Most medical practice websites fail in one of two ways. They look fine but leak protected health information through an intake form or a third-party analytics script. Or they are locked down and compliant but give a prospective patient no way to book an appointment without calling during office hours.
This is a working guide to web design for medical practices, written for independent practitioners and small groups rather than hospital systems. It covers the rules that actually apply to a practice your size, the platform tradeoffs that follow from those rules, and the design decisions that move someone from a search result to a scheduled visit.
What a medical practice website has to do
A practice website has three jobs, in this order: let a new patient confirm you are real and relevant, let them act without friction, and do both without creating a compliance problem.
Everything else is decoration. Most practices invert the order, spending the budget on a hero video and leaving the appointment path to a phone number in the footer.
The three jobs map cleanly onto measurable things. Credibility comes from provider bios, insurance information, and patient testimonials. Action comes from online booking and a visible phone link. Compliance comes from how the site handles data, and from meeting accessibility standards that now carry federal deadlines.
First impressions happen in about a second, and for a professional practice they are mostly carried by load speed, legible type, and whether the page looks maintained. Fix those three before you argue about colors.
Does a website need to be HIPAA compliant?
Not every page. HIPAA applies when your site creates, receives, maintains, or transmits protected health information. A brochure site with office hours and a phone number sits outside the rule. The moment you add an intake form, a patient portal login, a symptom questionnaire, or a chat widget, the Security Rule at 45 CFR Part 164 Subpart C applies.
The distinction matters because it tells you where to spend. You do not need a hardened hosting environment for a page listing your services. You absolutely need one for anything that collects sensitive patient information.
How do I make my website HIPAA compliant?
Identify every place PHI enters the site, then put safeguards and contracts around those places. In practice that means encrypted transmission and storage, access controls and audit logging, a signed business associate agreement with every vendor that touches the data, and no third-party tracking scripts on pages where patients submit health information.
The Security Rule names three categories of safeguards: administrative at 45 CFR 164.308, physical at 164.310, and technical at 164.312. Technical safeguards are the ones web vendors talk about. Administrative safeguards are the ones practices actually fail, because they are paperwork and nobody owns them.
A current TLS certificate, the padlock most people still call SSL, is table stakes and not sufficient on its own. It protects data in transit. It does nothing about where the submission lands, who can read it, or how long it is kept.
Where PHI actually enters your site
Walk the site and list every input. The usual culprits are the contact form that asks what brings you in, the appointment request that collects date of birth, the new patient packet download that posts back to an email address, the live chat widget, and the review request flow that references a visit.
A contact form that collects a name and a reason for visit is handling PHI. Treat it that way or remove the field.
The business associate agreement most practices skip
Any vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and you need a written contract with them. The requirement sits at 45 CFR 164.308(b) and 164.502(e), with the contract terms spelled out at 164.314(a).
In a typical small practice that list includes the host, the form handler, the scheduling tool, the email provider, and sometimes the website agency itself. Practices routinely have a signed agreement with the EHR vendor and nothing else.
Tracking scripts and the Becerra ruling
On December 1, 2022 the HHS Office for Civil Rights published a bulletin saying that an IP address combined with a visit to a page about a specific condition could be PHI, and it issued an updated version on March 18, 2024. On June 20, 2024, in American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas vacated that central provision as exceeding the agency’s statutory authority. HHS noticed an appeal and then moved to withdraw it on August 29, 2024.
What that changed: the specific theory OCR advanced is no longer enforceable guidance. What it did not change: the Privacy Rule and Security Rule themselves. Running a general-purpose advertising pixel on a page where patients discuss conditions is still a bad idea, and the Breach Notification Rule at 45 CFR 164.400 through 164.414 still requires notice within 60 days when a breach affects 500 or more individuals.
HHS also proposed a substantial Security Rule overhaul in a notice published January 6, 2025 at 90 FR 898. It would remove the required and addressable distinction entirely, making every implementation specification required subject to narrow stated exceptions. The comment period closed March 7, 2025 and the rule has not been finalized, so build to the current rule and watch the docket.
What websites are HIPAA compliant?
No website is HIPAA compliant on its own. Compliance is a property of the whole arrangement: the hosting environment, the form handler, the patient portal, the email routing, and the signed agreements behind them. Vendors advertising HIPAA compliant hosting are selling one component, and they will still require you to sign a business associate agreement.
Ask a vendor two questions. Will you sign a BAA, and what specifically are you taking responsibility for? A vendor that signs but excludes everything you care about is worse than one that declines honestly. The Health Insurance Portability and Accountability Act puts the obligation on you as the covered entity, not on the vendor’s marketing copy.
Are Wix websites HIPAA compliant?
