What a medical or dental practice website needs

A patient searching for "dermatologist near me" or "emergency dentist" wants three answers fast: does this practice do what I need, what will it cost and when can I get in? A practice website also carries rules a coffee shop's doesn't: health privacy law covers its forms, pricing law covers its notices, and state boards cover its advertising. Below is what to put on the site and what to check.

What patients look for

• Services, with a page for each important one: what it involves, how long it takes, how to prepare.
• Clinicians: name, credentials, specialty and board certification, a short background, a photo.
• Insurance: the plans you're in network with, and what happens if a patient's isn't.
• Prices, or self-pay rates for common services.
• Hours, address, map, parking and access (floor, elevator, step-free entrance).
• Booking: a phone number that can be tapped on mobile, a form or an online calendar.
• What to bring: insurance card, referral, test results, medication list.
• New-patient forms, through a secure portal rather than an email attachment.

Most visits come from phones, and service pages are what show up for searches like "wisdom tooth extraction cost". A single page that lists every service in one block misses exactly those searches.

Online forms and HIPAA

A booking form looks harmless, but when a patient types what's wrong, a covered practice receives protected health information (PHI). What that means in practice:

1. Ask only what booking needs: name, phone, the service and preferred times. The rest belongs in the visit or the patient portal.
2. Use vendors that sign a business associate agreement (BAA). Any form builder, hosting provider or scheduling tool that receives PHI is a business associate. Many popular form tools don't sign BAAs on their standard plans.
3. Encrypt in transit and at rest, and don't route form submissions into a shared inbox many people can read.
4. Mind tracking tools. HHS guidance treats tracking technologies on patient portals and booking flows as handling PHI. In June 2024 a federal court vacated the part that covered visits to public pages combined with an IP address, but pixels on booking and form pages are still the risky part. Keep ad pixels off them unless you know exactly what they send.

The options for online booking (an off-the-shelf tool or your own system) are compared in Online booking for salons and clinics.

The Good Faith Estimate notice

Under the No Surprises Act, providers must give uninsured and self-pay patients a Good Faith Estimate of expected charges, and tell them it's available. The rule requires that notice to be displayed prominently on your website, in the office and wherever scheduling or cost questions happen, and CMS guidance adds that it should be easy to find through a search engine. CMS publishes a model notice; using it isn't mandatory, but most practices do.

Testimonials, photos and advertising rules

• Patient stories and before-and-after photos count as using PHI for marketing, which under HIPAA requires the patient's written authorization. Get it in writing before anything goes on the site.
• Testimonials should reflect typical results, or say clearly when they don't, under the FTC's endorsement rules.
• Specialty claims: many state boards restrict who can call themselves a "specialist", especially in dentistry. Use the exact titles your licence and board certification allow.
• No guarantees. "Pain-free", "guaranteed results" and "best dentist in town" are the kind of claims boards and the FTC look at first.

Reviews and how to reply

Patients read reviews like any other customer: in BrightLocal's 2026 survey, 97% of consumers said they read reviews before choosing a local business. For a practice, the delicate part is the reply. HHS has settled with dental practices that revealed patient details in replies to online reviews, including New Vision Dental in California, which paid $23,000 in 2022. A safe reply stays general and moves the conversation to the phone:

We're sorry to hear about your experience. Please call our front desk so we can talk it through directly.

How to ask for reviews within Google's rules: How to get Google reviews.

Accessibility

Practices are public accommodations under the ADA, and patients include people with low vision, older patients and people using screen readers. Readable text, real buttons, labelled form fields and captions on videos are the basics: Website accessibility: ADA and EAA.

Checklist

1. A page for each important service, with what it costs or a self-pay rate.
2. Clinicians with credentials written exactly as licensed.
3. Accepted insurance listed clearly.
4. The Good Faith Estimate notice on the site.
5. Booking forms that ask only what's needed, with vendors that sign a BAA.
6. No ad pixels on booking, form or portal pages.
7. Written authorization for any patient photo or story.
8. Review replies that never confirm someone is a patient.

The sites we build on our web design page have a page per service, call and booking one tap away on a phone, and forms that ask only for what's needed. We write the copy with the rules above in mind, and you and your clinicians check it before launch.