When patients look for a clinic, they usually check online first: what does this clinic treat, who are the doctors, is it open today, do I need to book, and how do I get there? A clinic website's job is to answer these questions clearly and correctly, and to make first-time patients feel at ease.
Unlike an ordinary shop website, a clinic website in the US is covered by several sets of rules at once: the FTC's truth-in-advertising rules, the HIPAA privacy rules for patient information, and your state medical or dental board's rules on advertising. Many common marketing phrases could get a clinic into trouble. This guide covers the pages a clinic website needs, how to write the content, and the legal points to check before going live.
This article summarizes publicly available US federal rules and official guidance for general reference only and is not legal advice. State rules differ, and whether specific content complies depends on the facts; check with your state board or a healthcare lawyer.
What pages does a clinic website need?
How to write content patients understand and trust
Opening hours: put them where everyone sees them
Opening hours are the most-viewed information on a clinic website. Make a clear weekly table showing which doctor sees patients in each session, and put temporary closures and holiday changes prominently on the home page. Keep the hours consistent with your Google Business Profile.
Doctor profiles: facts, not adjectives
Patients want to know a doctor's education, training, board certification and areas of expertise. Concrete facts such as "MD from ○○ University School of Medicine, dermatology residency at ○○ Hospital, board-certified by the American Board of Dermatology" are more convincing than "highly experienced and skilled", and less likely to cross a legal line.
Services: explain "what it is", don't promise "how well it works"
For each service, explain what it is, which situations it suits, roughly what the process is, and what to watch out for. Avoid words like "guaranteed", "cure", "most effective" or "zero risk".
Health articles: they help patients and make the site easier to find
Regularly publishing accurate, easy-to-understand health education articles answers the questions patients search for online, and makes it easier for Google and AI assistants to find your website when answering related questions. Health articles also must not turn into disguised promotion of treatment results.
Check before going live: key medical advertising rules
Which rules apply to a clinic's website?
There is no single "clinic website law" in the US. Several sets of rules overlap, and they apply to your website, social media and ads alike:
- Truth in advertising (FTC): under the FTC Act, claims must be truthful, not misleading, and backed by evidence before you make them. For health claims the FTC expects "competent and reliable scientific evidence", as it explains in its Health Products Compliance Guidance.
- Reviews, testimonials and endorsements (FTC): the Endorsement Guides (16 CFR Part 255) say testimonials must reflect real experience, must not imply that unusual results are typical, and paid or family connections must be disclosed. The Consumer Review Rule (16 CFR Part 465), in force since October 2024, bans fake reviews, undisclosed reviews by staff, incentives tied to positive (or negative) reviews, and hiding bad reviews while presenting the rest as all of them.
- Patient privacy (HIPAA): most clinics that bill health insurance are HIPAA "covered entities". Using a patient's name, photo or story to promote the clinic is marketing, which needs the patient's written authorization (45 CFR 164.508(a)(3)).
- Your state board's rules: each state's medical and dental boards set their own advertising rules, and they differ. California, for example, requires before-and-after photos to say which procedure was performed and that results may vary, models to be labeled as models, and limits which boards a doctor may cite when advertising "board certified" (Business and Professions Code §651).
3 things to do before going live
- Post your Notice of Privacy Practices: a HIPAA covered entity with a website about its services must prominently post its notice of privacy practices on the site and make it available electronically there (45 CFR 164.520(c)(3)(i)). Link to it from the footer and next to every form.
- Post the Good Faith Estimate notice: under the No Surprises Act, providers must tell uninsured and self-pay patients that they can get a Good Faith Estimate of costs, and the notice must be prominently displayed on the website, in the office and where scheduling happens (45 CFR 149.610). CMS publishes a model notice you can adapt.
- Check your state board's advertising rules: look up your state medical or dental board's rules on advertising, credentials (such as "board certified" or "specialist") and before-and-after photos, and have every page checked against them. Date your health articles and name their sources and the doctor who reviewed them, so patients can see they are information, not ads.
What can you include?
- Clinic name, address, phone, directions, opening hours
- Doctors' names, degrees and training, state license, board certifications from recognized boards
- Insurance plans you accept (including Medicare or Medicaid if you take them), specialties
- Facilities, services, how to book, contact details
- Names of conditions, treatments and tests, self-pay prices with what they include
- Health articles with dates, sources and the reviewing doctor
- Real patient reviews and testimonials, with written HIPAA authorization and a note on typical results where needed
Don't write it like this
Below are the patterns most likely to get a clinic website into trouble with the FTC, HHS (which enforces HIPAA) or a state board:
Be especially careful with offers and reviews. Imagine a dental practice in Phoenix that adds a banner to its website: "Leave us a 5-star Google review and get $50 off your next cleaning!" The FTC's Consumer Review Rule prohibits incentives conditioned on a review expressing a particular sentiment, so this offer is exactly what the rule bans; asking every patient for an honest review, with no strings attached, is fine. Replies to reviews are a second trap: HHS has settled with dental practices that revealed patients' treatment or insurance details while answering online reviews, including a $23,000 settlement announced in December 2022. Thank reviewers in general terms and take anything specific offline.
What happens if you break the rules
The FTC can order a clinic to stop deceptive advertising, and for knowing violations of an FTC rule such as the Consumer Review Rule it can seek civil penalties of up to $53,088 per violation (the current amount in 16 CFR 1.98, adjusted for inflation). HIPAA violations, such as posting patient testimonials without authorization or revealing patient details in review replies, can lead to HHS settlements, corrective action plans and civil money penalties; in 2016 a physical therapy practice paid $25,000 over website testimonials posted without valid authorization. State boards can also discipline the doctor's license, and state attorneys general enforce state consumer-protection laws.