Wix does not sign business associate agreements, so a Wix site cannot lawfully collect protected health information. Squarespace takes the same position. You can still run a marketing site on either platform and route intake through a separate vendor that does sign a BAA. Confirm any vendor’s current stance in writing before you build.
This is the most common mistake on self-built practice websites: a well-designed Wix page with a custom intake form collecting symptoms. Several widely circulated articles in the healthcare industry state flatly that Wix is HIPAA compliant. Check the vendor’s own agreement rather than a blog post.
Which website builder is best for a medical practice?
The right answer depends on who holds the PHI. Pick the platform for the marketing site, then pick a separate vendor that signs a BAA for anything patients submit. Trying to force one tool to do both is what produces either a compliance gap or a site nobody can update.
| Approach | Can it hold PHI directly? | Accessibility control | Best fit | Main tradeoff |
|---|---|---|---|---|
| Wix or Squarespace | No, route intake to a BAA-signing vendor | Limited, constrained by templates | Solo practitioner, tight budget, simple services | You cannot fix what the template gets wrong |
| WordPress on a HIPAA-ready managed host | Yes, with the right host and configuration | Full, depends on theme and build quality | Practices wanting control of website content and room to grow | Plugin and update maintenance is real work |
| Webflow plus an embedded compliant form | No on standard plans, confirm in writing | Full, clean markup by default | Design-led practices with a few locations | Smaller developer pool than WordPress |
| Healthcare-specific website vendor | Yes, usually included | Varies widely, ask for a VPAT | Practices that want it handled end to end | Templated look, harder to leave later |
| Fully custom build | Yes, by design | Full, specified up front | Multi-location groups with specific needs, portal integration | Highest cost and longest timeline |
Vendor positions change. Get the current answer in writing, not from a marketing page. Also ask what support looks like after launch, because a platform you cannot get help with becomes a platform you stop updating.
The accessibility standards deadline that moved in May 2026
This is the requirement most medical practices have never heard of, and it is the one with a date attached.
HHS published a final rule on May 9, 2024 on nondiscrimination on the basis of disability in programs and activities receiving federal financial assistance. It adopts the Web Content Accessibility Guidelines 2.1 Level AA as the standard for web content and mobile applications. Section 1557 of the Affordable Care Act imposes a parallel obligation on covered health programs.
The original deadlines were May 11, 2026 for recipients with 15 or more employees and May 10, 2027 for smaller recipients. On May 7, 2026 HHS announced an interim final rule extending both by one year, to May 11, 2027 and May 10, 2028. HHS was explicit that the extension imposes no new obligations and that the underlying duty to make content readily accessible to and usable by people with disabilities continues to apply.
Whether the rule reaches your practice turns on whether you receive federal financial assistance from HHS. If you participate in Medicaid or hold an HHS grant, assume you are in scope and confirm with counsel. Whether particular Medicare payment streams count has been contested, so do not treat it as settled either way.
Separately, private medical practices are places of public accommodation under Title III of the ADA. The Department of Justice has never adopted a technical web standard for Title III, which is why plaintiffs’ firms cite WCAG anyway and why building to it is the practical defense.
Accessibility standards worth building to now
Build to WCAG 2.2 Level AA. It first became a W3C Recommendation on October 5, 2023 and was republished as a revised Recommendation on December 12, 2024, which is the current version. It is backward compatible with 2.1, so meeting it satisfies the HHS standard and leaves you ahead of the next revision.
The items that fail most often on practice websites are low-contrast text on brand colors, form fields with placeholder text instead of real labels, appointment widgets that cannot be operated by keyboard, PDFs of new patient forms with no tagged structure, and images carrying information with no alt text. Screen readers expose all five immediately.
High-contrast type at a readable size is the single cheapest fix and it helps every visitor, not only the ones using assistive technology. Accessibility work also helps search engines, because the same markup that tells a screen reader what a button does tells a crawler the same thing.
Structured data and how search engines read your practice online
Add schema markup so search engines can verify what your practice is without guessing. For a clinic that means MedicalBusiness or Physician markup carrying name, address, phone, hours, accepted insurance, and provider credentials, plus FAQPage markup on pages that answer common patient questions.
This is quiet, unglamorous work with an outsized effect on how your practice online is represented in map results and AI answers. It is also how you keep a single source of truth when your hours or locations change.
How much does it cost to design a medical website?
For a single-location practice, a template-based build typically runs $3,000 to $8,000, and a custom designed medical practice website runs roughly $10,000 to $30,000. Portal integration, multi-location structure, and HIPAA-ready hosting push it higher. Hosting, maintenance, and accessibility remediation are separate recurring costs.
