable delay'. Digital health apps outside HIPAA fall under the FTC Health Breach Notification Rule, which the FTC expanded in 2024 to cover most health apps and connected products.
Tracking technologies
HHS issued guidance in December 2022, revised in March 2024, that treats analytics and advertising pixels on patient-facing pages as potential PHI disclosures. A federal court vacated the part covering unauthenticated pages in June 2024 and HHS dropped its appeal, but the rest stands and private class actions under wiretap and state privacy laws continue. The platform must let you run authenticated and condition-specific pages with no third-party trackers.
Accessibility: Section 504, Section 1557 and the ADA
HHS's 2024 rules require recipients of federal health funds to meet WCAG 2.1 AA across websites, patient portals, telehealth and mobile apps; HHS extended the original May 2026 and May 2027 deadlines through an interim rule in 2026, so confirm the current dates. The DOJ's ADA Title II rule for public hospitals and health departments now takes effect in April 2027. Our scorecards rate both the authoring interface and the vendor's accessibility documentation.
State and international health privacy
Washington's My Health My Data Act, Nevada's and Connecticut's consumer health data laws and California's CCPA sensitive data rules reach health information outside HIPAA, including on marketing sites. For EU patients, GDPR Article 9 treats health data as a special category requiring explicit consent, and several platforms' data processing agreements exclude special categories outright. Check residency options and the DPA before signing.
What the scorecards found in the contracts
Our compliance scoring reads the binding documents, not the trust page, and the gap between the two is wide in healthcare. These are the findings that moved platforms on or off this shortlist.
Platforms that forbid health data
Storyblok's April 2026 data processing addendum prohibits special categories of personal data. Contentstack's June 2026 US addendum defines PHI under HIPAA as prohibited data, which contradicts its own marketing about built-in HIPAA support. Craft CMS bars protected health information in its acceptable use policy. Squiz's subscription agreement says it is not HIPAA accredited and disclaims liability for health information. Jahia Cloud's terms forbid HIPAA-protected data despite a published Security Rule assessment.
Platforms that say no plainly
Webflow states it is not HIPAA compliant by default and is not designed to store PHI. Hygraph says it does not handle HIPAA-type information. Prismic confirmed on its community forum that it has no BAA. Cosmic says it holds no HIPAA certification and will not claim otherwise. Honest answers, and clear ones.
Platforms where the vendor never touches PHI
WordPress, Drupal, TYPO3, Joomla, Umbraco, Strapi, Payload CMS and Directus are software you host. No BAA comes from the project, so compliance depends entirely on a hosting provider that will sign one and on your own controls. Acquia is that provider for Drupal; for WordPress, mainstream managed hosts generally decline to sign a BAA and only specialist hosts will. WordPress VIP's trust center lists no BAA.
Readiness that is narrower than the badge
Adobe's HIPAA readiness page excludes the Universal Editor and several newer products and bars PHI from non-production environments. Optimizely's HIPAA-enabled variants remove database exports and email delivery. HubSpot and Contentful sign only at Enterprise. Sitecore's attestation covers its SaaS products and not Sitecore XP. Each is a real offering; each has edges you must design around.
What to verify before you sign
Get the BAA and its scope document first
Before the demo, ask for the BAA, the list of products and features it covers, the environments that may hold PHI and the breach notification window. If the answer is 'our account team can arrange that', get it in writing before the pricing conversation.
Ask for the reports, not the badges
Request the SOC 2 Type 2 report with HIPAA mapping, the HITRUST certificate or the third-party HIPAA assessment under NDA. A Type 1 report describes controls on one day; a Type 2 shows they operated over months.
Map your PHI before you map your content
List every place health information could enter the site: appointment forms, symptom checkers, portal logins, chat, uploads, search queries. Each must sit inside the BAA's scope or outside the platform entirely. Form tools are where most CMS deployments leak.
Audit the default page
Load a blank page on the platform and inspect the network calls. Vendor analytics, session replay, chat widgets and AI assistants that fire by default must be switchable off, and the platform's own usage telemetry should be covered by the BAA or disabled.
Test the editor for accessibility and the output for WCAG
Have a staff member who uses a screen reader try the authoring interface, and run the rendered templates through WCAG 2.1 AA checks before launch. The Section 504 rule covers content from third-party vendors too, so the vendor's documentation is part of your evidence.
Frequently asked questions
Which CMS platforms will sign a HIPAA Business Associate Agreement?
Among the platforms we score, Salesforce Experience Cloud, Adobe Experience Manager as a Cloud Service, Acquia, Optimizely (CMS PaaS and SaaS in their HIPAA-enabled variants), HubSpot Content Hub Enterprise, Progress Sitefinity, Contentful Enterprise, Kontent.ai and Sitecore's SaaS products document a BAA. Most other vendors do not, and Storyblok, Contentstack, Craft CMS, Squiz and Jahia Cloud forbid health data in their terms.
Is WordPress HIPAA compliant?
Not as software. WordPress.org signs no BAA and has no HIPAA features in core. A HIPAA-compliant WordPress site depends on a specialist host that will sign a BAA, on avoiding plugins and trackers that handle PHI, and on your own risk analysis. Mainstream managed WordPress hosts generally decline to sign BAAs, and WordPress VIP's trust center lists none.
Does a HIPAA-ready CMS make my website HIPAA compliant?
No. The BAA covers the vendor's infrastructure and listed services; your organization remains responsible for the risk analysis, access policies, workforce training, the application code, the forms and integrations you add, and the trackers you load. Several vendors, including Adobe, Optimizely and Acquia, state that application-level controls remain the customer's responsibility.
Can I use Google Analytics or advertising pixels on a healthcare website?
Carefully, and not on authenticated or condition-specific pages that could tie a person to their health. HHS guidance treats such tracking as a potential PHI disclosure; a court vacated the part covering unauthenticated pages in 2024, but private lawsuits under wiretap and state laws continue. Use a tracking vendor that will sign a BAA, or none, on sensitive pages.
What accessibility standard applies to healthcare websites?
WCAG 2.1 Level AA. HHS's 2024 rules under Section 504 and Section 1557 apply it to websites, patient portals, telehealth and mobile apps of organizations receiving federal health funds, with compliance dates extended by an interim rule in 2026. The DOJ's ADA Title II rule applies the same standard to public hospitals and health departments from April 2027.
How we rated these platforms
Each rating combines the relevant criteria from our independent scorecards into a five-point scale. The Fit score blends the ratings below, weighted for this topic, into one number out of 10. Ratings are recalculated whenever a scorecard is updated, so the order above always reflects current evidence. The written analysis was last reviewed on October 21, 2026.
Scorecards and platform inclusion are unsponsored: no vendor pays to appear in this guide or to change a rating. Full criteria, weights and evidence are in the methodology and on each platform’s scorecard. Spotted something out of date? Tell us.
Still deciding?
Answer seven questions for a shortlist built around your team, or put the top two side by side.