Check: Privacy-sensitive analytics and tracking. Evidence required: an inventory of analytics, tag-management, advertising, form, scheduling, and third-party scripts, plus documented data flows and configured fields.
Google Analytics 4 (GA4) or any alternative should be assessed based on the information actually collected and transmitted, not assumed safe or unsafe by product name. Pass/fail: Pass when the responsible technical and privacy reviewers can account for the data flow and approved configuration; fail when tags, parameters, or destinations are unknown or unreviewed.
Severity: critical. Owner: technical lead with the clinic's privacy or compliance reviewer. Corrective action: remove unnecessary collection, reconfigure data flows, and select tools or server-side patterns only where they fit the clinic's requirements.
Tools for investigation may include Google Tag Manager Server-Side, Freshpaint, and Matomo. Validation: retest representative pages and forms and inspect the network or tag output to confirm the approved configuration is what actually runs.
Check: Structured data accurately describes the clinic and practitioners. Evidence required: rendered JSON-LD, visible practitioner and clinic information, service descriptions, locations, and any pricing or insurance statements shown to users.
Pass/fail: Pass when markup uses applicable Schema.org types and mirrors visible facts; fail when it invents specialties, prices, affiliations, or other properties that are absent or inaccurate. Severity: high.
Owner: technical SEO owner with clinic administration. Corrective action: use MedicalBusiness, Physician, or another applicable type only when it accurately fits the real entity, and omit unsupported fields.
Tools: Schema.org, Validator.schema.org, Merkle Schema Generator. Validation: validate syntax and manually compare every material property with the page and clinic records.
Check: Mobile performance on important patient paths. Evidence required: field or lab measurements for core templates, especially service, contact, booking, and intake pages. The source previously cited Over 70% as a mobile-search observation, but no supporting source URL is present here, so treat it as historical context rather than a verified benchmark.
Pass/fail: Pass when priority pages are usable on representative mobile devices and material layout, loading, and interaction issues are resolved; fail when users encounter blocking delays, unstable layouts, or broken controls.
Severity: high. Owner: web performance or engineering owner. Corrective action: investigate LCP, CLS, asset weight, third-party scripts, and interaction bottlenecks using PageSpeed Insights, Google Search Console, and WP Rocket where applicable. Validation: rerun tests after deployment and manually complete the mobile journey.
Check: HTTPS and transport security are configured consistently. Evidence required: certificate status, HTTPS coverage, redirects, mixed-content checks, and secure behavior on forms and patient-facing workflows.
Pass/fail: Pass when the site uses valid HTTPS consistently and insecure resources or form endpoints are absent; fail when certificate, mixed-content, redirect, or transmission issues remain. Severity: critical.
Owner: infrastructure or web operations owner. Corrective action: correct certificate and HTTPS configuration and review application-level data handling separately. Tools: Let's Encrypt, Qualys SSL Labs. Validation: retest representative URLs and forms after the fix.