What actually drives the number is the count of service pages, whether patient data touches the site, and how much content you can supply yourself. Writing is usually the long pole. Our custom web design page walks through the process and where the hours go.
How to design a medical website
Online booking that patients will finish
Online booking is the single highest-leverage feature in medical website design. Put it in the header, make it reachable in one tap on a mobile friendly website, and keep the form to the fields you need to hold the slot. Every additional field costs completions.
Patients who can book appointments at 10pm become patients. Patients who find a phone number and a closed office do not. If your scheduling vendor cannot be embedded cleanly, link out rather than rebuild it badly, because a clean handoff beats a broken embed.
Service pages built one condition at a time
One page per condition or procedure, written in the words patients use, not the words on the billing code. Someone actively searching for a specific problem should land on a page about that problem, not a combined services list. Specific service pages built around relevant keywords are also what let you rank higher and get pulled into AI answer surfaces, which quote short, direct passages.
Each service page needs the same spine: what it is, who it helps, what the visit looks like, what it costs or how insurance handles it, and a way to book. Plain language is not dumbing down. It is the difference between a page a patient finishes and one they abandon.
Educational content that works as a valuable resource
A small library of genuinely useful articles about the conditions you treat does three things at once: it demonstrates expertise, it answers questions patients would otherwise call about, and it gives search engines and answer engines something specific to cite. Three good pages beat thirty thin ones.
Keep clinical content reviewed and dated. A page about patient care that has not been touched in four years reads as a closed practice.
Provider bios and patient testimonials that build trust
Bios do more conversion work than any other page type on a practice website. Include credentials, years in practice, what they treat, and a real photograph of the actual provider. Skip the stock image of a stethoscope. This is how healthcare providers become a trusted authority to someone who has never met them.
Patient testimonials carry weight, but keep them compliant. Never publish a review that reveals a condition without written authorization, and never edit a review into something the patient did not say. Patient privacy and patient trust are the same asset.
Clear navigation and the patient portal
Keep the top navigation to five or six items. Potential patients come for three things: services, booking, and contact details, and those are the important tasks your navigation has to serve before anything else. A patient portal login belongs in the header as a separate, obvious link, because returning patients are a different audience with a single task.
Design around real user needs rather than your internal org chart. Visitors do not know which department owns which page, and they should not have to.
Chat and AI assistants, carefully
An AI chat widget can answer routine questions instantly and take pressure off the front desk, which is a real gain for a practice’s operations. It is also a direct PHI intake point the moment a patient describes a symptom.
If you deploy one, confirm the vendor signs a BAA, turn off transcript retention you do not need, and give the widget a scope: hours, directions, insurance, and booking. Leave clinical questions to staff.
What are the 7 C’s of website design?
The seven C’s come from Rayport and Jaworski’s customer interface framework: context, content, community, customization, communication, connection, and commerce. On a medical practice website, context and content do the heavy lifting, communication covers booking and messaging, and commerce usually means insurance and payment clarity rather than a cart.
It is a useful checklist, not a design method. Compliance is the eighth C that framework never anticipated.
How local patients actually find your practice
Most new patient searches are local and done on a phone. That means a complete Google Business Profile, consistent name, address, and phone across directories, and location signals on the practice website itself. This is the core of patient acquisition for a single-location practice, and the fastest route to more patients without buying ads.
AI answer engines are now a meaningful share of discovery, and they reward pages that answer common patient questions directly in the first few sentences. That is why the headings on this page are phrased as questions. Our AI SEO and SEO services pages cover how that works in more depth.
Best healthcare websites to study
Rather than copying a competitor, look at how large systems solve navigation under pressure. Johns Hopkins Medicine is a useful example because it serves patients, referring physicians, and researchers from one entry point without losing any of them.
Then scale down hard. The best healthcare websites for a small practice look nothing like a health system. They look like one clear path to one clear action, which is also the fastest route to a better patient experience.
A patient experience audit you can run this week
Open your own practice website on your phone and time it. Can you book in under thirty seconds? Does every form field have a visible label? Is there a tracking pixel on the intake page? Do you have a signed BAA with every vendor on the list above? Is your practice information up to date, including hours and insurance? Does the site meet WCAG 2.1 Level AA today, not in May 2027?
If more than one answer is no, the fix is usually smaller than a redesign. Focus on the booking path first, because that is where the money is.
Where to start
Compliance and conversion are not opposed. Practices that handle data security carefully tend to have cleaner, faster sites, because they carry less third-party weight.
If you want this handled rather than managed, explore our website design for wellness and health practitioners service. It is built for exactly this: essential healthcare websites that hold up to both a compliance review and a patient in a hurry.
This article is general information about web design for medical practices, not legal advice. Confirm your own obligations with counsel.