Sources: Endorsement Guides, 16 CFR Part 255, Consumer Review Rule, 16 CFR Part 465, FTC civil penalty amounts, 16 CFR 1.98, HIPAA authorizations, 45 CFR 164.508 and notice of privacy practices, 45 CFR 164.520 (Electronic Code of Federal Regulations).
Booking and contact forms: mind personal data too
Online booking or contact forms collect patients' names, phone numbers and sometimes descriptions of symptoms. For a clinic, all of this is sensitive information.
If your clinic is a HIPAA covered entity, information that ties a person to your clinic, even a name and phone number on an appointment request, can count as protected health information. It has to be handled with HIPAA's safeguards, and an outside service that stores or handles it for you (a form tool, email, scheduling software) generally needs to sign a business associate agreement (BAA) with you. Some states add their own health-privacy laws on top. So booking forms are best kept short and should not ask patients for their medical history or detailed symptoms.
In practice, we suggest:
- Ask only for what the form needs: name, phone or email, and the preferred time; symptoms, medical history and insurance numbers can wait until the visit.
- Know where the data goes: ask your form or scheduling provider whether it will sign a BAA. If it won't, use the website form only for simple call-back requests, and link to a HIPAA-compliant scheduling system or patient portal for anything more.
- Explain the form in plain words: for example, "○○ Clinic uses your name and phone number only to arrange your appointment and contact you. Please don't include medical details here. See our Notice of Privacy Practices for how we protect your information."
- Keep ad trackers off form and booking pages: advertising pixels on these pages can pass patient information to ad platforms, which regulators have acted against.
- Don't use the form for emergencies: add a reminder next to the form: "If this is a medical emergency, call 911."
Building a clinic website with an AI website builder
Taking C Building as an example:
- Describe your clinic: for example, "A family medicine clinic in Columbus, Ohio, with two doctors, covering primary care, chronic conditions and adult physicals; most patients are local families and seniors; clean, trustworthy style."
- The AI builds the first version: based on your description, the AI plans the pages and builds a complete website, layout and copy included, in a few minutes.
- Replace it with your real information: doctors' education and training, services, the opening-hours schedule, photos of the clinic. You can tell the AI "make the opening hours a weekly table", or click the text on the page and change it yourself.
- Add a booking form: ask the AI to add a booking-request form; when a patient submits it, it goes to your form inbox and the clinic gets an email. This collects booking requests; it isn't a real-time scheduling system. Keep it to name, contact details and preferred time, and if your clinic already uses a HIPAA-compliant scheduling system or patient portal, link to it instead.
- Check every page against the rules: AI-written copy is a starting point. Before publishing, the clinic must check every page, remove any superlatives, promises of results or review-for-discount wording, make sure every testimonial and before-and-after photo has the patient's written authorization, and link your Notice of Privacy Practices and Good Faith Estimate notice.
- Preview on a phone, then publish, and add the website link to your Google Business Profile.
C Building also has an articles feature you can use to publish health education articles.
Frequently asked questions
Can a clinic website show patients' before-and-after photos?
Yes, with care. Photos of real patients are protected health information, so get each patient's written HIPAA authorization before using them. The FTC treats before-and-after results like testimonials: if they aren't what patients generally achieve, say clearly what typical results are. Don't retouch the photos, keep lighting and angles comparable, say which procedure was performed, and note that results vary; some states, such as California, write these points into law. We suggest presenting them together with full information on who the treatment suits, its risks and its side effects.
Can a clinic website publish prices for self-paid treatments?
Yes, and showing prices actually reduces patients' doubts. Keep them accurate and say what each price includes and any conditions. For uninsured or self-pay patients, the No Surprises Act also requires you to give a Good Faith Estimate when they schedule or ask, and to post a notice of that right on your website. Don't tie discounts to reviews.
What happens if a clinic website breaks the medical advertising rules?
The FTC can order the clinic to stop, and knowing violations of an FTC rule such as the Consumer Review Rule can bring civil penalties of up to $53,088 per violation (16 CFR 1.98). Using patients' information without authorization can lead to HHS settlements and HIPAA civil money penalties, and your state board can discipline the doctor's license.
Does a clinic website need online registration?
Not necessarily. Clinics that already have a registration system can just link to it from the website; if you don't have one, start with phone booking plus a booking-request form on the website. What matters is that patients can see at a glance how to book.
How much does a clinic website cost?
With an AI website builder, the first year including the domain is about US$250: C Building's Pro plan at US$20 a month (US$240 a year) plus a .com domain at about US$10–11 a year (Cloudflare Registrar, which sells domains at cost, listed $10.46 on October 28, 2026). Agency prices vary widely with the number of pages and features, so get several quotes and compare. A HIPAA-compliant scheduling system or patient portal, if you need one, is a separate cost. For a detailed comparison, see How much does it cost to build a website with AI?.
The bottom line
A clinic website comes down to "accuracy" and "trust": correct opening hours, clear doctor credentials, easy-to-understand service descriptions, and every sentence able to stand up to medical regulations. Prepare factual content first, check every page against the rules before going live, then keep answering patients' questions with health education articles.
To see what kind of website AI would build for your clinic, start with C Building's Free plan, no credit card needed.
Legal content and prices checked on October 28, 2026 against the Electronic Code of Federal Regulations (16 CFR Parts 1, 255 and 465; 45 CFR Parts 149 and 164), FTC and HHS guidance and announcements, CMS's No Surprises Act materials, California Business and Professions Code §651, and C Building's pricing page. Laws change and state rules differ, so check your state board and a healthcare lawyer before going live.