For practices

Detection without capability is worthless

A practice manager can know that every patient photograph needs a separate written authorization and still have no system that captures one. Knowing is not the hard part. The hard part is having an instrument that makes the rule satisfiable on a Tuesday afternoon, across nine locations, without a developer.

Most audits end at a list of findings. A list of findings is a list of things you cannot do. The catalogue below pairs each rule with the reason a practice typically cannot satisfy it, and with the instrument that closes the gap.

The capability map

Rule, gap, instrument

Every row names its source and the date we last checked that source. 26 of these 42checks are deterministic: same input, same verdict, every time. The rest say “checked against”, because that is all they can honestly say.

MED-PHI-AUTHDeterministiclegally required Every patient image has a live authorization: What is required
A separate written authorization is required for each use of a patient image in marketing.
Why you cannot do this today
Authorizations live on paper or nowhere. There is no link from a published photograph back to a consent, and no way to prove one existed at the time of publication.
The instrument that closes it — and whether it exists yet
Branded authorization capture, timestamped and revocable per asset. Publication is refused when no live authorization matches the image.
In build · phase one
MED-PHI-FACEAdvisorylegally required Full-face photographs are treated as identifiers: What is required
Full-face photographic images are a Safe Harbor identifier. Cropping does not de-identify them.
Why you cannot do this today
No practical way to detect faces across a photo library, and a widespread belief that cropping or angling is sufficient.
The instrument that closes it — and whether it exists yet
Face detection flags a full face the page presents as a patient — a before/after, a testimonial, a gallery — and asks for the authorization behind it. It does not block: whether the face is a patient’s, staff’s or a licensed model’s is not on the page.
In build · phase two
AD-RESULTS-DISCLAIMERDeterministiclegally required “Results not typical” does not cure a misleading result claim: What is required
The regulator states, on the basis of its own consumer testing, that a “results not typical” style disclaimer is insufficient to cure an otherwise misleading depiction.
Why you cannot do this today
The disclaimer is treated across the industry as a safe harbour, so the problem is invisible to the people writing the copy.
The instrument that closes it — and whether it exists yet
The anti-pattern is detected on sight and the claim is surfaced with what would actually be required instead.
In build · phase two
MED-FDA-CLEAREDBoundedlegally required Devices are described as cleared, not approved: What is required
Most aesthetic energy devices reach market through 510(k) clearance rather than approval, and registration and listing do not denote approval.
Why you cannot do this today
Vendor marketing copy is reproduced verbatim, and staff have no reference distinguishing a cleared device from an approved drug.
The instrument that closes it — and whether it exists yet
Claims are checked against a sourced device-to-pathway reference. Genuinely approved products are recognised as such rather than flagged.
In build · phase two
MED-BOARD-CERTDeterministiclegally required A “board certified” claim names the certifying board: What is required
The full name of the certifying board must appear at comparable prominence to the claim itself.
Why you cannot do this today
Nobody audits this page by page across dozens of practitioner and location pages.
The instrument that closes it — and whether it exists yet
Deterministic check across every page that makes the claim.
In build · phase one
AD-DISCLOSURE-POSDeterministiclegally required Disclosures are placed where they will actually be read: What is required
Disclosures placed at the end of a post, in a bio only, behind a “more” link, or buried among hashtags do not satisfy the requirement.
Why you cannot do this today
Social tools do not check placement, and posts are written by hand under time pressure.
The instrument that closes it — and whether it exists yet
Character-offset check on the composed post before it is published.
In build · phase one
MSG-SMS-STOPDeterministiclegally required Campaign messaging honours opt-out keywords: What is required
Recipients must be able to revoke consent, and the statute carries a private right of action.
Why you cannot do this today
Campaigns are sent from tools that do not enforce keyword handling, and the exposure is per message.
The instrument that closes it — and whether it exists yet
Pre-send gate. A campaign that cannot demonstrate opt-out handling does not send.
In build · phase two
MSG-AUTHDeterministic Bulk email authenticates and unsubscribes correctly: What is required
SPF, DKIM and DMARC alignment, plus a one-click unsubscribe whose headers are covered by the DKIM signature.
Why you cannot do this today
DNS configuration is beyond practice staff, and almost nobody checks the signature-coverage condition — so mail silently stops arriving.
The instrument that closes it — and whether it exists yet
DNS and header checks. Pure lookups, no judgement involved.
In build · phase one
A11Y-CONTRASTDeterministic Text meets minimum contrast against its background: What is required
Text must meet a minimum contrast ratio against its background.
Why you cannot do this today
The site was delivered and the design firm moved on. There is no developer to change a colour.
The instrument that closes it — and whether it exists yet
Measured, reported with the exact ratio and the failing pair, and corrected in generated assets.
