Checkpoint: Analytics and patient-adjacent data flows
Evidence required: A current tag inventory, browser and network captures on consultation and procedure journeys, form-field inventory, destination list, vendor configuration records, consent behavior where applicable, and written review from the responsible privacy or legal team.
If Google Analytics 4 is present, inspect the implemented events and parameters rather than assuming the default configuration is appropriate. Pass condition: The practice can explain what data is collected, where it is sent, why it is needed, which journeys trigger collection, and who approved the configuration.
Fail condition: Unknown tags fire on sensitive pages, unnecessary information is transmitted, destinations cannot be accounted for, or no responsible reviewer can explain the implementation. Severity: critical
Owner: Analytics or marketing operations, web engineering, security, and the responsible privacy or legal reviewers.
Corrective action: Remove unnecessary collection, minimize payloads, document vendor behavior, separate sensitive journeys where appropriate, and implement the practice-approved measurement design. Validation step: Repeat the tag and network inspection after deployment and compare the observed payloads with the approved specification.
This checklist cannot guarantee compliance, and responsible legal, medical, or regulatory reviewers remain required for practice-specific decisions.
Checkpoint: Mobile rendering and Core Web Vitals
Evidence required: Field data where available, lab tests on priority templates, mobile browser recordings, and an inventory of scripts, fonts, images, video, forms, and consent components that affect loading or interaction.
Pass condition: Important LASIK procedure information and consultation actions render reliably on mobile, and any performance issue is documented by template and user task rather than inferred from a sitewide score.
Fail condition: Key content is delayed, unstable, blocked, or difficult to use, or a reproducible performance defect interferes with a patient journey. Severity: high
Owner: Web engineering and design, with marketing identifying the journeys that matter most.
Corrective action: Reduce unnecessary payloads, optimize media delivery, defer nonessential execution when technically appropriate, and simplify interactions that impede task completion. Validation step: Retest the same templates under comparable conditions and confirm that the original defect no longer reproduces. Keep later ranking analysis separate from technical validation.
Checkpoint: Practice and surgeon structured data
Evidence required: The rendered page, generated markup, practice records, surgeon records, genuine location records, and validator output. Pass condition: Structured data represents the same organization, surgeon, location, and service facts visible on the page, and optional properties are included only when supportable.
Fail condition: Markup invents credentials, services, ratings, affiliations, or locations, conflicts with visible content, or is added solely because the team assumes it will create rankings or enhanced search treatment.
Severity: high
Owner: SEO for specification, web engineering for implementation, and the factual data owner for accuracy. Corrective action: Remove unsupported properties, align markup with visible content and approved records, and simplify templates that cannot keep facts current.
Validation step: Validate the deployed markup, inspect the rendered page alongside it, and document any search appearance as an observation rather than a guaranteed outcome.
Checkpoint: HTTPS and secure page delivery
Evidence required: A crawl of intended indexable hosts, browser security checks on representative templates and forms, certificate status, mixed-resource checks, and an approved host inventory.
Pass condition: Patient-facing pages and required resources load through the approved secure configuration without errors that break or degrade the experience. Fail condition: Important pages resolve through unintended insecure paths, mixed resources impair functionality, or legacy host variations create duplicate or unsafe journeys.
Severity: critical
Owner: Web engineering, security, and infrastructure. Corrective action: Repair mixed resources, consolidate approved host behavior, update internal links and canonical configuration where appropriate, and document redirects before deployment.
Validation step: Re-crawl the same host set, retest forms and representative templates, and compare production behavior with the approved host inventory.