A good healthcare website design agency does three things a general agency often skips: it designs around patient tasks (finding a provider, booking, reaching the portal), it knows exactly which parts of your site can touch protected health information, and it builds to WCAG 2.1 AA from the first wireframe. Hire the team that can show you its form, booking, chat, and analytics plan, name the vendors that will sign a Business Associate Agreement, and explain when your compliance or legal team must review a decision. Visual polish is the easy part to find.
The gap between agencies is wide. When I reviewed 60 healthcare portfolios and proposals while building our list of top healthcare website design companies, only 14 explained how they would handle form data, tracking scripts, and BAAs before launch. The rest focused on brand and conversion and left the riskiest decisions for the client to discover later.
Below: where HIPAA actually applies to a marketing site, the accessibility rules that now carry dates, medical SEO, realistic US costs, and the questions and red flags I use to evaluate agencies.
What Makes Healthcare Website Design Different
A healthcare website is a service tool first and a brand site second. Most visitors arrive with a task, often while worried or in pain, and leave the moment it feels hard. Good agencies design around those tasks:
- Patient journeys: separate paths for new patients, existing patients, caregivers, and referring physicians, each with its own next step.
- Provider and location finders: search by specialty, location, language, and insurance, with profiles that stay current.
- Appointment booking: a clear route to schedule, request, or call, usually through a scheduling vendor rather than a custom build.
- Patient portal entry points: an obvious "Log in" path that hands off cleanly to the portal (Epic MyChart, athenahealth, or similar).
- Clinical credibility: real provider credentials, medical review dates, and clear contact details.
- Plain-language content: conditions and treatments explained for patients, with accuracy signed off by a clinician.
The strongest teams start with a service inventory, not a moodboard: locations, providers, service lines, and which systems hold that data. If an agency talks about your hero image before your provider data, keep looking.
Where HIPAA Applies to a Healthcare Website (and Where It Doesn't)
HIPAA applies to covered entities (health plans, clearinghouses, and providers that bill electronically) and their business associates. It protects PHI: identifiable information about a person's health, care, or payment for care. A page that describes your cardiology services is not PHI. A form where a named person types "chest pain, need appointment Tuesday" is.
A typical marketing site is mostly outside HIPAA. Four features pull it back in.
Pages that are usually outside HIPAA
Service pages, provider bios, locations, careers, news, and general health education are public information. They can be built and hosted like any marketing site, as long as nothing on them collects information about a specific person's health.
The four places PHI shows up
- Contact and appointment forms. "Request an appointment" forms collect names plus reasons for a visit, so the form tool, the inbox it emails, and its database all handle PHI.
- Online booking and symptom checkers. Even without a login, these collect identifiable health details.
- Chat widgets and AI assistants. Patients type symptoms into any chat box, whatever the placeholder says.
- Tracking technologies. Analytics tags, ad pixels, session replay, and heatmaps can send page URLs, form inputs, and IP addresses to third parties.
Online tracking technologies: what HHS said and what a court changed
The HHS Office for Civil Rights published a bulletin on the use of online tracking technologies by covered entities and business associates. It says tracking on logged-in pages, such as a patient portal, generally has access to PHI, and that tracking on booking pages, symptom checkers, and portal login or registration pages can also disclose PHI. It also says a cookie consent banner is not a valid HIPAA authorization.
On June 20, 2024, a federal court in the Northern District of Texas (American Hospital Association v. Becerra) declared unlawful and vacated one part of that guidance: the position that HIPAA is triggered when a tracking tool connects a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS shows that notice at the top of the bulletin. The rest of the guidance stands, so the ruling is no license to put ad pixels on booking flows or portal pages. A HIPAA-aware agency audits every tag, removes third-party tracking from forms, scheduling, chat, and portal entry pages, and keeps identifiable data away from vendors that won't sign a BAA.
