HIPAA, privacy and legal basics for your website

We don't claim that, and you should be careful of anyone who says it about a whole website. Whether HIPAA applies depends on your practice and how data is handled. The safest setup is to keep health information off your website and inside your secure practice platform.

It shouldn't. Our contact forms ask for basic contact details and warn people not to send health information. Anything clinical belongs in your secure client platform.

In your practice platform, such as Practice Better, Healthie or SimplePractice, under whatever agreement that company offers you. Your website simply links to it.

Most websites that collect any personal information, even a name and email, need one. Several US states have privacy laws, so a tool like Termageddon or a lawyer can help you get one that fits.

It's usually wise. A disclaimer explains that your website's content is general information and doesn't create a client relationship. Ask your insurer or lawyer what yours should say.

A site disclaimer speaks to anyone reading your website. Telehealth consent is an agreement with a specific client about their care, and it belongs in your client paperwork, not on a public page.

Sometimes, but be careful. The FTC requires testimonials to be real and to reflect typical experience or be clearly qualified, and some licensing boards and privacy rules add limits. Get written permission, and never invent or edit one to change its meaning.

We generally advise against it. They can imply results others may not get, raise privacy concerns, and can harm readers, especially around weight and eating disorders.

Be careful. Claims like lose 20 pounds or reverse your diabetes can be misleading and may break FTC rules. Describe what you do and how you help, and leave out promises.

We build to WCAG 2.2 AA basics, such as readable contrast, keyboard use and image descriptions, and check them before launch. It matters because your clients include people with disabilities, and US accessibility rules may apply to you.

It depends on what your site uses and where your visitors live. A tool like Termageddon can set up a banner that fits your site's tools, including whether analytics wait for consent.

Be careful. Never use one to show a person as if they were you, your staff or a real client. For general images of food or objects it can be fine, and we'd check the look and the licence terms.

It needs care. Analytics on public pages can be reasonable, but it should never collect health details, and it shouldn't run inside patient portals or on pages tied to a client's care. If HIPAA applies to you, ask your compliance adviser.

We avoid them on health websites by default. They can send information about visitors to advertising companies, which is a real risk around health topics.

It's helpful, especially if you offer content, programs or downloads. It sets the rules for using your site, and a policy generator or a lawyer can help you write it.

General education is common, but your licence rules and your insurer may set limits, and a clear disclaimer helps. Avoid anything that sounds like personal advice to one reader.