Website builds for medical, dental and wellness practices

A practice website tells patients who the clinicians are, how to book, and what a visit costs. It also sits under federal health rules that reach the code on the page, not only the words, so a scheduling widget or analytics script can raise a privacy question a brochure never would.

Below are the build decisions specific to practices: tracking and forms, accessibility and language notices, booking and provider pages, the estimate notice, and our process. What to write about care and cost is on our healthcare content hub. None of this is legal advice; settle each point with your privacy officer, compliance lead or counsel.

Tracking technologies, forms and HIPAA

The HHS Office for Civil Rights describes a tracking technology as "a script or code on a website or mobile app used to gather information about users." Its guidance says tracking technologies on user-authenticated pages, such as a patient portal or telehealth platform, "generally have access to PHI," and that regulated entities must make sure tracking vendors have signed a business associate agreement and that an applicable permission exists before PHI is disclosed. Where a vendor is not a business associate and no Privacy Rule permission applies, the guidance says patients' HIPAA-compliant authorizations are required first. A notice on the same page says that on June 20, 2024, the U.S. District Court for the Northern District of Texas vacated the guidance to the extent it says HIPAA obligations are triggered when an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. As of October 2026, that notice says HHS "is evaluating its next steps in light of that order."

In a build, that calls for a script inventory: analytics and ad pixels mapped to the pages they load on and kept off portal links, appointment requests and anything behind a login unless the privacy officer approves them. Ask your team, "Which scripts load on our appointment request page, and who approved each one?" Because our standard practice emails form submissions to the business, the privacy officer decides what each form may collect.

Accessibility and language assistance

Practices that receive federal financial assistance from HHS face a specific web standard. The Section 504 regulation at 45 CFR 84.84 requires recipients' web content and mobile apps to meet the "Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1." An interim final rule published May 11, 2026 pushed the compliance dates back a year, to May 11, 2027 for recipients with fifteen or more employees and May 10, 2028 for those with fewer, and those are the dates the eCFR shows as of October 2026. Our builds run automated accessibility checks, but an automated scan is not an audit, and conformance also needs a manual review.

Under Section 1557, 45 CFR 92.11 requires a covered entity to post a notice that it provides language assistance services and auxiliary aids and services free of charge, in English and at least the 15 languages most commonly spoken by people with limited English proficiency in the relevant state or states, including "at a conspicuous location" on its website if it has one. One option to put to counsel is a clearly labeled header or footer link to a notice page holding each translation the practice supplies. Whether either rule covers your practice is a question for counsel.

Booking, provider pages and the estimate notice

The booking button should link into the practice's own scheduling system, and the site should say which visit types can be booked online and which need a call. Each clinician should have a page with credentials, the services they provide, locations, and whether they are accepting new patients as of a stated date.

Under 45 CFR 149.610, information about the availability of good faith estimates for uninsured or self-pay patients must be "prominently displayed (and easily searchable from a public search engine)" on the convening provider's or facility's website, in the office, and on-site where scheduling or cost questions come up. That wording argues against tucking the notice into a PDF behind a login or keeping its page out of search. A plain, indexed page linked from the footer and the cost pages fits that wording better.

How the build runs for a practice

Authority Asset, the first of our four steps, collects confirmed provider credentials, bookable visit types, scheduling and portal links, the approved list of scripts and vendors, and any translated notices. The designer should not have to guess which clinicians are taking new patients or which scripts the privacy officer has cleared, so that record comes first. Hudson Twenty-One records how clinicians explain things, Market Intelligence maps what local patients ask, and AEO Creation turns those inputs into answer-first pages. The build adds JSON-LD, an XML sitemap, redirects, mobile layout checks and a quality gate on copy. Platform follows our usual guidance: WordPress for staff who edit and post, Squarespace for a simple self-managed editor, Netlify for low upkeep with us making edits.