SSL Certificates
What encrypting the site does and does not prove, and why any page with a form needs it.
Read about SSL
Hosting by industry
Web Hosting for Healthcare Providers
Home health agencies, equipment suppliers and therapy groups rarely win work because a family found them. They win it because a hospital case manager had ten minutes, three names and a discharge to arrange. Your website is one of those ten minutes, and everything about web hosting for healthcare providers follows from that.
You are writing for the referrer, not the family
Most healthcare provider websites are written to reassure. Warm photographs, a paragraph about compassionate care, a promise to treat every patient like family. None of that is wrong. It is just aimed at the wrong reader.
The person who actually sends you business is a discharge planner, a case manager, a referral coordinator or a physician's office staffer. They are not moved by your mission statement, because every agency on their list has one. They are trying to answer three questions before the patient leaves the building: do you cover this address, do you take this insurance, and how do I send you the referral right now.
When the site does not answer those, the reader does not dig. They pick up the phone, or they pick the next name on the list. That is the whole failure, and it is quiet. Nobody calls to tell you they gave up on your website.
What that looks like in practice
- The service area is described as "Western New York and surrounding communities", which does not tell anyone whether you will drive to Gowanda.
- Insurance is covered by "we accept most major plans", which a coordinator reads as a maybe and treats as a no.
- The referral fax number and intake phone are on a contact page, three clicks deep, below a form.
- Intake hours are nowhere, so nobody knows whether a Friday afternoon referral gets picked up.
- There is no page a referrer can print or forward to a colleague.
You do not have to choose between the two audiences. Families and referrers want different things from the same site, and the fix is usually one more page rather than a rewrite. Give referral sources their own route in, label it plainly, and link it from the homepage where they can see it.
Give referral sources their own way in
We build the page a discharge planner needs, with your service area in named towns, the payers you take and your intake line where they can see it. If your site already does that, we will tell you.
The two facts that decide it: service area and insurance
Almost every referral decision narrows on geography and coverage before anything else. Get specific on both and you will get calls from people who already know you are a fit.
On geography, name places. Counties, towns, ZIP codes, or a plain sentence about how far out you travel and what changes past that line. A coordinator arranging care for an address in Lockport wants to see Lockport, not a region. If you cover part of a county and not the rest, say which part. Being honest about the edge of your area saves you the visits you were going to turn down anyway.
On coverage, list the payers by name. If you take Medicare, say so. If you are in network with some plans and out of network with others, splitting the list into two headings is more useful than a vague sentence, and it stops the calls you cannot serve. Put a date on the page saying when the list was last checked, and check it when your contracts change.
Say what you actually do
The second layer is scope. Skilled nursing versus companion care. Which therapy disciplines you staff. Which equipment categories you stock and which you order in. Whether you handle setup and training in the home, and whether you service what you supply. These read as details. To a referrer they are the difference between one call and four.
If there is something you do not do, put it in writing. "We do not provide 24 hour live-in care" reads as confidence and filters out the enquiries that waste an intake nurse's morning.
Referral forms carry patient data, so treat them differently
The moment your website has a form that a referral source might type a patient's name into, it stops being a brochure. Somebody will paste a diagnosis and a date of birth into a comments box, whether you asked for it or not. Design for that, because it will happen.
General principles first, and then the part you should take to your own compliance adviser. Nothing on this page is legal advice, and HIPAA obligations depend on your organisation and how you handle data. What follows is about the plumbing.
-
Encrypt the whole site, not just the form page
A certificate is standard on any current plan and there is no reason to run without one. Every page should load over HTTPS, and the form should refuse to submit any other way. Our SSL page covers what a certificate does and does not prove.
-
Decide where the submission actually goes
Most website forms email themselves to somebody. Ordinary email is not a secure channel and it leaves copies in mailboxes and on phones. If a form can receive patient information, the destination needs to be an account you control on your own domain at minimum, and often something more deliberate than email. Ask your adviser before you point it at a personal address.
-
Keep clinical intake off the public website
The most common answer is the simplest. Let the website capture a name, an organisation and a callback number, and move the clinical detail to your fax line, your secure portal or a phone call. A short form that says "we will call you back within business hours" is safer and often faster than a long one.
-
Know what is being stored and for how long
Plenty of contact form plugins quietly keep every submission in the website database forever. That is a copy of patient data sitting on a web server nobody thinks about. Turn the storage off, or know it is there and manage it.
-
Lock down who can log in
Every login on the site is a way in. Strong unique passwords, two-factor where it is offered, and accounts removed the week somebody leaves. The website security page goes through the rest.
The uncomfortable version of all this: a referral form is the highest risk thing on a healthcare provider's website and it is usually the least examined. If you inherited your site and do not know where the form sends, find out this week.
Accreditation and licensure get verified
Unlike most industries, your credentials are checked by someone whose job it is to check them. Hospital contracting, payers and referral coordinators will look, and they will look on your website first because it is quicker than a registry.
So put them where they can be found. State licence, accreditation body, Medicare certification, the year you started, the names and credentials of your clinical leadership. A staff page with real names and real qualifications does more for a referral relationship than any amount of copy about caring.
- Name the accrediting body plainly rather than showing a logo with no words around it.
- Say what the accreditation covers if you are accredited for some services and not others.
- Put a review date on the page so an old certification is not sitting there implying it is current.
