A treatment center website is a regulated surface. It collects health information, makes claims about care, runs tracking code for advertising, and has to publish notices that federal rules require. Many of the issues aren’t hidden in legal fine print. They’re visible on the page to anyone who knows where to look.
This checklist covers nine checks a marketing team can run on its own site. For each one: what it rests on, who it applies to, a quick way to tell whether you have it, and what to fix.
It’s a detection tool, not legal advice. Which rules apply to your facility, and how, is a question for counsel.
The checklist ties together the compliance work inside our website design practice for treatment centers, and each check links to a deeper guide.
Key Takeaways
- Nine checks cover most of what a treatment center website needs: tracking, forms and chat, privacy claims, privacy policy, the Good Faith Estimate notice, surprise billing disclosures, advertising certification, accessibility and language access, and outcome claims.
- Tracking is the highest-risk area. HIPAA and 42 CFR Part 2 govern it, and FTC cases against addiction and mental health services show how pixel data and privacy promises get enforced.
- Some notices are required on the website itself, like the notice of the right to a Good Faith Estimate for self-pay patients.
- Several checks depend on facility type and funding. Section 504 and Section 1557 apply to recipients of HHS federal financial assistance, and the surprise billing disclosure applies to providers at hospital-type facilities.
- Run the checklist once, fix the gaps, then add it to a quarterly review.
How to use this checklist
Work through the nine checks with the site open in a browser and your tag manager, form tool, and ad accounts at hand. Mark each one present, missing, or unsure.
THE NINE CHECKS
- Check 1. Tracking and pixels
- Check 2. Forms and chat
- Check 3. Privacy promises and seals
- Check 4. Privacy policy and state health data laws
- Check 5. The Good Faith Estimate notice
- Check 6. Surprise billing disclosure
- Check 7. Advertising certification and landing pages
- Check 8. Accessibility and language access
- Check 9. Outcome claims and testimonials
“Unsure” goes to counsel. Most checks take a few minutes.
DEFINITION
Website compliance check. A quick, visible test a marketing team can run on its own site to see whether a required element is present and working, before asking counsel whether it meets the rule.
Check 1: Tracking and pixels
What it rests on. HIPAA and, for many substance use disorder programs, 42 CFR Part 2. HHS’s tracking technology bulletin applies, except the portion a federal court vacated in June 2024 covering IP addresses combined with visits to unauthenticated public pages.
Who it applies to. HIPAA-covered treatment centers and their vendors.
Quick check. Open your tag manager and list every tag that fires on program, condition, insurance, and form pages. Read your ad platform event names and parameters. Any event that names a condition, a level of care, or a payment for treatment is a problem.
The fix. Route conversion data through a server-side layer covered by a business associate agreement, send neutral event names, and never upload patient lists. Our HIPAA-safe conversion tracking guide and guide to HIPAA-compliant Meta ads cover the setup, and our review of HIPAA-safe Google Analytics alternatives covers analytics.
Check 2: Forms and chat
What it rests on. HIPAA. A form or chat tool that collects health information on your behalf is handling protected health information.
Who it applies to. Any covered treatment center using contact forms, insurance verification forms, chat widgets, or scheduling tools.
Quick check. List every form and chat tool on the site. For each, confirm whether the vendor has signed a business associate agreement and where submissions are stored and emailed.
The fix. Use vendors that sign BAAs, limit fields to what admissions needs, and stop emailing form contents in plain text. See our guides to HIPAA-compliant contact forms and HIPAA-compliant chat widgets.
Check 3: Privacy promises and seals
What it rests on. The FTC Act’s prohibition on deception, and for substance use disorder treatment, the Opioid Addiction Recovery Fraud Prevention Act. The FTC’s Monument case involved an alcohol addiction treatment service that promised “100% confidential” and shared health information with advertisers.
Who it applies to. Any treatment center that makes privacy claims on its site, forms, or ads.
Quick check. Search the site for “confidential,” “private,” “secure,” and “HIPAA compliant,” and look for badges or seals. Ask who issued each seal.
The fix. Keep claims you can support, rewrite the rest to describe what you actually do, and remove seals no outside reviewer issued.
Check 4: Privacy policy and state health data laws
What it rests on. Your own privacy policy, plus state laws that reach health data outside HIPAA. Washington’s My Health My Data Act requires a consumer health data privacy policy linked separately from the homepage, and bans geofencing near health care facilities.
Who it applies to. Facilities that do business in or target consumers in states with these laws.
Quick check. Read the privacy policy against what the site actually does: tracking tools, form vendors, ad platforms. If it doesn’t mention tools you use, it’s out of date.
The fix. Update the policy to match your stack, and have counsel decide whether state-specific policies or links are needed for where you advertise.
Check 5: The Good Faith Estimate notice
What it rests on. The No Surprises Act. Under 45 CFR 149.610, the notice of the right to a Good Faith Estimate must be prominently displayed and easily searchable from a public search engine on the website.
Who it applies to. Providers serving uninsured and self-pay patients, including insured patients who choose not to bill their plan.
Quick check. Search Google for your facility name plus “good faith estimate.” Then look for the notice from your insurance and admissions pages.
