What a practice website is actually judged on
Twenty checks, in the order they tend to matter. Most are testable from outside your building in a few minutes, which is the reason website privacy became an enforcement priority in the first place. Nothing here is legal advice.
01What is loading before anyone is asked
- 01
No analytics, ad or social tag fires before a consent decision
Load the site in a private window and watch the network panel before touching anything. Every request to a third party at that moment happened without permission.
how the gate holds tags - 02
Tags are held, not just announced
A banner that displays a notice while the scripts already ran has documented the exposure rather than prevented it. The test is whether the requests disappear, not whether a notice appears.
tag blocking vs consent mode - 03
You have a current list of every tag on the site
Plugins, page builders, chat widgets and embeds each add their own. The list approved at launch and the list running today are rarely the same.
the five places tags load - 04
Embedded forms and schedulers are accounted for
A third-party iframe sits outside your consent gate and can carry its own tracking. Neither the page nor the banner can reach inside it.
the iframe consent gap - 05
Call tracking has been assessed separately
The swapped number, the session identifier and the recording are three different questions, and they do not carry the same exposure.
call tracking and HIPAA
02Whether HIPAA reaches your website
- 06
Covered-entity status has been determined in writing
Most practices are covered entities, but it is a determination rather than an assumption, and the answer changes what every other item here means.
the two questions it turns on - 07
You know which pages carry health intent
A procedure page, a consult page and a symptom page support an inference about the visitor that a homepage does not.
what counts as PHI - 08
Every vendor receiving that data has signed a BAA
A vendor becomes a business associate by handling PHI. A vendor that will not sign cannot lawfully receive it.
the BAA decision tree - 09
Analytics on patient-facing pages has been reviewed
General-purpose analytics is the most common vendor on this list and the one least likely to have a BAA in place.
where the risk actually is - 10
You can date your advice
OCR guidance was issued in 2022, revised in 2024, and partly vacated by a federal court. Advice that does not say when it was written cannot be relied on.
what survived the challenge
03State law, which follows your visitor
- 11
You know which states your traffic actually comes from
Your website has one configuration for every visitor. If you draw patients across state lines, the strictest state in your traffic sets your standard.
detection and state notices - 12
You know whether your state exempts at entity or data level
Thirteen of the twenty comprehensive-law states exempt covered entities entirely. Seven exempt only the PHI, leaving website and marketing data in scope.
which states do which - 13
Sensitive-data handling has been checked
Most state laws treat health data as sensitive and require opt-in rather than an opportunity to opt out. That inverts the default a site can rely on.
how sensitive data is treated - 14
A universal opt-out signal is honoured
Several states require controllers to recognise a browser-level signal as a valid request, independent of anything the visitor clicks on your banner.
universal opt-out - 15
You have considered consumer health data laws separately
They are a different family from comprehensive privacy laws. Washington's reaches practices outside the state, has no size threshold, and carries a private right of action.
what My Health My Data reaches
04What you have written down
- 16
The privacy policy describes what the site actually does
A policy is a factual claim. It stops being true when a plugin adds a vendor, and nobody has to touch the policy for that to happen.
how drift is caught - 17
Every vendor on the site appears in the policy
And every vendor in the policy is still on the site. Both directions are checkable from outside your building.
what the scan compares - 18
The policy has been revised within the last year
An unrevised date is the first thing a regulator or a plaintiff's counsel looks at, because it is visible without asking you anything.
policy age monitoring - 19
You can produce what a specific visitor was shown and chose
A cookie in the visitor's own browser is not documentation. A defensible answer is a timestamped record with the banner version and the categories offered.
how the record is held - 20
The conversion path meets WCAG 2.1 AA
An automated scan reaches about a third of the criteria. A booking button a screen reader cannot name is reachable and unusable at once.
scheduled scanning
Answering the first five takes about a minute
The scanner loads your site in a real browser and reports what fires before any consent interaction, named tag by named tag, with timings. It tells you where you stand before anyone tries to sell you anything.
Scan your site free Glossary of the terms above