In build · phase one
A11Y-ALTDeterministic Images carry alternative text: What is required
Non-text content has a text alternative.
Why you cannot do this today
Bulk-uploaded galleries — before-and-after sets especially — are published without any alternative text at all.
The instrument that closes it — and whether it exists yet
Presence is checked deterministically. Quality of wording is advisory and labelled as such, because meaning is not machine-checkable.
In build · phase one
GEO-CRAWLERDeterministic Answer-engine crawlers are not blocked: What is required
Answer engines use named user agents. If the origin refuses them, the site cannot be cited as a source.
Why you cannot do this today
A security plug-in or host default returns 403 to those agents, and nothing surfaces it — the practice simply disappears from AI answers.
The instrument that closes it — and whether it exists yet
Direct request per named agent, with the response code recorded. This is the most demonstrable failure of this type.
In build · phase one
PROV-AI-MARKDeterministiclegally required AI-generated content carries machine-readable marking: What is required
To the extent technically feasible, a covered provider must include a latent disclosure meeting the statute's criteria in any image, video or audio content its GenAI system creates or alters, except by minor modification. Applied from 2026-08-02.
Why you cannot do this today
Most practices do not know the requirement exists, and no consumer tool embeds the metadata.
The instrument that closes it — and whether it exists yet
Marking is applied in the generation pipeline, so anything we produce is marked by construction. Note that absence of a marking proves nothing about content we did not generate. EU AI Act Article 50 imposes a parallel marking obligation from the same date: a separate regime, and not the authority this rule quotes.
In build · phase two
FL-ADV-FREEDeterministiclegally required Florida "free consultation" ads carry the 72-hour refusal statement: What is required
Any advertisement for a free, discounted or reduced-fee service by a Florida-licensed health care practitioner must carry a fixed statement, "in capital letters clearly distinguishable from the rest of the text", telling the patient they may refuse to pay, cancel payment or be reimbursed for any service performed within 72 hours of responding to the advertisement.
Why you cannot do this today
Practices advertise free consultations constantly and the statement is long, exact, and almost never present. Nobody re-checks it when a landing page or an ad variant is rewritten, and the statute is prescriptive about capitalisation and prominence.
The instrument that closes it — and whether it exists yet
Detect the free/discounted/reduced-fee offer, then match the required statement literally, including its capitalisation. Report the offer and the missing statement together, with the statute text to paste.
In build · phase one
TX-ADV-ELIGIBLEDeterministiclegally required "Board eligible" and "board qualified" are prohibited in Texas: What is required
Texas deems it false, deceptive or misleading advertising to use "board eligible", "board qualified", "or any similar language calculated to convey the same meaning as ‘board certified’".
Why you cannot do this today
The phrases read as modest and truthful to the person writing them — a physician mid-certification describing their actual status. The rule names them explicitly anyway, and bio pages are written once and never re-read.
The instrument that closes it — and whether it exists yet
Literal phrase match across every page, bio and profile, with the near-variants enumerated rather than inferred.
In build · phase one
TX-ADV-CERT-BODYBoundedlegally required A Texas "board certified" claim names an accepted certifying body: What is required
In Texas, "board certified" may be used only by a physician currently certified by a member board of the ABMS, the AOA Bureau of Osteopathic Specialists, the American Board of Oral and Maxillofacial Surgery, or a certifying organisation separately approved by the Board.
Why you cannot do this today
The accepted set is a closed list, and the approved-organisation register changes on a five-year review cycle. A practice has no way to tell an ABMS member board from a similarly-named private certifying body, and aesthetic medicine has many of the latter.
The instrument that closes it — and whether it exists yet
Extract the certifying body named alongside each "board certified" claim and check it against the accepted list. Bounded, not deterministic: the claim has to be attributed to a body first, and the approved-organisation register is a moving target we must date.
In build · phase two
GEO-STRUCTURED-DATAAdvisory Practice pages carry structured data a machine can read: What is required
Schema.org markup describing the practice, its locations, its practitioners and its services lets search and answer engines read the page as data rather than inferring it from prose. Google is explicit that this earns no entitlement: "Google does not guarantee that your structured data will show up in search results, even if your page is marked up correctly according to the Rich Results Test."
Why you cannot do this today
Most practice sites were delivered without it, and the ones that have it often describe the agency that built the site rather than the practice. Nobody re-checks it when a location is added, so a multi-location practice ends up with markup for three of its five sites.
The instrument that closes it — and whether it exists yet
Report which entities are described, which are missing, and which contradict the page they sit on. Advisory only: we report what is present and what a reader could infer, and we never predict a search outcome from it.
