Every medical practice website operates inside three sets of expectations: privacy rules under HIPAA, accessibility obligations under the ADA, and the trust standards patients apply before they book with anyone. Most practices get vague reassurance from their web vendor on all three and clear answers on none. This guide lays out what actually applies to a practice marketing site, where the real risk sits, and a checklist you can run against your current site today.
One thing before we start: this article is design and web strategy guidance from a team that builds healthcare websites. It is general information, and it is not legal advice. HIPAA and ADA questions turn on the specifics of your practice, your tools, and your state, so review your setup with a qualified healthcare attorney or compliance officer before treating anything here as a final answer.
Key takeaways
- HIPAA governs protected health information. A marketing site that collects none of it sits largely outside HIPAA scope, and keeping it that way is the strategy.
- Forms are where practices cross the line by accident. Symptom fields and appointment details tied to an identifiable person are the problem.
- Any third-party tool that handles patient health information needs a signed Business Associate Agreement.
- WCAG 2.1 AA is the accessibility target referenced in ADA settlements, and healthcare sites are frequent targets for demand letters.
- Trust requirements are practical: consistent practice information, real provider credentials, and visible third-party reviews.
HIPAA: What Actually Applies to a Marketing Site
HIPAA regulates how covered entities, meaning most providers who bill insurance electronically, and their business associates handle protected health information, or PHI. PHI is health information that identifies a person or could reasonably identify one, held or transmitted in connection with care or payment.
Here is the distinction that matters for your website. Your practice has two very different web surfaces:
The marketing site
Public pages describing your services, providers, locations, and how to book. If these pages collect nothing beyond basic contact details, they hold no PHI, and HIPAA has little to say about them. This is the healthy state. The goal of good medical practice website design is to keep the marketing site clean while routing anything clinical into systems built for it.
The patient-facing systems
The portal, telehealth platform, online intake, and scheduling system that knows why the patient is coming in. These handle PHI by definition. They must be purpose-built compliant software, protected by authentication and encryption, and covered by agreements with each vendor. Your website should link to these systems and never try to replicate them in public pages.
Practices get into trouble when the two surfaces blur. Three places deserve your attention.
Forms: the most common mistake
A contact form asking for name, phone, and email is standard marketing machinery. Add a field that says “describe your symptoms” or “which condition are you seeking treatment for,” and the submission becomes health information tied to an identifiable person seeking care from a provider. Now ask where that form data goes: a marketing email inbox, a generic form tool, a spreadsheet. None of those are compliant homes for PHI.
The fix is structural. Keep public forms minimal: name, contact details, and a preferred callback time. Move symptom questions, medical history, and appointment specifics into your compliant intake or scheduling tool. If the form promises “a member of our team will call you,” the clinical conversation happens on that call rather than in a database your marketing stack was never designed to protect.
Third-party tools and the BAA
A Business Associate Agreement is a contract in which a vendor handling PHI on your behalf accepts HIPAA obligations. The rule of thumb: if a tool touches patient health information, you need a BAA with the vendor before the tool goes live. That includes online scheduling tools that capture visit reasons, chat widgets where patients type health questions, transactional email services that send appointment details, and form processors receiving anything clinical.
Two practical notes. First, many mainstream tools will never sign a BAA, and their terms say so. That answers the question of whether you can use them for anything involving PHI. Second, a BAA is the floor rather than the finish line. The tool also has to be configured correctly, which is why an embedded scheduler should come from a healthcare-specific vendor rather than a generic booking plugin.
Analytics and tracking pixels
The federal Office for Civil Rights has published guidance on tracking technologies on provider websites, and ad pixel use in healthcare has driven real enforcement actions and settlements in recent years. The cautious posture for a practice: keep advertising pixels off pages where visitors express care-seeking intent, know exactly what your analytics collects and where it flows, and make the decision deliberately with counsel instead of inheriting whatever your template or agency installed by default. Document what you decided and why.
Accessibility: The ADA and WCAG on a Practice Site
The ADA requires places of public accommodation to be accessible, and courts have applied that to websites for years. Plaintiff firms send demand letters over inaccessible sites at industrial scale, and healthcare is a favorite target because the harm argument writes itself: a patient who cannot use your site cannot book care. Practices receiving federal funds carry further obligations under Section 1557 of the Affordable Care Act. The technical standard referenced in settlement after settlement is WCAG 2.1 Level AA.
Beyond risk, there is the plain fact of who visits a medical site: older patients, people with low vision, people with tremor or limited mobility, people using screen readers. Accessibility failures on a practice site turn away the exact people most likely to need appointments. Here is what WCAG 2.1 AA means in concrete terms for a practice site:
- Contrast: body text at a contrast ratio of at least 4.5 to 1 against its background, including text placed over photos.
- Keyboard access: every menu, button, form, and embedded widget usable without a mouse, with a visible focus indicator.
- Forms: every field programmatically labeled, errors described in text, and no placeholder-only labels that vanish when typing starts.
- Images: alt text that conveys meaning, especially for images that carry information like insurance logos or maps.
- Structure: a logical heading hierarchy screen readers can navigate, and link text that makes sense out of context.
- Motion: animations that respect the reduced-motion preference, and nothing that flashes.
- Touch targets: buttons sized for unsteady hands, which quietly improves mobile conversion for everyone.
Watch your embeds. Practices often achieve an accessible site and then bolt on a third-party scheduler or chat widget that fails keyboard navigation entirely. The patient experiences your site and the widget as one thing, so hold vendors to the same standard. This is also a reason to prefer platforms with clean semantic output. When we build practice sites in Framer, heading structure, contrast, and focus states are part of the design system rather than a retrofit, which is the approach we detail in our complete healthcare website design guide.
