Reference

Laws & regulations for US private clinics.

Every rule that shapes a clinic's website, booking, and patient systems, in plain English. For each one: what it says, what it means for your website, what it means for your systems, and how we handle it when we build for you.

42 rules · 6 clinic types · Last reviewed 10 November 2026

How to read this

Law: A federal statute passed by Congress.
Regulation: Federal rules made by an agency such as HHS, the FTC, or the FCC, with the force of law.
State law: Varies by state. We build for the states your patients are in.
Guidance: What a regulator or licensing board expects, and often how it judges complaints.
Standard: A recognized standard, often required by contracts or partners.
Contract: Terms you agree to, like a payer contract.

Every clinic

The rules everyone follows.

Whatever kind of clinic you run, these apply the moment you have a website, take a booking online, or send a patient a message.

01RegulationHHS · OCR

HIPAA Privacy, Security, and Breach Notification Rules

Read the source

What it says

Covered providers must protect patients' health information, limit who sees it, secure electronic records, and notify patients and HHS after a breach. Anyone who handles that information for you, such as a developer or hosting provider, needs a business associate agreement.

Your website: Forms that collect health details send them securely to a HIPAA eligible system, never to an ordinary inbox.
Your systems: Access controls, encryption, audit logs, and backups, on hosting that will sign a business associate agreement.
How we work: We sign a business associate agreement with you, and only use vendors who will sign one with us.

02GuidanceHHS · OCR

HIPAA and online tracking technologies

Read the source

What it says

HHS guidance warns that tracking pixels and analytics can disclose protected health information, especially on patient portals and other logged in pages. A 2024 court ruling narrowed the guidance for public pages, but tracking on booking, intake, and portal pages still carries real risk, and private lawsuits over pixels are common.

Your website: No advertising pixels on booking, intake, or portal pages, and analytics set up not to capture health details.
Your systems: Patient facing pages built without third party trackers.
How we work: We audit every script on your site before launch.

03LawFTC

FTC Act: truthful advertising and health claims

Read the source

What it says

Advertising must be truthful and not misleading. Health claims need competent and reliable scientific evidence, and that includes your own website and social posts.

Your website: Measured claims with evidence on file, and before and after photos that reflect typical results.
Your systems: No direct impact.
How we work: We flag claims that need evidence before anything goes live.

04RegulationFTC

FTC Rule on Consumer Reviews and Testimonials

Read the source

What it says

Since October 2024, fake reviews and testimonials, buying reviews, and suppressing negative reviews are banned, and the FTC can seek civil penalties for each violation.

Your website: Reviews shown honestly, never filtered to hide the negative ones.
Your systems: Review requests sent to every patient after a visit, not only the ones you expect to be happy.
How we work: We never write, buy, or seed reviews for a client.

05LawFCC

Telephone Consumer Protection Act (TCPA)

Read the source

What it says

Automated texts and calls need the right consent. Healthcare messages such as appointment reminders have a narrow exemption with limits on length and frequency, while marketing texts need prior express written consent.

Your website: Opt in wording on forms that matches the messages you will actually send.
Your systems: Reminders and marketing kept separate, consent recorded per patient, and STOP honored automatically.
How we work: No direct impact.

06LawFTC

CAN-SPAM Act

Read the source

What it says

Marketing emails need accurate sender details, a physical postal address, and a working unsubscribe that is honored promptly.

Your website: No direct impact.
Your systems: An unsubscribe link in every marketing email, honored automatically, with your address in the footer.
How we work: No direct impact.

07LawDOJ

Americans with Disabilities Act, Title III

Read the source

What it says

Businesses open to the public, including medical practices, must be accessible to people with disabilities, and the Department of Justice has said that applies to websites. Accessibility lawsuits against healthcare websites are common.

Your website: Built to WCAG 2.2 AA: readable contrast, keyboard access, labeled forms, and descriptive alt text.
Your systems: Booking and patient portals that work with screen readers and without a mouse.
How we work: We test accessibility before launch, not after a demand letter.

08State lawState attorneys general

State consumer health data laws

Read the source

What it says

Washington's My Health My Data Act protects consumer health data even where HIPAA does not apply, requires consent to collect and share it, bans geofencing around health facilities, and lets consumers sue. Nevada and Connecticut have similar laws, and California's privacy law adds its own rights.

Your website: Consent before collecting health data that HIPAA does not cover, and a consumer health data privacy policy where required.
Your systems: No health data shared with advertisers or data brokers without consent.
How we work: We map which state laws apply to your patients before we build.

09LawCMS

No Surprises Act: Good Faith Estimates

Read the source

What it says

Uninsured and self pay patients have the right to a Good Faith Estimate of expected charges when they schedule care in advance, or when they ask for one.

Your website: A clear notice that self pay patients can ask for a Good Faith Estimate.
Your systems: Good Faith Estimates generated from your price list when self pay patients book ahead.
How we work: No direct impact.

10LawFTC · state attorneys general

ROSCA and state automatic renewal laws

Read the source

What it says

Memberships billed automatically online need clear terms before payment, the customer's express consent, and a simple way to cancel. California and other states add their own automatic renewal rules.

Your website: Membership terms, price, and renewal shown clearly before payment.
Your systems: Online cancellation that is as easy as signing up, with renewal reminders where your state requires them.
How we work: No direct impact.

11RegulationFDA

FDA: software as a medical device

Read the source

What it says

Software can be regulated as a medical device if it is intended to diagnose, treat, or drive clinical decisions about a patient.

Your website: No direct impact.
Your systems: We build booking, records, and report tools that support clinicians rather than make clinical decisions: results are flagged against the lab's own reference ranges, and clinicians make the calls.
How we work: If what you want would make the software a medical device, we tell you before anything is built.

12StandardCard brands

PCI DSS

Read the source

What it says

Any business that takes card payments must protect card data to the PCI DSS standard.

Your website: Payments taken in secure, hosted card fields from your payment processor.
Your systems: Card numbers never touch your servers or ours, which keeps your compliance burden small.
How we work: We never store card details.

By clinic type

The rules for your kind of clinic.

Built in, not bolted on

Want a site that already follows them?

We build these rules into every clinic website and system we make. This page is a plain English summary, not legal advice. Rules change, so check each source and check with your healthcare attorney, compliance lead, or state board.