In build · phase two
GEO-CWV-LABAdvisory Page-experience measurements, reported as the lab signal they are: What is required
Core Web Vitals are assessed on field data — "a good threshold to measure is the 75th percentile of page loads, segmented across mobile and desktop devices". A single measurement taken by us is a lab measurement, and web.dev is direct about the limit: "While lab measurement is an essential part of delivering great experiences, it is not a substitute for field measurement."
Why you cannot do this today
Vendors quote a one-off lab score as though it were the metric that counts. It is not the same number, and a practice acting on it can spend money moving a figure no user experiences.
The instrument that closes it — and whether it exists yet
Measure and report the lab signal, labelled as lab, alongside field data where the practice has authorised access to it. We never present a lab figure as the assessed metric, and we never convert either into a ranking claim.
In build · phase three
NY-ADV-GUARANTEEDeterministiclegally required New York prohibits advertising that guarantees any service: What is required
New York defines it as unprofessional conduct for a licensed professional to advertise in a way that "guarantees any service", or that "makes claims relating to professional services or products or the cost or price therefor which cannot be substantiated by the licensee, who shall have the burden of proof", or that "makes claims of professional superiority which cannot be substantiated by the licensee, who shall have the burden of proof". The burden of proof sits with the licensee, not the regulator.
Why you cannot do this today
Guarantee language is the default register of aesthetic marketing — "guaranteed results", "results guaranteed or your money back" — and it reads as confidence rather than as a prohibited claim. Nobody re-reads a landing page against a conduct rule after a campaign is written.
The instrument that closes it — and whether it exists yet
Literal phrase match for guarantee constructions and unsubstantiated superiority claims, reported with the burden-of-proof point attached, since the practice has to hold the substantiation rather than merely believe it.
In build · phase one
NY-ADV-TESTIMONIALBoundedlegally required New York patient portrayals need written authorization and disclaimers: What is required
New York permits testimonials and portrayals of patients only where "the patient or client expressly authorizes the portrayal in writing", "appropriate disclosure is included to prevent any misleading information or imagery", and "reasonable disclaimers are included as to any statements made or results achieved in a particular matter". Fictional situations are permitted only where no testimonials are included, and "fictional client testimonials are not permitted".
Why you cannot do this today
This is a second jurisdiction requiring written authorization before a patient may be portrayed, and practices treat a signed release for the photograph as covering the testimonial too. The disclaimer and disclosure conditions are separate requirements that almost never appear alongside the quote.
The instrument that closes it — and whether it exists yet
Check each testimonial or portrayal for a matching written authorization in the rights ledger, and for the presence of disclosure and results disclaimers. Bounded rather than deterministic: identifying what counts as a testimonial, and whether a disclaimer is adequate, is judgement over a stated policy rather than a string match.
In build · phase two
GEO-EXTRACTABLEAdvisory Content is structured so an answer engine can extract and attribute it: What is required
Google frames its content guidance as a self-assessment rather than a specification: "Evaluating your own content against these questions can help you gauge if the content you're making is helpful and reliable." The same page states that E-E-A-T "isn't a specific ranking factor". So the checkable question is structural — does a page state what it is about near the top, answer the question it poses, and name its sources where a reader or an engine can find them — not whether it earns a placement.
Why you cannot do this today
The gap here is the opposite of the usual one. Practices are sold "E-E-A-T optimisation" and "AI visibility scores" as though a number existed to move. It does not, and paying to move it is paying for folklore. Meanwhile the structural work that genuinely helps an engine quote you accurately goes undone because it is unglamorous.
The instrument that closes it — and whether it exists yet
Report structural findings only: whether a page answers the question it raises, whether claims carry a named source, whether headings describe content rather than tease it. Advisory, and deliberately unscored — we will not produce an E-E-A-T number, because Google says it is not a ranking factor and selling a score for it would be selling folklore.
In build · phase three
KS-ADV-GUARANTEEDeterministiclegally required Kansas prohibits advertising a guaranteed or painless service: What is required
Kansas defines it as unprofessional conduct for a licensee to advertise "to guarantee any professional service or to perform any operation painlessly". The same section also names "[a]dvertising professional superiority or the performance of professional services in a superior manner" (b)(7), and solicitation "through the use of fraudulent or false advertisements" (b)(1).
Why you cannot do this today
"Painless" and "pain-free" are standard aesthetic marketing vocabulary and read as reassurance rather than as a named prohibition. Kansas names both the guarantee and the painlessness claim explicitly, and a practice writing reassuring copy has no reason to suspect either is listed.
