Does a dental website need to be HIPAA compliant?

Any part that collects, stores or sends patient health information does. Use form, booking and chat vendors that sign a BAA, and keep tracking pixels off those pages. Pages that only give general information carry less risk.

Can I use a regular contact form on my dental website?

Yes, for general questions, as long as it does not ask for health details and says so. Symptoms, history and insurance IDs should go through a HIPAA-capable form provider.

Can I use Google Analytics on a dental website?

On general public pages, many practices do. Google does not offer a BAA for Google Analytics, so keep it off booking, intake and portal pages, and avoid sending any health-related details to it.

Should dentists show prices online?

Showing typical ranges or starting prices for implants, aligners and whitening helps, as long as you explain that the exam sets the final plan and cost.

Can I post patient before-and-after photos?

Only with a signed written authorization from the patient that covers website and social use. Keep a record and remove the photos if the authorization is revoked.

What is the ADA accessibility deadline for dental websites?

Under the ADA there is no fixed date, but lawsuits already happen. For practices getting HHS funds such as Medicaid, the Section 504 rule sets May 11, 2027 for 15 or more employees and May 10, 2028 for smaller practices.

How do I reply to a bad review without breaking HIPAA?

Thank the reviewer, do not confirm they are a patient or mention any treatment, and invite them to call the office to discuss privately.

Websites by Industry

Website for Dentists: What a Dental Practice Site Needs in 2026

By ITCM Team · Updated November 2026

A dental website has two jobs that pull in different directions. It has to win new patients who are comparing practices on a phone, often in pain or nervous, and it has to handle health information carefully because most dental practices are covered by HIPAA. This guide walks through the pages patients look for, how booking and new-patient forms should work, what to say about insurance and financing, how to handle emergencies, before-after photos and reviews, and where accessibility and privacy rules come in. It is practical guidance, not legal advice; check the details with your compliance advisor.

Key takeaways

Give each major service its own page: general and family care, cosmetic, implants, clear aligners and emergency dentistry.
Put insurance plans you are in-network with, plus financing and any in-house membership plan, where patients can find them in two taps.
Do not collect health details through a plain contact form or regular email; use a HIPAA-capable form or booking provider that signs a BAA.
Keep tracking pixels and analytics off booking, intake and patient portal pages unless the vendor will sign a BAA.
Patient photos and testimonials need written authorization, and review replies must never confirm someone is a patient.
Aim for WCAG 2.1 AA; practices that take federal funds such as Medicaid face an HHS deadline of May 2027 or May 2028 depending on size.

What do patients look for on a dentist's website?

Patients search in a few clear patterns: "dentist near me accepting new patients," "emergency dentist open today," "dentist that takes [insurance plan]," "dental implants cost," "Invisalign near me" and "sedation dentist for anxiety." Each one is a page waiting to be built.

Within seconds they want to know if you are taking new patients, whether you take their insurance, where you are and when you are open, who the dentist is, and how to book. If any of those take more than a tap or two on a phone, many people go back to the map results.

Which pages should a dental practice website have?

Build service pages around what patients actually search for, and keep each one specific: what the treatment involves, how many visits it typically takes, who is a good candidate, price range or financing note, and a booking button. Our guide to service page structure that ranks shows the layout.

Use brand names like Invisalign only if you are an actual provider, and follow the brand's naming rules; otherwise say "clear aligners."
Many state dental boards restrict who may advertise as a "specialist," so check your board's advertising rules before using that word.

Page	What it must answer	Key element
Home	New patients? Insurance? Book?	Book + call buttons
General / family	Cleanings, kids, exams	Ages served
Cosmetic	Whitening, veneers, bonding	Consented photos
Implants	Process, visits, cost range	Financing note
Clear aligners	Fit, timeline, cost	Consult booking
Emergency	Can I be seen today?	Tap-to-call
Insurance & financing	Is my plan accepted?	Plan list
Meet the dentist	Who will treat me?	Real photos, credentials

How should online booking and new-patient forms work?

Online booking for new patients reduces phone tag, especially for people who search after hours. Most practices connect booking to their practice management software through a scheduling tool rather than an open calendar, so the front desk keeps control of which slots are bookable. Our online booking system guide covers the options.

Keep the public booking step light: name, contact details, new or existing patient, reason category (cleaning, emergency, consultation) and preferred time. Medical history, medications and insurance member IDs belong in the secure intake system the patient completes afterwards, not in the first form.

What does HIPAA mean for your contact forms and tracking?

According to HHS guidance, health information a covered practice collects through its website, such as appointment details or the reason someone is seeking care, is generally protected health information (PHI). Any vendor that receives PHI on your behalf, including a form provider, scheduling tool or chat widget, is generally a business associate, and you need a business associate agreement (BAA) with it.

In practice that means a plain website contact form that emails submissions to a regular inbox is the wrong place for symptoms, medical history or insurance details. Use a HIPAA-capable form or intake provider that will sign a BAA, encrypts data, and lets staff view submissions inside a secure portal instead of plain email. Add a short line on your contact form asking people not to include health details there.

Tracking is the second trap. HHS has warned that tracking pixels on pages like booking or patient portals can disclose PHI to ad platforms. A June 2024 federal court ruling vacated part of that guidance for public informational pages, but the rules for authenticated and booking pages still stand. Google states it does not offer a BAA for Google Analytics, so keep analytics and ad pixels off booking, intake and portal pages, or use a tool that signs a BAA. This is general information, not legal advice; confirm your setup with your HIPAA compliance advisor.