Business Associate Agreements: who signs what
A BAA is a contract in which a vendor that creates, receives, maintains, or transmits PHI on your behalf agrees to protect it under HIPAA rules. The project question: which vendors will touch PHI, and will each sign?
- Form, scheduling, chat, CRM, and email vendors that receive patient submissions usually need a BAA.
- Your hosting provider needs one if PHI is stored or processed on its servers.
- The agency itself needs one only if its people will access PHI, for example by managing form submissions or debugging a live booking integration.
- A purely static marketing site with no PHI flowing through it usually needs no BAA from the host or the agency.
Digital health startups should check a step earlier. If you sell directly to consumers and are neither a covered entity nor a business associate, HIPAA may not apply, but the FTC's Health Breach Notification Rule can, along with state health privacy laws.
When to bring in compliance or legal
A web design agency is not a law firm, and a good one says so. Involve your privacy officer, compliance team, or healthcare counsel to decide whether you are a covered entity, which vendors must sign BAAs, how tracking works on pages that touch care, what your privacy notice says, and how to respond to a suspected disclosure. The agency surfaces these decisions early, documents data flows, and builds what compliance approves.
Accessibility: WCAG 2.1 AA, Section 504, Section 1557, and the ADA
For most healthcare organizations accessibility is a legal requirement with dates attached, and it is what agencies most often under-scope.
- Section 504. If you receive federal financial assistance from HHS, as most hospitals and many clinics do, the Section 504 rule adopted WCAG 2.1 Level A and AA as the standard for your web content and mobile apps, including content provided through vendors and contracts. Under 45 CFR 84.84, compliance is required from May 11, 2027 for organizations with 15 or more employees and from May 10, 2028 for smaller ones.
- The date change. Those dates were originally May 11, 2026 and May 10, 2027. HHS pushed both back by one year in a May 2026 interim final rule extending the compliance dates.
- Section 1557. The 2024 Section 1557 final rule requires covered health programs delivered through information and communication technology to be accessible, and it requires recipients' websites and apps to meet Section 504 requirements.
- The ADA. Private practices that do not receive federal funding are still public accommodations under the ADA. There is no regulatory technical standard for them, but WCAG 2.1 AA is the practical target I would hold any agency to.
Put it in the contract: WCAG 2.1 AA conformance, screen reader and keyboard testing (not just an automated scanner), and accessible forms, PDFs, and third-party widgets. Scheduling and chat embeds fail most often in the sites I review, because nobody owned testing them.
SEO and Content for Medical Topics
Health is the clearest example of what Google calls "Your Money or Your Life" content. Google's Search Quality Rater Guidelines tell raters to apply very high page quality standards to YMYL topics because poor pages could harm people's health. Raters do not rank pages, but the guidelines show what Google wants to reward: visible medical expertise.
- Medically reviewed content: every condition and treatment page should name a clinical reviewer and a review date, and the CMS should make that easy to maintain.
- Provider pages: one page per provider with credentials, specialties, locations, languages, and booking, marked up with structured data such as schema.org's Physician type.
- Local SEO: one page per location with consistent name, address, phone, and hours, matching each business listing.
- Migration discipline: in a redesign, every old URL needs a mapped redirect, or condition-page rankings built over years can vanish in days.
What a Healthcare Website Costs in the US
Provider data, integrations, accessibility testing, and clinical and compliance reviews make healthcare sites pricier than comparable marketing sites. Typical US agency ranges in the proposals I review in 2026:
- Single practice or small clinic: about $15,000 to $40,000 for a custom site of 15 to 40 pages with a booking embed and secure forms.
- Multi-location group or digital health startup: about $40,000 to $120,000, with provider and location finders, CMS structure, integrations, and content strategy.
- Hospital or health system: usually $150,000 to $500,000 or more, driven by service lines, hundreds of providers, EHR and scheduling integrations, governance, and multi-stage accessibility audits.
