A patient does not visit your website to admire it. They visit because a symptom has lasted longer than it should, a referral slip is sitting on the counter, or the practice they have used for a decade just stopped taking their insurance. They have three questions: do you treat this, do you take my plan, and how do I get in the door.
Most practice websites answer none of those questions in the first screen. They open with a stock photo of a stethoscope, a mission statement about compassionate care, and a navigation menu written in the language of the billing department.
This is the checklist we use when we design for physicians, clinics, and group practices. It is not compliance advice; your privacy officer and counsel have the final word on anything involving patient data. It is what we have learned matters, roughly in the order it matters to the person on the other side of the screen.
1. The three answers, above the fold
Conditions treated, insurance accepted, and how to book. Those three belong on the home page before anyone scrolls, and each should link to a fuller page.
“Conditions treated” is not the same as “services.” A patient searches for the thing they have (“knee pain after running”), not the thing you bill for (“orthopedic consultation”). We write condition pages in the patient’s words and let the service language live underneath.
Insurance deserves its own page with a real list, a date it was last updated, and a plain sentence about what to do if a plan is not listed. A phone number next to that sentence saves your front desk a dozen calls a week.
2. Forms that respect the line between marketing and medicine
Here is where practice websites get into trouble. A contact form on a standard WordPress install stores submissions in a database and emails them to whoever is on the list. That is fine for “I would like to schedule a consultation.” It is not fine for “I have been having chest pain and here are my medications.”
The distinction matters because the moment a form collects protected health information, HIPAA follows it: the form vendor needs to sign a Business Associate Agreement, the data needs encryption at rest, access needs to be logged, and retention needs a policy. Most marketing form plugins do none of that, and their terms of service say so.
- Keep the public contact form to non-clinical fields: name, phone or email, and “what can we help you with” with a short menu (new patient, existing patient, billing, records request).
- Put a visible note above the form: “Please do not include medical details in this form. We will collect your health history securely once your appointment is scheduled.”
- Route anything clinical through the patient portal or a HIPAA-compliant form service with a signed BAA. Link to it clearly; do not bury it.
- Confirm where submissions live. If the answer is “in the WordPress database and Bryan’s inbox,” that is a problem to fix before launch.
- Do not embed a chat widget that invites people to describe symptoms unless the vendor is under a BAA.
3. New-patient pages that cut phone volume
The front desk answers the same eight questions every day. A new-patient page answers them once, well, and lets people arrive prepared.
What to bring. What to expect at the first visit and how long it takes. Where to park and which entrance to use. Whether forms can be completed ahead of time, and a link if they can. Cancellation policy. Telehealth availability. Languages spoken. Whether the practice is accepting new patients at all, which is the single most common question and the one most often missing.
For Dr. Debra Shapiro’s A New View of Food, the original site buried key features like newsletter signups and free downloads where visitors could not find them, and services were left undefined. We put each of her offerings in a bold, clickable box on both the home page and a dedicated Services page so that visitors could see, in one glance, what she does and how to reach her. The same principle applies to a clinical practice: a visitor should never have to guess what you offer or how to start.
4. Provider bios patients actually read
Patients read bios to answer one question: will this person listen to me. Credentials matter, but they come second.
Lead each bio with a sentence about how the provider practices, in their own voice if possible. Then board certifications, training, and hospital affiliations. Then the human details that help someone choose: languages, areas of focus, whether they see children. A current photo taken in the same light as the rest of the team so the roster reads as one practice.
Avoid the word “specialist” unless the certification supports it, and keep any claims about outcomes tied to sources. Your state medical board has advertising rules of its own, and they apply to your website.
5. Accessibility is not optional here
A meaningful share of your patients are older, have low vision, use screen readers, or are navigating your site with a hand that shakes. Healthcare websites are also a frequent target of ADA-related demand letters. Both reasons point the same direction.
Practically: real text instead of text in images, sufficient color contrast (4.5:1 for body copy), form labels attached to fields, keyboard navigation that works, alt text on any image that carries information, and a font size that does not require pinching. If your site has a PDF intake packet, it needs to be tagged and readable, not a scan. We designed twelve ADA-accessible policy reports for UC Berkeley’s Possibility Lab; the discipline transfers directly to clinical documents.
6. Reviews and schema, done honestly
Structured data tells search engines what your site is about in a format they can read directly. For a practice the relevant types are MedicalBusiness or Physician (for individual providers), with name, address, phone, hours, accepted insurance where appropriate, and medical specialty. This is invisible to visitors and useful to search.
Reviews are more delicate. Google only allows review rich results for reviews collected on your own site, not copied from Google or Healthgrades. Any patient testimonial you publish needs written authorization, because a testimonial that identifies a patient and their condition is itself protected health information. And the FTC’s rules on endorsements apply to healthcare as much as anywhere.
Our recommendation: keep the Google Business Profile complete and current, link to it, respond to reviews without confirming that the reviewer is a patient, and publish on-site testimonials only with signed consent and only when they are true.
7. Speed, security, and the boring foundation
A practice website is on the receiving end of constant automated attacks because health data is valuable. The site needs HTTPS everywhere, a maintained WordPress core and plugin set, a web application firewall, daily off-site backups, and someone whose job it is to notice when something breaks at 2 a.m.
Speed matters for a plainer reason: your patients are on phones, often on cellular, often in a parking lot. A home page that loads in under three seconds on a mid-range phone is a reasonable target. Compress images, remove the plugins nobody remembers installing, and host on infrastructure that is not shared with four hundred other sites.
8. What to leave out
Stock photos of models in white coats. A blog nobody has updated since 2021. Auto-playing video. A pop-up asking for an email address before the visitor has found the phone number. Symptom checkers that create liability without creating appointments. Every one of these makes the site feel like it belongs to someone else.
Case study: Dr. Shapiro’s A New View of Food
A physician’s wellness site rebuilt for clarity, warmth, and a growing mailing list.
The website is the first clinical encounter most patients will have with your practice. It should feel like the waiting room you would want: quiet, clear, and staffed by someone who already knows why you are there.
If your site is not doing that, we can help. We have built for physicians, wellness practitioners, and family medicine practices, and we handle the technical parts so you can stay with your patients.
How we help Doctors & Medical Practices →
This article is general information for practice owners, not legal or regulatory compliance advice. Confirm HIPAA, state medical board, and accessibility requirements with your privacy officer and counsel.