Choosing a healthcare website design company comes down to one question the portfolio can't answer: does this firm understand that your website is a system that can leak protected health information? Most can build an attractive practice site. Far fewer can tell you, correctly and with a date attached, what the current rules on website tracking technologies actually say — and that specific knowledge gap is where practices get hurt.
This guide covers what changed legally in 2024 and where it stands now, the design requirements unique to healthcare, what medical website design realistically costs, and the questions that separate a healthcare specialist from a generalist with a stethoscope stock photo.
The tracking-technology rules: what actually happened
This is the single most misreported topic in healthcare web design, and you will find agency blog posts on both wrong sides of it. The timeline matters:
- December 2022: HHS Office for Civil Rights published a bulletin on online tracking technologies, taking the position that when a tracking tool on an unauthenticated public webpage connected a visitor's IP address with a visit to a page about a specific health condition or provider, that combination could constitute individually identifiable health information — triggering HIPAA obligations. OCR revised the bulletin in March 2024.
- June 20, 2024: The U.S. District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra that HHS had exceeded its authority, and vacated that “proscribed combination” portion of the guidance (AHA; Holland & Knight analysis).
- August 29, 2024: OCR withdrew its appeal, leaving that portion vacated (AHA).
The practical read: the aggressive interpretation of unauthenticated marketing pages was struck down, but the core obligation is untouched. Any part of your site where a patient logs in, books, pays, or submits information is handling PHI, and a third-party script on those pages is a business associate problem. An agency that tells you “all pixels are illegal now” is working from 2023. An agency that tells you “the court threw it out, you're fine” is going to get you in trouble. This is not legal advice — verify your specific situation with healthcare counsel. But your web firm should be able to describe the above accurately, unprompted.
What healthcare websites need that other sites don't
- A clean separation between marketing pages and PHI surfaces. Analytics and advertising scripts belong on the former and must be deliberately excluded from the latter — portal pages, booking flows, intake forms, symptom checkers, and anything post-authentication.
- Business associate agreements for anything that touches PHI. Your hosting, your forms provider, your scheduling widget, your chat tool. If a vendor won't sign a BAA, it cannot sit on a page where patients identify themselves.
- Forms that don't email PHI. A contact form that mails patient details to a practice inbox in plaintext is a routine, serious finding. Submissions need to land in an encrypted store with access controls, not in someone's Gmail.
- Genuine accessibility. Healthcare serves a population with a higher-than-average prevalence of visual, motor, and cognitive impairment, and healthcare organisations face both ADA exposure and Section 504/1557 obligations. WCAG 2.1 AA should be an acceptance condition, not an aspiration.
- Provider and location data as structured content. Physician directories and location pages want proper schema markup and a maintainable data model — not 40 hand-built pages that drift out of date the moment someone joins or leaves.
- Speed on mobile, specifically. Patients search for care on phones, often urgently. Deloitte's analysis of 30 million sessions found a 0.1-second mobile speed improvement moved conversions measurably across sectors (Milliseconds Make Millions) — and a slow site loses an urgent-care search to the next result in a way a slow B2B site never does.
What medical website design actually costs
Healthcare sites price above general small-business web design for structural reasons, not because agencies charge a specialty premium for the word “medical.” General 2026 market research puts small-business builds at roughly $1,000–$48,000 with small agencies typically at $6,000–$12,000 (WebFX pricing research, 2026 — a vendor source, useful for range only). Healthcare projects sit higher because of what has to be added:
Every row above is engineering time, not markup. A practice site with real scheduling integration and compliant intake is a Tier 3 project in the terms we use in our website design packages breakdown — it's custom software with a website attached, and it should be scoped that way rather than quoted off a page count.
Questions that identify a genuine healthcare specialist
“Walk me through the current status of the OCR online tracking guidance.”