The instrument that closes it — and whether it exists yet
Literal phrase match for guarantee constructions and painless claims across every page, reported with the statute's own words attached.
In build · phase one
MO-ADV-SUBSTANTIATEBoundedlegally required Missouri prohibits unsubstantiated cure and superiority claims: What is required
Missouri makes advertising a ground for discipline where it is "false or misleading", or where it "claims without substantiation the positive cure of any disease, or professional superiority to or greater skill than that possessed by any other physician". A separate clause, §334.100.2(4)(e), names "[m]isrepresenting that any disease, ailment or infirmity can be cured by a method, procedure, treatment, medicine or device".
Why you cannot do this today
Superiority language — best, leading, most advanced, unmatched — is the default register of aesthetic marketing, and the statute puts the substantiation burden on the licensee. A practice that believes its claim is true still has to hold evidence for it.
The instrument that closes it — and whether it exists yet
Detect superiority and cure constructions, then report them with the substantiation requirement attached. Bounded rather than deterministic: whether a particular claim is substantiated is not decidable from the page, so we report the claim and name what must exist behind it.
In build · phase one
KS-ADV-FALSEBoundedlegally required Kansas treats soliciting patients by false advertisement as misconduct: What is required
Kansas defines unprofessional conduct to include "[s]olicitation of professional patronage through the use of fraudulent or false advertisements". The Act defines a false advertisement as "any advertisement that is false, misleading or deceptive in a material respect", and defines advertisement broadly as representations disseminated by any means for the purpose of inducing the purchase of professional services.
Why you cannot do this today
The definition reaches any representation made to induce a purchase, which includes social posts and paid placements a practice may not think of as advertising at all. Nobody re-reads a three-year-old landing page against it.
The instrument that closes it — and whether it exists yet
Surface claims whose substantiation is not evident on the page, and report them with the statute's definition attached. Bounded rather than deterministic: materiality and deception are judgements about the whole impression, not about a string.
In build · phase one
KS-ADV-SUPERIORITYDeterministiclegally required Kansas prohibits advertising professional superiority: What is required
Kansas names it as unprofessional conduct to advertise "professional superiority or the performance of professional services in a superior manner". Unlike Missouri, which permits a superiority claim that the licensee can substantiate, Kansas states the prohibition without a substantiation escape.
Why you cannot do this today
Superlatives are the default register of aesthetic marketing — best, premier, leading, most advanced. A Kansas practice using the same copy as a Missouri practice across the state line is in a different position, and nothing on the page signals that.
The instrument that closes it — and whether it exists yet
Literal match for superiority constructions, reported with the statute's wording. Worth reading alongside the Missouri rule, which addresses the same copy on a different test.
In build · phase one
MED-PHI-FILENAMEDeterministiclegally required Image filenames can publish a name the page never shows: What is required
Names are the first identifier Safe Harbor requires to be removed. An image URL is published HTML: a filename pairing a surname with a treatment discloses that name to anyone reading the source, whatever the picture itself shows.
Why you cannot do this today
Filenames arrive from a camera, a device manufacturer or a rep and are uploaded untouched. Nobody reviews them, they are invisible in the page as rendered, and a CMS will happily serve them forever. Found on a real engagement: nine before-and-after images carried surnames in their filenames.
The instrument that closes it — and whether it exists yet
Read image URLs on every page scanned and report filenames that pair a person-like name with treatment or before-and-after markers. Renaming the file is the whole remedy, and it costs nothing.
In build · phase one
MED-IMG-PROVENANCEBoundedlegally required Manufacturer before-and-after images need written permission, not patient consent: What is required
A before-and-after image on a practice site is one of two different things, and they need different instruments. If the practice took it, it needs a HIPAA marketing authorization under §164.508 — a specific, revocable document, not a general consent form. If a device manufacturer supplied it, the practice instead needs the manufacturer's written permission naming the practice, and their warranty that they hold the subject's authorization.
Why you cannot do this today
Practices cannot tell the two apart, because device reps supply clinical assets that look exactly like the practice's own photography. Found on a real engagement: nine images assumed to need nine patient conversations turned out to carry manufacturer and investigator credits printed in the artwork, and needed three emails to reps instead. Guessing wrong in the other direction is worse — it means publishing a patient photograph with no authorization on file.
The instrument that closes it — and whether it exists yet
Detect before-and-after imagery and ask which bucket each belongs to, then hold the answer in the rights ledger. A "results may vary" caption is not a remedy for either bucket — the FTC has tested those disclaimers — and adding one creates a second problem under 16 CFR §255.2(b).
In build · phase one