The main price drivers are templates and integrations, how much content the agency writes, accessibility testing depth, and HIPAA-eligible tooling. BAA-backed form, chat, and hosting plans also usually cost more each month than standard tiers. For redesign budgets beyond healthcare, see what a full website redesign typically costs.
How to Evaluate a Healthcare Web Design Agency
Start with the general process in our guide on how to choose a web design agency, then add these healthcare-specific checks.
Portfolio
Look for live healthcare sites, not mockups. On your phone, find a provider and start a booking, then tab through a form with your keyboard. Ask which parts the agency built and which came from vendors.
Compliance process and vendor stack
Ask for a sample data-flow map from a past project: what each form collects, where it goes, and which vendors sign BAAs. Strong agencies have a default HIPAA-eligible stack for forms, scheduling, and hosting and can explain each choice.
Security and QA
Expect HTTPS everywhere, least-privilege CMS roles, multi-factor authentication for admins, a pre-launch tag audit, and documented accessibility testing, each with a named owner.
Questions to Ask Before You Sign
- "Which pages and features on our site could collect PHI?" A good answer names forms, booking, chat, and tracking without prompting.
- "Which vendors will sign a BAA, and will you?" Listen for specifics, not "we're HIPAA compliant."
- "How will you configure analytics and ad tags on booking, form, and portal pages?"
- "How do you test for WCAG 2.1 AA, and what do you deliver as proof?"
- "Who on your side works with our compliance or legal team, and when?"
- "Who maintains provider and location data after launch?"
Red Flags
- The agency calls its websites "HIPAA certified." There is no official HIPAA certification for websites or agencies.
- It treats an accessibility overlay widget as its accessibility plan.
- It cannot name a single vendor in its stack that signs BAAs.
- It promises legal certainty about HIPAA or plans the same ad pixels and session replay it uses for retail clients.
Who Owns the Site, Accounts, and Data After Launch
Your organization should own the domain, hosting, CMS, analytics, tag manager, form and scheduling accounts, and every BAA, with the agency added as a user. If the agency holds those accounts, your patient data sits under its contracts. Write ownership and the handover of files and code into the statement of work, plus an offboarding checklist that removes agency access when the engagement ends.
Frequently Asked Questions
Does a healthcare website need to be HIPAA compliant?
HIPAA applies to organizations and the PHI they handle, not to websites as such. A site with only public information is usually outside it; once forms, booking, chat, or tracking handle PHI, those features and their vendors must meet HIPAA requirements.
Can we use Google Analytics on a healthcare website?
On public information pages, usually yes. The risk is on booking, form, chat, and portal pages, where standard analytics can receive PHI. Treat any analytics vendor that will not sign a BAA as one that must never receive PHI, and have your compliance team approve the configuration.
Does my web design agency need to sign a BAA?
Only if its people will create, receive, maintain, or transmit PHI on your behalf, for example by managing form submissions or troubleshooting live booking data. If the agency only designs and builds pages that never touch PHI, a BAA is usually not required.
When do healthcare websites have to meet WCAG 2.1 AA?
For recipients of HHS funding under Section 504, May 11, 2027 for organizations with 15 or more employees and May 10, 2028 for smaller ones, after HHS's 2026 one-year extension. Starting now is cheaper than retrofitting later.
How long does a healthcare website redesign take?
In the projects I review, small practice sites take 8 to 12 weeks, multi-location groups 4 to 6 months, and hospitals often 9 to 12 months because clinical, legal, and accessibility reviews add rounds.
Conclusion
Hire a healthcare website design agency like any partner that touches patient trust: it should understand patient tasks, show where PHI enters your site and which vendors sign BAAs, build to WCAG 2.1 AA, and know when to hand a decision to compliance or legal. Price integrations and ongoing tooling, not just design. When you are ready to compare vetted partners, start with the curated agency lists on TopWebsiteAgencies, beginning with our healthcare list, and run each shortlisted agency through the questions above.