The fix. Publish a dedicated, indexable page with the notice as text, adapted from the CMS model notice, and link it from your insurance, admissions, and contact pages.
Check 6: Surprise billing disclosure
What it rests on. The No Surprises Act disclosure rule at 45 CFR 149.430, which requires a disclosure of patient protections on a searchable homepage.
Who it applies to. Providers that furnish services at hospitals, hospital outpatient departments, critical access hospitals, or ambulatory surgical centers. Many freestanding treatment centers don’t, so confirm with counsel.
Quick check. Confirm whether any of your services are delivered at those facility types. If so, look for the disclosure on your homepage.
The fix. If it applies, publish the disclosure on a searchable homepage with the required content and regulator contacts.
Check 7: Advertising certification and landing pages
What it rests on. Platform policies. Google requires LegitScript certification for addiction services advertisers in the US, and Meta requires LegitScript certification plus its own permission for addiction treatment ads.
Who it applies to. Facilities running paid search or social for addiction treatment.
Quick check. Confirm your LegitScript certification is current and that ad landing pages match what was certified: same facility, same services, same contact details.
The fix. Keep certification current and landing pages aligned with it. Our guide to LegitScript-compliant landing pages covers the requirements.
Check 8: Accessibility and language access
What it rests on. Several rules, with different reach:
- ADA Title III. The Justice Department has no regulation setting web standards for private businesses. Its web guidance describes WCAG as helpful guidance.
- Section 504. HHS adopted WCAG 2.1 AA for recipients of HHS federal financial assistance. Compliance dates were extended to May 11, 2027, for recipients with 15 or more employees and May 10, 2028, for smaller ones.
- Section 1557. Requires covered entities to post a nondiscrimination notice and a language assistance notice in a conspicuous location on their website.
Who it applies to. Section 504 and 1557 apply to recipients of HHS federal financial assistance, which can include providers that participate in programs like Medicaid. Ask counsel whether your facility is one.
Quick check. Run an automated accessibility checker on your top pages, then try navigating the admissions path with a keyboard only. Look for the nondiscrimination and language assistance notices.
The fix. Fix the issues automated tools flag, add real headings and alt text, and publish the notices if they apply.
Check 9: Outcome claims and testimonials
What it rests on. The FTC Act, the FTC’s Endorsement Guides, HIPAA authorization for patient stories, and OARFPA.
Who it applies to. Every treatment center that publishes success rates, reviews, or patient stories.
Quick check. Search the site for “success rate,” “cure,” “guarantee,” and percentages near the word “recovery.” List every testimonial and whether you have written authorization on file.
The fix. Remove or source outcome claims, label actors as actors, and keep authorization records for every identifiable patient story. Our testimonial compliance playbook covers the details.
COMMON MISTAKE
Fixing the site once and never checking again. New tags get added for a campaign, a vendor changes its widget, a page gets copied from an old template.
Compliance drifts the same way content does. Put the nine checks on a quarterly calendar.
Turning the checklist into a routine
Our 12 SEO failure patterns diagnostic and homepage rubric cover the non-compliance side of a site review.
OPERATOR INSIGHT
Assign each check an owner: tracking to whoever runs the tag manager, forms and chat to the web team, notices to billing and admissions, claims to the content lead. Review the checklist together once a quarter, and whenever a new vendor or campaign goes live.
The checks that fail most often are the ones nobody owns.
Where this fits
For how the website fits the rest of your marketing, see the complete guide to behavioral health marketing and our guide to the Meta Conversions API for treatment centers.
If you want a second set of eyes on your site, book an intro meeting.
Frequently Asked Questions
What does a treatment center website need to be compliant?
At minimum, HIPAA-safe tracking, forms, and chat; privacy claims you can support; a current privacy policy; and the Good Faith Estimate notice for self-pay patients.
Depending on your facility type and funding, you may also need the surprise billing disclosure, accessibility work under Section 504, and Section 1557 notices.
Use the nine checks to find gaps, and ask counsel which rules apply.
Is our website required to meet WCAG?
For private businesses, the Justice Department has no web accessibility regulation under ADA Title III and describes WCAG as helpful guidance.
Recipients of HHS federal financial assistance must meet WCAG 2.1 AA under Section 504, with compliance dates of May 11, 2027, or May 10, 2028, depending on size.
WCAG 2.1 AA is the standard the Section 504 and ADA Title II rules adopted, so it’s a sensible target either way.
Does the HHS tracking guidance still apply?
Mostly. A federal court vacated the part covering IP addresses combined with visits to unauthenticated public pages in June 2024, and HHS hasn’t reissued that portion.
The rest of the bulletin, including tracking on authenticated pages and pages that reveal health information, still stands.
HIPAA and Part 2 still govern how patient information is used.
How often should we run this checklist?
Once now, then quarterly, and whenever a new vendor, tag, or campaign goes live.
Assign an owner to each check.
Problems often come from changes nobody reviewed.
Can our marketing agency run these checks for us?
Yes, the checks are designed to be visible to a marketing team: tags, forms, pages, and claims.
Deciding which rules apply to your facility, and how, is for counsel.
Use the checklist to bring counsel a clear list of findings.
Trevor Gage is the Director of Marketing at Webserv, a digital marketing agency for treatment centers.