MSG-EMAIL-OPTOUTDeterministiclegally required Marketing email carries a working opt-out that keeps working: What is required
Every commercial email must carry a functioning opt-out mechanism, clearly and conspicuously displayed, and it must still work for at least thirty days after the message was sent.
Why you cannot do this today
Campaign tools bolt an unsubscribe footer on at send time, so nobody checks that the link still resolves a month later — and an expired list, a rotated domain or a retired form turns a lawful send into an unlawful one retroactively.
The instrument that closes it — and whether it exists yet
The opt-out is generated as a signed token carried in the link, so it verifies without a database read and cannot go stale. Suppression is append-only and permanent.
In build · phase two
MSG-EMAIL-DISCLOSEDeterministiclegally required Marketing email says it is marketing, and says who sent it: What is required
A commercial email must identify itself as an advertisement or solicitation, give clear notice of the opportunity to decline further mail, and carry a valid physical postal address of the sender.
Why you cannot do this today
Outbound that opens with a free audit or a courtesy report reads as a favour rather than a solicitation, and the postal address is the element most often missing entirely. Both are mechanically checkable and neither is usually checked.
The instrument that closes it — and whether it exists yet
The three elements are assembled with the message rather than appended to it, and the send gate inspects them. A message whose elements the gate cannot see does not go out.
In build · phase two
FTC-REVIEW-INCENTIVEDeterministiclegally required Review requests do not pay for a sentiment: What is required
Compensation may not be offered in exchange for, or conditioned on, a review expressing a particular sentiment. Asking for a review is permitted; asking for a good one and paying for it is not.
Why you cannot do this today
A discount offered for a five-star review is standard front-desk practice and reads as ordinary hospitality, so nobody recognises it as the conduct the rule names. The line falls between "leave us a review" and "leave us a five-star review" — one word apart, and only one of them is lawful.
The instrument that closes it — and whether it exists yet
Review solicitation copy is checked before it is printed, posted or scripted, and the sentiment condition is removed rather than the incentive.
In build · phase two
FTC-REVIEW-INSIDERBoundedlegally required Staff testimonials disclose the relationship: What is required
A testimonial from an officer, manager, employee or agent must carry a clear and conspicuous disclosure of that relationship, unless it is already obvious to the reader.
Why you cannot do this today
Practices publish staff experiences of their own treatments as patient testimonials because the staff genuinely had the treatment. The relationship is real, material, and invisible on the page.
The instrument that closes it — and whether it exists yet
Testimonials carry their provenance in the governance record, so a staff testimonial cannot be published without its disclosure attached.
In build · phase two
A11Y-LABELSDeterministic Form fields tell you what to type: What is required
Every consultation form, booking form and newsletter box needs a programmatic label, not just placeholder text that disappears the moment someone types.
Why you cannot do this today
Placeholder-only fields look labelled to a sighted user and are silent to a screen reader. A booking form nobody can complete is a lost patient, which is the version of this a practice acts on.
The instrument that closes it — and whether it exists yet
Labels are generated with the field, so a form cannot ship without them.
In build · phase two
A11Y-LINK-PURPOSEDeterministic Links say where they go: What is required
A link must be understandable from its own text or its immediate context.
Why you cannot do this today
Galleries and treatment pages are built from repeated "Learn More" and "Click Here" links. A screen reader user tabbing through hears the same two words twenty times with nothing to choose between.
The instrument that closes it — and whether it exists yet
Link text is generated from the destination, so the words describe the page they open.
In build · phase two
A11Y-PAGE-TITLEDeterministic Every page is titled: What is required
Each page carries a title describing what it is.
Why you cannot do this today
Template pages ship with the theme default or the site name repeated, which leaves every browser tab, bookmark and search result identical.
The instrument that closes it — and whether it exists yet
Titles are derived from page content and checked before publication — the same check this site runs on itself.
In build · phase two
A11Y-LANGDeterministic The page declares its language: What is required
The document carries a lang attribute.
Why you cannot do this today
One attribute, almost always absent on templated sites, and without it a screen reader may read English copy with a Spanish voice.
The instrument that closes it — and whether it exists yet
Emitted with the document. A one-line fix that nobody looks for.
In build · phase two
A11Y-STRUCTUREDeterministic Headings and lists are real markup: What is required
Visual structure must exist in the markup, not only in the styling.
Why you cannot do this today
Page builders produce bold styled text where a heading belongs, so a screen reader user cannot skim the page by its structure — the way most of them navigate.
The instrument that closes it — and whether it exists yet
Content is authored as structure and rendered to styling, rather than the reverse.
In build · phase two
A11Y-NAME-ROLEDeterministic Buttons and controls announce themselves: What is required
