Use this section to test whether the site is secure, usable, technically crawlable, and appropriately configured for the practice's handling of patient information. Passing an SEO check does not establish HIPAA compliance.
Audit SSL Certificate and HTTPS Protocols
Evidence required: A crawl of canonical pages, browser checks, redirect behavior, certificate status, and form endpoints. Pass/fail condition: Pass when public pages resolve over HTTPS without mixed-content errors or avoidable insecure redirects and the forms in scope use secure transport.
Fail when important pages, assets, or submissions fall back to insecure delivery. Severity: High for exposed or broken security behavior; otherwise prioritize by affected page and workflow. Owner: Web developer or technical owner, with the privacy or compliance owner reviewing data-handling obligations.
Corrective action: Repair certificate, redirect, asset, and form transport issues without assuming encryption alone satisfies healthcare privacy requirements. Validation step: Re-crawl, submit test data that contains no real patient information, inspect the rendered request flow, and document the result. Tools: Screaming Frog, SSL Labs
Implement HIPAA-Compliant Lead Capture Forms
Evidence required: An inventory of every form and communication workflow that can collect patient or prospective-patient information, the vendors involved, contractual documentation where applicable, storage destinations, and access controls.
Pass/fail condition: Pass only when the practice's responsible reviewer has approved the actual workflow for its intended use. Fail when a form's data path, vendor role, agreement status, or handling procedure is unknown or inconsistent with the practice's requirements.
Severity: Critical when sensitive information may be handled through an unreviewed workflow. Owner: Privacy or compliance owner with technical implementation support. Corrective action: Replace or reconfigure unsuitable collection methods, minimize unnecessary data collection, and document approved handling procedures.
A vendor label or plugin setting is not itself proof of compliance. Validation step: Review the live form, vendor configuration, data destination, retention and access process, and applicable agreements with the responsible reviewer. Tools: JotForm HIPAA, FormDr
Optimize Core Web Vitals (LCP, FID, CLS)
Evidence required: Field data where available, lab diagnostics, mobile rendering checks, page templates, image weights, script behavior, and contact-flow testing.
Pass/fail condition: Pass when priority pages are usable on representative mobile devices and no known performance defect prevents reading, navigation, or contact. Fail when slow rendering, layout movement, blocked controls, or heavy assets materially impair the experience.
Severity: High when service, location, or contact pages are affected. Owner: Developer, with design and content owners responsible for assets and interface decisions. Corrective action: Reduce unnecessary scripts, optimize media, fix layout instability, and remove interaction blockers based on measured evidence.
Validation step: Retest representative templates after deployment and record whether the specific defect was resolved rather than relying on one aggregate score. Tools: Google PageSpeed Insights, WP Rocket
Configure MedicalBusiness Structured Data
Evidence required: The structured data emitted on the page, the visible business and service information it describes, and validator output. Pass/fail condition: Pass when the markup is syntactically valid, uses an appropriate type, and accurately reflects content visible to users.
Fail when the markup invents services, credentials, locations, or other facts, or conflicts with the rendered page. Severity: Medium unless the implementation creates broader technical or trust problems.
Owner: Technical SEO or developer, with practice staff verifying factual business details. Corrective action: Remove unsupported properties, align markup with visible content, and use structured data as machine-readable description rather than a promised ranking mechanism.
Validation step: Test the final rendered markup and manually compare each material property with the page and practice records. Tools: TechnicalSEO Schema Generator, Google Rich Results Test