- Keep the leadership list accurate. A director who left two years ago is the kind of detail a contracting office notices.
This is also the argument for owning your website properly rather than renting it inside a platform you cannot edit. Credentials change, staff change, and a page you can update in five minutes stays true. A page that requires a support ticket does not.
We will find out where your referral form sends
Send us the site and we will trace the form, check the certificate and confirm your backup restores. If the plan you are on already covers a home health or DME site, we leave it alone.
Web hosting for healthcare providers asks less than you think
A healthcare provider website is a couple of dozen pages that change occasionally, plus a form. It is light. Shared hosting covers it, and the entry tier is usually genuinely enough.
The things that matter here are not the plan size. They are the certificate, a working backup you have actually restored once, a login list that is current, and email at your own domain so a referral coordinator sees intake@yourdomain rather than a free address. Business email on your own domain is worth more to your credibility than any hosting upgrade.
Be careful with the word compliant. Hosting cannot make an organisation compliant, and any plan sold on that basis deserves a hard question about exactly what it covers. Your obligations depend on how you handle data, not on where the website sits. Confirm the specifics with your own compliance adviser.
Who should not buy this, or spend more than the minimum
If you are a physician practice seeing patients directly, this is the wrong page for you. Your website sells to the patient, not to a referrer. Your traffic comes from local search, your conversion is an appointment, and the things that matter are your Google Business Profile, your hours, your locations and how easy it is to book. Almost none of the referral thinking above applies, and following it would send you down the wrong road. Our pages for doctors and medical practices cover that case.
Even among agencies and suppliers, most should stay on a small plan. Being direct about it:
- You do not need a large hosting tier for a site that is text, a staff page and a form.
- You do not need extra storage unless you are hosting video, and you probably should not host video on a web server anyway.
- You do not need a managed plan to run a site that changes a few times a year.
- You very likely do need the certificate, a tested backup and clarity about where your form sends. Those are cheap and they are the ones that bite.
Where spending more is fair: you run a genuine patient or referrer portal with logins, you operate several branded agencies on one platform, or you have an intake system built into the site rather than sitting beside it. Those are real workloads. Number of patients on service is not, because your patients are not visiting the website.
How AldoMedia helps
AldoMedia has built and looked after websites for Western New York businesses since 1999, and healthcare provider sites written entirely for families are familiar work. We are an independent authorised reseller rather than the operator of the underlying platform, and if the plan you are on is already right, we will say so and leave it alone.
If you have taken over a site somebody else built and are not sure what is behind it, start with taking over a website. Otherwise call 716-771-2536 or tell us what your site runs on.
Common questions
Healthcare provider website questions
Can a referral form on my website accept patient information?
Technically yes, and that is the problem. People will type a diagnosis into a comments box whether you invited it or not. The safer pattern is a short form that captures the referrer's name, organisation and callback number, with clinical detail moved to your fax line, a secure portal or a phone call. Whether your setup meets your obligations depends on how you handle the data, so confirm it with your own compliance adviser rather than with a hosting company.
Is there such a thing as HIPAA compliant hosting?
Providers do sell plans marketed that way, and some arrangements are more suitable than others. But compliance is a property of your organisation and your processes, not a checkbox on a hosting invoice. A server cannot make you compliant, and a plan sold on that promise deserves a specific question about what it actually covers and what it leaves with you. Ask your adviser what you need before you buy anything on that label.
What should be on the page a discharge planner lands on?
The service area in named towns or counties, the payers you accept by name, what you actually provide, the intake phone and fax, and the hours those are staffed. Put it above the reassurance copy and label the route in so a coordinator can find it without hunting. A referrer who can answer their three questions in thirty seconds calls you. One who cannot calls the next agency.
Should the website list our accreditation and licence numbers?
List the accrediting body and your licensure plainly, yes, because contracting offices and referral coordinators do check. Name the body in words rather than relying on a logo, say what it covers if it covers only some of your services, and put a review date on the page so nothing stale sits there implying it is current. Whether to publish a specific number is worth a quick check with your administrator.
How much hosting does a home health agency or DME supplier need?
Less than most are sold. A site of text pages, a staff list and a form is one of the lighter things you can put on a server, and an entry shared plan covers it. Spend the money instead on a certificate, a backup you have restored at least once, and email on your own domain. A bigger plan makes sense only if you are running a real portal with logins or several agencies on one platform.
We are a physician practice, not an agency. Does any of this apply?
Not really, and it is better to say so. A practice sells to the patient directly, so the work is local search, accurate hours and locations, and easy booking. Referral thinking would point you at the wrong things entirely. Our pages for doctors and medical practices cover the practice case properly.
Related
Website Security
Logins, updates and the ordinary housekeeping that keeps a site with a form on it out of trouble.
Read about website securityBusiness Email
Why intake@ at your own domain matters when a hospital coordinator is deciding whether you are real.
Read about business emailEvery trade we cover is listed on hosting by industry.
Hero image: Jacek Halicki, CC BY-SA 4.0, via Wikimedia Commons. Cropped.
Make the site answer the referrer's questions
Tell us what your site runs on and where its referral form sends. We will tell you what needs attention and what is already fine.
Get Your Web Hosting Plan Get help choosing
Or call 716-771-2536 and tell us what the site has to do. If the plan you are already on is the right one, we will say so.