The correct answer references the June 2024 vacatur in AHA v. Becerra, notes that HHS withdrew its appeal in August 2024, and immediately clarifies that authenticated pages and any PHI-handling surface remain fully covered. Vagueness here — in either direction — is disqualifying for a firm claiming healthcare expertise.
“Which of our vendors will need a BAA, and will you manage that?”
A specialist inventories this at discovery: hosting, forms, scheduling, chat, analytics on PHI surfaces. A generalist has never had the conversation and will treat it as your lawyer's problem after launch.
“Where do patient form submissions physically go?”
If the answer is “they email to the office,” stop. Submissions containing patient information need encrypted storage with access controls and an audit trail. This is the most common defect we find on existing practice sites, and it's usually invisible from the front end.
“How will this integrate with our EHR or practice management system?”
“We'll link to your portal” is a valid, honest answer for a smaller build. “We'll integrate with anything” without asking which system you run is not. Real integration work starts with the vendor's API documentation and its limits.
“Who owns the site, the hosting, and the patient data on the day we leave?”
You should own all three, and the data question is not rhetorical — if intake submissions live in a system the agency controls, changing agencies becomes a records-custody problem, not just a migration.
The honest verdict
Pick the firm that treats your website as a PHI-adjacent system with a marketing layer on top — not a marketing site with a compliance disclaimer. In practice, the filter is simple: ask about the OCR tracking guidance and about where form submissions physically land. A genuine healthcare website design company answers both precisely and with dates. Everyone else will reach for their portfolio.
Then score what you have. Our 42-point evaluation criteria covers the accessibility, performance, and ownership checks that matter most in healthcare, and turns a redesign conversation into a priceable defect list. If the requirement extends past the website into scheduling, intake, records workflow, or reporting, that's a software project — see custom healthcare software development, and workflow automation for behavioral health if you're in that setting specifically. Legal is the other vertical where a professional-conduct rulebook shapes the build rather than decorating it — law firm website design cost and compliance covers the bar advertising equivalent of everything above.
Security and compliance are where we start, not where we bolt on — we build HIPAA-conscious websites, the software behind them, and the automation that connects intake to the systems your staff actually use. Get a scoped proposal, or take the free automation audit to see whether your website or your intake workflow is costing you more.
Frequently Asked Questions
Can healthcare websites use Google Analytics or advertising pixels?
On general marketing pages, the position is far less restrictive than it was: in June 2024 a federal court vacated OCR's guidance that connecting an IP address to a visit to an unauthenticated health-topic page automatically created PHI, and HHS withdrew its appeal that August. What did not change is that authenticated pages, patient portals, booking flows, and intake forms handle PHI — third-party scripts do not belong there without a BAA. Scope tags by page class, and confirm your specific situation with healthcare counsel rather than relying on any agency's summary, including this one.
How much does a medical practice website cost?
Expect to sit above general small-business web design, which 2026 research places at roughly $6,000–$12,000 for a small agency build. Healthcare adds encrypted intake handling, BAA-covered vendors, analytics scoped away from PHI surfaces, accessibility as an acceptance condition, clinical content review, and often EHR or scheduling integration. Each is engineering time rather than a specialty markup. A practice site with real scheduling integration should be scoped as a software project, not quoted off a page count.
Does a doctor's website need to be HIPAA compliant?
The parts that touch patient information do. A purely informational page listing your services and hours isn't handling PHI. The moment a patient submits a form, books an appointment, uses a chat widget to describe a symptom, or logs into a portal, you're handling PHI and the surrounding infrastructure — hosting, form storage, any third-party script on that page — falls under HIPAA. The most common real-world failure is a contact form emailing patient details to a practice inbox in plaintext.
What should I look for in a healthcare website design company?
Three things above portfolio quality: an accurate, dated account of the current OCR tracking-technology position; a discovery process that inventories which vendors need business associate agreements; and a specific answer to where patient form submissions are physically stored. Add WCAG 2.1 AA as a written acceptance condition, and confirm you own the domain, hosting, source code, analytics, and any stored patient submissions on the day the relationship ends.