Trust Requirements: What Patients Verify Before Booking
The third requirement set has no regulator behind it, and it decides more bookings than the first two combined. Patients cross-check practices. Your site needs to survive that check.
Consistent practice identity
Your practice name, address, and phone number should match everywhere they appear: your website, your Google Business Profile, insurance directories, and hospital affiliation pages. Much of that directory data traces back to NPI records, so keep those current too. When a patient sees one address on your site and another in their insurer’s directory, some fraction of them conclude the practice has moved or closed, and they book elsewhere without telling you.
Provider credentials, fully stated
Every clinician needs a bio page with a real photograph, full name and degrees, board certifications, education and training, languages spoken, and a sentence or two of who they are as a person. Patients search their doctor by name before a first visit. A thin or missing bio sends them to third-party review sites where you have no voice in the narrative. A strong bio page ends with a booking link for that specific provider.
Reviews you did not write
Third-party review counts and ratings beat curated testimonials because patients know you chose the testimonials. Show your Google rating and link to the source. If you quote individual patients, get written permission, keep it specific, and never include health details without explicit authorization, since a testimonial describing treatment is patient information too.
The unglamorous pages
Insurance accepted, new patient instructions, what to bring, parking, hours, after-hours instructions, and a privacy policy that reflects what your site actually does. These pages rarely win design awards and constantly win bookings. Their absence is why practices lose patients to competitors with objectively worse care and better websites. The same holds across specialties, whether you run a family practice, a dental office, or a mental health practice, where privacy expectations run even higher and the tone of the site does real clinical work before the first session.
The Practical Compliance Checklist
Run your current site against this table. Anything failing in the left column deserves attention this month.
| Check | What passing looks like |
|---|---|
| Public forms | No symptom, condition, or treatment fields. Name, contact info, and callback preference only. |
| Form destinations | You can name where every form submission is stored and who can read it. |
| Scheduling and intake | Handled by healthcare-specific tools under signed BAAs, linked from the site rather than rebuilt inside it. |
| Chat widgets | Either absent, or HIPAA-appropriate with a BAA, with no generic chatbot collecting health questions. |
| Analytics and pixels | Inventory documented, ad pixels kept off care-seeking pages, decisions reviewed with counsel. |
| Accessibility | Audited against WCAG 2.1 AA, including embedded third-party widgets, with issues tracked and fixed. |
| Practice identity | Name, address, phone, and hours identical across site, Google Business Profile, and insurance directories. |
| Provider bios | Real photos, credentials, certifications, and a booking path on every clinician page. |
| Reviews | Third-party ratings visible and linked. Testimonials permissioned and free of unauthorized health details. |
| Privacy policy | Current, accurate to your actual data practices, and written in language a patient can read. |
| SSL and security basics | HTTPS everywhere, forms submitted over encrypted connections, no mixed-content warnings. |
| Content freshness | Hours, providers, services, and insurance participation updated the week they change. |
The last row is where most practices quietly fail, and it is a systems problem rather than a diligence problem. If updating the site requires emailing a developer and waiting a week, the site will drift out of date. This is a core reason we build practice sites in Framer: front desk staff can correct hours or add a new provider themselves, the same day, without touching anything structural.
Who Enforces What
A quick orientation to the landscape, because vendors often blur it. HIPAA is enforced by the Office for Civil Rights within the Department of Health and Human Services, with state attorneys general also holding enforcement authority. ADA website claims mostly arrive as private lawsuits and demand letters rather than government action, which is exactly why they are so common. And patient trust is enforced by patients, one silent back-button at a time. The first two produce occasional severe penalties. The third taxes you every single week, which is worth remembering when deciding where to invest first.
Requirements Are the Floor
A practice site can pass every check above and still fail to book patients. Compliance keeps you out of trouble. Conversion comes from clear positioning, visible proof, fast mobile pages, and a booking path on every screen, and the practices that treat requirements as the floor rather than the finish line pull ahead. To see how leading healthcare brands build on top of that floor, read our breakdown of the best healthcare website designs. And when you are ready for a site that handles both layers properly, our healthcare team can walk you through how we build it. Book a call and bring your current site, since the checklist review takes about twenty minutes.
Frequently Asked Questions
Is a regular contact form HIPAA compliant for a medical practice?
A form collecting only name, phone, email, and a callback preference generally stays outside PHI territory because it captures no health information. Risk enters when the form asks about symptoms, conditions, or visit reasons, or when submissions land in tools with no BAA. Keep public forms minimal, route clinical questions into compliant intake software, and confirm the setup with your compliance advisor.
Do small practices really get ADA website complaints?
Yes. Website accessibility demand letters are sent in volume, and small businesses receive a large share of them precisely because their sites are least likely to conform. Healthcare practices make attractive targets because the connection between an inaccessible site and denied access to care is easy to argue. An audit against WCAG 2.1 AA plus documented fixes is the practical defense.
Does my practice need a BAA with its website host?
If your marketing site holds no PHI, the host of that site is generally outside business associate territory, and that is the architecture to aim for. BAAs become necessary for vendors that do touch PHI: your scheduling platform, intake forms, patient email tools, and telehealth system. Map which vendors see health information, then close the BAA gap with each of them.
What is the difference between HIPAA compliance and ADA compliance for a website?
They cover different obligations to different people. HIPAA governs how patient health information is collected, stored, and shared, and it is enforced by federal regulators. ADA accessibility governs whether people with disabilities can actually use your site, and it is mostly enforced through private lawsuits. A practice site needs both: no stray PHI in the marketing stack, and WCAG 2.1 AA conformance for every visitor.