Interactive components expose a name, a role, and their state.
Why you cannot do this today
Booking widgets, carousels and pop-ups are built from divs with click handlers. They work with a mouse and do not exist to assistive technology.
The instrument that closes it — and whether it exists yet
Components are built from elements that carry their own semantics.
In build · phase two
WA-MHMD-LINKDeterministiclegally required A consumer health data privacy policy, linked from the homepage: What is required
Washington requires a separate consumer health data privacy policy, and a link to it published prominently on the homepage. A general privacy policy does not satisfy this — the statute names a distinct document.
Why you cannot do this today
Practices have a privacy policy and assume it covers them. My Health My Data is enforceable through the Consumer Protection Act, which carries a private right of action, so this is the rare marketing rule a patient can sue over without a regulator deciding to act first.
The instrument that closes it — and whether it exists yet
The policy is generated from what the site actually collects, and the homepage link is emitted with it rather than added by hand afterwards.
In build · phase two
WA-MHMD-CONSENTBoundedlegally required Consent before health data is collected, not after: What is required
Consent must be obtained before any consumer health data is collected or shared, and the request must disclose the categories collected, the purpose, who it is shared with, and how to withdraw.
Why you cannot do this today
Advertising pixels on a treatment page fire on load. The page a visitor reads about a procedure is itself the health data, and the tracker has already sent it before anyone has been asked anything.
The instrument that closes it — and whether it exists yet
Tags are held until consent is recorded, and what was disclosed at the moment of consent is kept with it.
In build · phase two
FTC5-PRIVACY-PROMISEBoundedlegally required A privacy policy that promises what the site does not do: What is required
A privacy policy is a representation to consumers. Promising that information is never shared with third parties while running advertising tags that send visitor data to them is a deceptive practice under the FTC Act — the theory behind the FTC's GoodRx and BetterHelp actions.
Why you cannot do this today
The policy is a template written once; the tags are added later by whoever runs the ads. Nobody re-reads the policy when a pixel goes in.
The instrument that closes it — and whether it exists yet
The policy is generated from the tags the site actually loads, so adding a tag changes the policy or fails the check.
In build · phase two
HIPAA-TRACK-INTAKEBoundedlegally required Third-party trackers where patients type their details: What is required
A covered entity may not disclose protected health information except as the Privacy Rule permits. A tracker that loads on an appointment or intake form can receive what a patient types there — name, contact details, reason for the visit — and HHS treats that as a disclosure of PHI to the tracker vendor.
Why you cannot do this today
Booking pages are built by whoever built the site, and the agency that added the ad tag never asked whether a patient would type a reason for their visit on that page. Most tracker vendors will not sign a business associate agreement.
The instrument that closes it — and whether it exists yet
Booking and intake run in a frame or page with no third-party tags, and the tags that remain are listed with the agreement, if any, that covers each.
In build · phase two
WA-ADV-MISLEADINGBoundedlegally required Advertising that is false, fraudulent or misleading: What is required
Washington defines unprofessional conduct for a licence holder to include all advertising which is false, fraudulent, or misleading — with no substantiation escape written into the clause.
Why you cannot do this today
The clause is short and absolute, and the copy it catches is ordinary superlative marketing that reads as enthusiasm rather than as a claim.
The instrument that closes it — and whether it exists yet
Claims are checked against the wording before publication, and the substantiation is held with the claim rather than recalled later.
In build · phase two
CA-CALOPPA-POSTEDBoundedlegally required A California site that collects names, emails or phone numbers links its privacy policy from the homepage: What is required
California requires the operator of a commercial website that collects personally identifiable information — a name, an email address, a telephone number — from California residents to post a privacy policy conspicuously: on the homepage, or through a link there containing the word "privacy". The policy must identify its effective date. There is no size or revenue threshold. A missing policy becomes a violation if it is still missing 30 days after the operator is notified.
Why you cannot do this today
A practice's site is a template with a contact form and a booking widget; the footer the template shipped with often has no privacy link at all, and nobody connects "we added a form" with "we now owe a privacy policy".
The instrument that closes it — and whether it exists yet
Where any crawled page has a form asking for a name, email or phone number, look on the homepage for a link whose text or label contains "privacy" (the statute's own test) and report its absence; where the policy is on the site and readable, report a policy that gives no effective date. Bounded: §22577(b) accepts other conspicuous forms a pattern cannot judge, the scan sees the homepage it was served, and the statute makes absence a violation only after notice, so the finding says the link was not found, never that the practice is in violation.
In build · phase one

