Medical website design: what a practice site needs in 2026

What a medical practice website has to do

A medical practice website has to help a patient decide, then act: call, book or log in. Visitors want to know if you take their insurance and how soon they can be seen.

Most of that work happens on a small-practice budget. In the AMA’s 2024 benchmark survey, 47% of physicians worked in practices with 10 or fewer physicians.

That gives the site six jobs:

• Call, book or request. A tap-to-call number and a booking button on every page, built for phones first.
• Answer insurance and cost questions. Plans you accept, self-pay options and any membership fee.
• Send current patients to the portal. Portal login, bill pay and refills where patients look for them. In 2024 federal survey data, 87% of people whose provider encouraged portal use used it, against 57% of those who weren’t encouraged.
• Show who treats patients. Physician profiles with credentials worded the way your state allows.
• Handle patient information safely. Forms, booking and tracking set up for HIPAA, the federal health privacy law.
• Post the required notices. Privacy, nondiscrimination and Good Faith Estimate notices, and for some practices a billing-protection notice.

Reviews matter too: 84% of respondents use them to evaluate physicians at least some of the time, in a Software Advice survey cited by the Texas Medical Association (third-party; year not stated).

The ways to get a medical website

The quick verdict: to own the site, use WordPress with forms and booking from a vendor that signs a HIPAA agreement. For one bill with a HIPAA option built in, Wix Business is the clearest general-builder route. Medical marketing vendors do the whole job, but only one of the seven we checked publishes a monthly website price, so read the contract first.

1. A general website builder

Wix. Wix’s help center explains how to turn on protection for PHI (protected health information) and sign a Business Associate Agreement (BAA) on Business plans and up. Business is $39 a month billed yearly. With HIPAA on, Wix hides non-compliant apps and identifying analytics, and you must disconnect Facebook and Instagram.

Squarespace. Fine for a brochure site, but its own forms aren’t covered by a BAA. For booking, only Acuity Scheduling Premium lists a signed BAA, at $55 a month billed yearly ($69 billed monthly), and that BAA doesn’t cover other Squarespace features. Squarespace Core is $29 a month billed yearly ($39 billed monthly).

2. WordPress with HIPAA-ready forms and booking

Self-hosted WordPress is free software that runs on web hosting you pay for. Most medical agency client sites we inspected run on it, including sites credited to Practis, Rosemont Media and NEXT Digital.

Under HHS cloud guidance, a host or form service that stores patient form entries is a business associate and needs a BAA. Either choose a host and form plugin service that will sign one, or send intake and booking to a tool that does, such as your EHR’s patient portal, Tebra or Acuity Premium.

We build on WordPress every week, so weigh our bias. The case for it is ownership: the files and database are yours, and any WordPress host can run them.

3. A medical website vendor

Healthcare marketing companies design and host the site, and most also sell SEO or ads. Here is what each puts in writing.

Officite’s terms say that if you cancel early you still owe the rest of the initial term, and that Officite may delete your data when service ends. Tebra’s help center says a site deactivates on the last day of your subscription or 30 days after your final payment.

Fit matters too: Etna focuses on aesthetic medicine, RemedyConnect on pediatrics, and Tebra pairs sites with its EHR software.

The routes side by side

The exit score, out of 10, measures how much of your site comes with you if you switch. See our exit scores tool and the details in our guide to leaving your website builder.

Healthcare website design that turns visitors into patients

Good healthcare website design makes the next step obvious. These ideas come from our medical website examples.

• Lead with access. Put “Book” and a phone number in the header. If you see people quickly, say so, as Greater Rochester Orthopaedics does: “New patients seen within 24-48 hours. No referral needed.”
• Split new and current patients. New patients need booking, insurance and directions; current patients need the portal, bill pay and refills. Tribeca Pediatrics puts a portal button in its header.
• Answer insurance plainly. List the plans you take, as Lake Forest Pediatrics does with a linked in-network list. Membership practices should state the fee, as One Medical does with its $99 a year price.
• One page per physician and office. Patients search by doctor name and by town, so give each a page with hours and a phone number.

Medical spa website design

A med spa site sells consultations, so treatment pages, before-and-after photos, offers with their terms and a booking button do most of the work. SkinSpirit, for example, puts “Book now” buttons and a first-treatment offer up front. Etna Interactive and Optimized360 both list med spas among the specialties they serve.

The privacy rules can differ. HIPAA covers a provider only if it handles certain transactions, such as insurance claims, electronically, so a cash-only med spa may fall outside it. State health-data laws such as Washington’s can still apply, and the FTC’s Health Breach Notification Rule can reach a non-HIPAA business that offers patient accounts or health trackers.

The rules your site has to follow

These are the main federal rules and a few state examples as of October 2026. This is general information, not legal advice; confirm your setup with a healthcare attorney.

HIPAA: who it covers and the BAA

HHS says a provider is a HIPAA covered entity only if it sends information electronically for a transaction HHS has a standard for, such as an insurance claim. That’s most physician practices. If it’s you, any vendor that creates, receives, stores or sends patient information for you must sign a BAA, even if it can’t read the encrypted data.

