Medical Website Cost: Build, Forms, Booking, Upkeep

A medical website costs twice: once to build, then yearly for hosting, a HIPAA form plan, upkeep and provider changes. Jotform, a form builder, charges $1,188 a year for Gold, its only self-serve plan with HIPAA features. A five-page brochure site is cheap to host and build. The price climbs at the contact form, the booking link and the day a doctor joins or leaves.

Quick answer

• Ask every bidder for two totals: one-time lines and every-year lines, listed separately.
• Ask which parts collect patient details, and which vendor signs a business associate agreement for each.
• Look up whose name the domain is registered in before the build starts.
• Put the number of provider changes included each year into the contract.
• Budget an accessibility check before launch if your practice bills Medicare Part B.

Which parts of the site touch patient data?

Four of these five lines sit where patient data or the EHR comes near the site, so compare bids on them line by line. A business associate agreement, or BAA, is the contract between a practice and a vendor that holds patient data.

The forms line needs the closest look. I cover what a form must collect in HIPAA website forms. The tags line has its own post, HIPAA-conscious conversion tracking.

The form plan and its BAA

On Jotform, HIPAA features start at the top self-serve plan. Its pricing page shows HIPAA features only on Gold, at $129 a month or $1,188 billed annually, and on Enterprise, which is priced by quote. Its HIPAA page says the same: Gold or Enterprise.

The HIPAA page also says "Covered Entity customers" who have turned on its HIPAA compliance features receive a signed BAA, so a plan upgrade alone is not the whole step. That is one vendor, and your site may use another. Ask each one the same three things: which plan, billed how, and what you must switch on before the agreement exists.

Monthly billing on Gold costs $1,548 a year, so annual billing saves $360. When Jotform runs a first-year discount on annual plans, its pricing page says the plan renews at full price a year later. Budget the full price from year two.

In Canada there is no BAA: PIPEDA's clause 4.1.3 asks for contractual or other means to protect data a vendor processes, and Ontario adds PHIPA for health information.

Booking: is it in your EHR subscription or an add-on?

Your EHR's pricing page answers it, and for DrChrono the widget comes with every plan. Its pricing page ticks "Scheduling Widget for Website" in all three plans, Foundation, Growth and Premium. Plan prices are not on the page, though. Each plan says "Request A Quote", so the total is still a quote.

Start with that built-in scheduler, because it avoids a second vendor holding patient details. A third-party booking layer on top of the EHR is another vendor to pay and another to ask about a BAA. Put both routes side by side before the web quote is final.

I have connected DrChrono online scheduling to Google Ads for a US medical practice. The booking link on the site was the easy part. The work was in counting what happened after the click. My DrChrono scheduling post covers it.

Costs that grow with each provider

Count last year's provider joins, departures and hours changes; multiply the ones your maintenance plan does not include by the quoted price per change.

Each clinician adds a bio page, a headshot, a booking link and an entry on every list, so the cost grows with headcount more than with pages. When one doctor leaves and another joins, every one of those items changes twice: out for one, in for the other.

Ask the agency three things:

• How many provider or hours changes the maintenance plan includes each year.
• The printed price of the next change.
• Whether your front desk can edit bios without calling the agency.

Accessibility as a budget line

If your practice receives HHS federal financial assistance, accessibility belongs in the build quote, not in a fix after launch. HHS's Section 504 rule requires web content and mobile apps to conform to WCAG 2.1 at levels A and AA, the standard that covers contrast, keyboard use and screen reader labels.

A 2024 HHS rule counts Medicare Part B payments as that assistance.

A rule that took effect without a comment period first pushed the dates back a year. 45 CFR 84.84 now says May 11, 2027 for practices with 15 or more employees, and May 10, 2028 for fewer than 15.

Two exceptions in 84.85 matter for budgeting.

Third-party content is exempt only when no contract stands behind it, and 84.84 covers content you provide through a contract. A booking widget you license is in scope.

I explain the wider rules in medical website design. In Ontario, the AODA requires the public websites of businesses and non-profits with 50 or more employees to meet WCAG 2.0 AA. Ask your own lawyer how the rule fits your practice; I'm not one, and this post is not legal advice.

One-time and yearly costs for four providers

Run your own quotes through the same sums. A bid that shows only the first total leaves out about half of the three-year cost in this example.

Check who holds your domain from your phone

Do this before you pay a deposit.

1. Open ICANN Lookup and search your practice's domain.
2. Note the registrar. If the registrant shows as redacted, log into that registrar's account instead.
3. Read the registrant name and email. It should be the practice, on an address you control.
4. If it shows the agency, ask them to change it now.
5. Log into the hosting account and confirm your own login exists.

Start before you need it. Under ICANN's transfer policy, a registrant change locks the domain against a move to another registrar for 60 days, unless the registrar let you opt out first. More on the domain in what a dental website costs.

Prices and rules checked on 2026-10-26.