This is the published subset. A rule without a verbatim source quote and a date does not load into the engine, so it does not appear here either.

The boundary

We never touch your website

Remediation produces a new, corrected artifact. It does not edit an existing one. Nothing we run installs a script on your site, and nothing we run has write access to your CMS. You publish, or your agency publishes. That is the legal position and it is also the practical one: a vendor with a script on your site is a vendor who can break it.

We do not: Write into your website, your CMS, or your booking system.
We do: Produce a corrected asset. You or your agency publish it.
We do not: Store your patient photographs.
We do: Gate publication against an authorization record we hold.
We do not: Warrant that your site is compliant.
We do: Seal what was checked, at which tier, on which date.

Start with the rules you are failing

The first audit is read-only and needs nothing but a URL. You get the findings, the source behind each one, and the tier it was checked at. If we find nothing, we will tell you that.

Request an audit Read the check catalogue

Detection without capability is worthless

Rule, gap, instrument

Every patient image has a live authorization

Full-face photographs are treated as identifiers

“Results not typical” does not cure a misleading result claim

Devices are described as cleared, not approved

A “board certified” claim names the certifying board

Disclosures are placed where they will actually be read

Campaign messaging honours opt-out keywords

Bulk email authenticates and unsubscribes correctly

Text meets minimum contrast against its background

Images carry alternative text

Answer-engine crawlers are not blocked

AI-generated content carries machine-readable marking

Florida "free consultation" ads carry the 72-hour refusal statement

"Board eligible" and "board qualified" are prohibited in Texas

A Texas "board certified" claim names an accepted certifying body

Practice pages carry structured data a machine can read

Page-experience measurements, reported as the lab signal they are

New York prohibits advertising that guarantees any service

New York patient portrayals need written authorization and disclaimers

Content is structured so an answer engine can extract and attribute it

Kansas prohibits advertising a guaranteed or painless service

Missouri prohibits unsubstantiated cure and superiority claims

Kansas treats soliciting patients by false advertisement as misconduct

Kansas prohibits advertising professional superiority

Image filenames can publish a name the page never shows

Manufacturer before-and-after images need written permission, not patient consent

Marketing email carries a working opt-out that keeps working

Marketing email says it is marketing, and says who sent it

Review requests do not pay for a sentiment

Staff testimonials disclose the relationship

Form fields tell you what to type

Links say where they go

Every page is titled

The page declares its language

Headings and lists are real markup

Buttons and controls announce themselves

A consumer health data privacy policy, linked from the homepage

Consent before health data is collected, not after

A privacy policy that promises what the site does not do

Third-party trackers where patients type their details

Advertising that is false, fraudulent or misleading

A California site that collects names, emails or phone numbers links its privacy policy from the homepage

We never touch your website

Start with the rules you are failing