HIPAA: tracking pixels

The HHS bulletin on online tracking, revised March 18, 2024, says trackers on logged-in pages such as patient portals generally have access to patient information, and scheduling or symptom-checker pages can capture it too. A tracking vendor must sign a BAA, or patients must give HIPAA authorization, before it gets their information. A cookie banner doesn’t count.

On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated one part: the idea that an IP address plus a visit to a public, logged-out page about health conditions or providers triggers HIPAA. HHS still says it is “evaluating its next steps.” The rest stands, so keep ad pixels off booking, form and portal pages unless the vendor signs a BAA.

Notice of Privacy Practices

A covered entity “must prominently post and make available its notice on any web site it maintains” that describes its services (45 CFR 164.520(c)(3)(i)), per HHS. A footer link on every page is the usual approach.

No Surprises Act: two different notices

• Good Faith Estimate notice (all state-licensed providers). Uninsured and self-pay patients have a right to a cost estimate, and 45 CFR 149.610 requires that notice to be “prominently displayed (and easily searchable from a public search engine)” on your website, in the office and where scheduling happens.
• Balance-billing disclosure (hospital and surgery-center work only). 45 CFR 149.430 requires a disclosure of surprise-billing protections on a searchable homepage. It applies to hospitals, hospital outpatient departments, critical access hospitals and ambulatory surgical centers, and to providers who work in them, such as surgeons, anesthesiologists and radiologists. A purely office-based practice is exempt.

Section 1557 nondiscrimination notices

Practices that receive HHS financial assistance must post a notice of nondiscrimination at a conspicuous spot on their website (45 CFR 92.10). A law-firm summary says the 2024 rule counts Medicare Part B payments as that assistance; we couldn’t confirm that on HHS’s site. Section 92.11 adds taglines in your state’s 15 most common languages among people with limited English. A benefits firm reported that HHS paused enforcement of these notice rules in May 2025; we couldn’t confirm that on hhs.gov, and the text is unchanged.

Accessibility: Section 504 and the ADA

HHS’s Section 504 rule (45 CFR 84.84) requires recipients of HHS financial assistance to make websites and apps meet WCAG 2.1 Level A and AA. An interim final rule published May 11, 2026 moved the dates back a year: May 11, 2027 with 15 or more employees, May 10, 2028 with fewer. The standard didn’t change. Separately, the Justice Department says the ADA covers the web content of businesses open to the public. See our web accessibility entry.

Washington’s My Health My Data Act

Businesses that operate in Washington or target its consumers and handle consumer health data must “prominently publish a link” to a consumer health data privacy policy on the homepage and get consent to collect or share that data. Geofencing health care providers to track people or send ads is banned. HIPAA-covered patient information is exempt, so the law matters most for med spas and wellness businesses.

“Board certified” and other claims

• California. Under Business and Professions Code 651, “board certified” must name the full certifying board, and only qualifying boards count. Before-and-after photos must state the procedures, be comparable in presentation, and say “the same ‘before’ and ‘after’ results may not occur for all patients.”
• Texas. The Texas Medical Board allows “board certified” only for ABMS member boards, the AOA Bureau of Osteopathic Specialists and a few other accepted boards (22 TAC 164.4). Its advertising rule treats “board eligible” as misleading and requires testimonials to disclose any compensation.

Reviews and testimonials

The FTC’s reviews and testimonials rule, in effect since October 21, 2024, bans fake or AI-written reviews, paying for reviews on the condition that they’re positive, and undisclosed staff reviews.

Pre-launch checklist

1. Your domain name is registered in the practice’s name, at a registrar you can log in to.
2. Every vendor that touches patient details (host, forms, booking, chat) has signed a BAA, or the form collects no health details.
3. No ad or analytics pixels run on booking, form or portal pages without a BAA.
4. The footer links your Notice of Privacy Practices, nondiscrimination notice and accessibility statement.
5. The Good Faith Estimate notice is easy to find, plus the balance-billing disclosure if you work in hospitals or surgery centers.
6. Menus, forms and buttons work by keyboard, with a WCAG 2.1 AA review planned before your Section 504 date.
7. Credentials name the certifying board, and before-and-after photos carry your state’s disclaimers.
8. You know your contract term, notice period, and who owns the design and domain.

Getting found after launch

Search traffic grows from useful local pages: one per main condition or service, one per office, one per physician. Our SEO entry covers the basics. Our sister site, SEO PPC Management, covers SEO and Google Ads for healthcare practices.

Where to go next

• How much a medical website costs: 3-year totals from published prices, math shown.
• Medical website examples: 14 practice sites and an idea to copy from each.
• Best website builders for small business: our picks for local service businesses.
• Dental website design and therapist websites: our guides for dental and therapy practices.
• Terms to know: web hosting, plugin and web accessibility.

Website guides for other industries: Real estate, Law firms, Dental, Therapists, Contractors, Electricians, Restaurants, Schools.