How should you present insurance, financing and emergencies?

List the plans you are in-network with by name, explain in a sentence what out-of-network means for the patient, and avoid promising what a plan will cover. Patients without insurance often look for financing through third-party lenders or an in-house membership plan with a fixed yearly fee; if you offer either, give it a clear page with what is included.

For emergencies, put a tap-to-call button at the top of every mobile page and an emergency page that explains what counts as a dental emergency, what to do before arriving, and your after-hours instructions. Only say "same-day" if the schedule really holds slots for it. If a patient has facial swelling spreading to the eye or neck, or trouble breathing or swallowing, the page should tell them to go to the ER or call 911.

Which features matter, and which can wait?

Not every practice needs everything at launch. Here is a practical split.

Feature	Priority	Notes
Tap-to-call + map	Must	Sticky on mobile
New-patient booking	Must	Linked to scheduler
HIPAA intake forms	Must	Provider signs BAA
Insurance plan list	Must	Keep it current
Accessible design	Must	WCAG 2.1 AA
Before-after gallery	High	Written consent
Spanish or other language	Depends	Match your patients
Live chat	Optional	No health details unless covered

Why does accessibility matter for a dental website?

Dental offices are public accommodations under the ADA, and the Department of Justice has said businesses open to the public must make their websites accessible. WCAG 2.1 AA is the standard courts and settlements usually point to. Separately, HHS updated its Section 504 rule in 2024; practices receiving HHS federal financial assistance, which includes Medicaid and CHIP providers, must meet WCAG 2.1 AA. After an extension in 2026, the deadline is May 11, 2027 for practices with 15 or more employees and May 10, 2028 for smaller ones.

The basics are achievable: readable contrast, real text instead of text in images, alt text on photos, forms with labels, keyboard navigation and captions on videos. Start with the accessibility contrast checker and our guide to ADA website compliance. Avoid relying on overlay widgets alone; they do not fix underlying code.

What are the rules for before-after photos and reviews?

Patient photos and testimonials are PHI when they identify the patient, so get a signed HIPAA authorization that names how and where the images will be used. Smile close-ups can still identify someone, so treat them the same way. Label photos honestly and do not edit results.

Reviews carry two rules. First, the FTC rule on fake reviews, in effect since October 2024, bans fake or bought reviews and suppressing negative ones, and Google prohibits incentives and asking only happy patients. Second, never confirm in a public reply that the reviewer is a patient or mention their treatment. HHS has fined dental practices over replies to online reviews, including a $10,000 settlement in 2019. Our guide on responding to negative reviews has safe wording.

How does local SEO work for a dental practice?

Most new patients find a dentist through the map pack, so your Google Business Profile matters as much as the site. Use the right primary category, list each dentist correctly, keep hours and holiday hours current, and add real photos of the office and team. Make sure the name, address and phone number match everywhere.

On the site, add LocalBusiness or Dentist structured data; you can create it with the free local business schema generator. Write service pages for the treatments people search for in your area, and keep pages fast. Google no longer shows FAQ rich results, but a clear FAQ section still helps patients and other search tools.

When is a template enough, and how does ITCM handle it?

Many practices are well served by a dental-specific website vendor that bundles HIPAA forms and patient messaging, and that can be the right choice. A custom site makes more sense when you want to own your content, control your design, or connect booking and lead tracking your own way.

At ITCM we build the site first and show it to you finished, so you judge real pages instead of a mockup. We have recovered hacked WordPress sites for small businesses and build custom CRMs that replace spreadsheets for tracking leads and follow-ups. For dental clients we connect a HIPAA-capable form or booking provider of your choice rather than routing health details through plain email.

Get your dental website built free, pay only if you like it

ITCM builds your practice website and an installable app free: service pages, 24/7 online booking, lead management, an admin panel and 3 design options. You see it finished, and you pay $150 one-time only if you are happy. Anything beyond that gets a fixed quote before any work begins, and an optional care plan starts from $100/month.

See how the free build works and request yours.

Frequently asked questions

Does a dental website need to be HIPAA compliant?: Any part that collects, stores or sends patient health information does. Use form, booking and chat vendors that sign a BAA, and keep tracking pixels off those pages. Pages that only give general information carry less risk.
Can I use a regular contact form on my dental website?: Yes, for general questions, as long as it does not ask for health details and says so. Symptoms, history and insurance IDs should go through a HIPAA-capable form provider.
Can I use Google Analytics on a dental website?: On general public pages, many practices do. Google does not offer a BAA for Google Analytics, so keep it off booking, intake and portal pages, and avoid sending any health-related details to it.
Should dentists show prices online?: Showing typical ranges or starting prices for implants, aligners and whitening helps, as long as you explain that the exam sets the final plan and cost.
Can I post patient before-and-after photos?: Only with a signed written authorization from the patient that covers website and social use. Keep a record and remove the photos if the authorization is revoked.
What is the ADA accessibility deadline for dental websites?: Under the ADA there is no fixed date, but lawsuits already happen. For practices getting HHS funds such as Medicaid, the Section 504 rule sets May 11, 2027 for 15 or more employees and May 10, 2028 for smaller practices.
How do I reply to a bad review without breaking HIPAA?: Thank the reviewer, do not confirm they are a patient or mention any treatment, and invite them to call the office to discuss privately.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles