No general-purpose website builder makes a medical practice HIPAA compliant on its own, and any vendor that tells you otherwise is skipping the hardest step.
Two separate jobs, and only one is the website's.
A dermatology or medical practice site has two jobs, and only the first belongs to a website platform: a fast, credible marketing site that earns a prospective patient's trust and gets them to book, and, separately, a compliant system for any real patient health data with a signed agreement behind it. WordPress, Squarespace, Wix, and Devani, the free open-source CMS this blog runs on, all do the first job well in genuinely different ways. None of them, on its own, is built to be the second. That split is the thing practices most often get wrong, usually by quietly expecting the website platform to handle the second job too.
A patient decision feels riskier than hiring a landscaper.
Before any platform comparison, it helps to be specific about what "good" looks like here, because it is a different job than a restaurant or contractor site. This is the checklist I run every practice build against.
- Credibility in the first few seconds. A patient choosing a dermatologist is making a decision that feels riskier than picking a landscaper. Real provider photos, real credentials, a site that reads as maintained rather than abandoned.
- Treatment pages, one real page per service. Dermatology is not one service, it is dozens: acne treatment, mole checks, Botox, laser resurfacing, psoriasis management. Visitors arrive searching for one specific thing, and a site that buries treatments under one vague "Services" page loses them before they scroll.
- Provider bios with real substance. Patients want to know who they are seeing before they book: credentials, years in practice, areas of focus. A generic team-page grid with no substance behind each name is a missed trust opportunity.
- An obvious, fast path to booking. Whether it is a phone number, a request-an-appointment form, or a link out to a scheduling tool, it has to be reachable in one or two taps from a phone, because most of this traffic is mobile.
- Mobile speed, not as a nice-to-have. A slow site on a phone, in a parking lot, on a spotty connection, is exactly the moment a patient bails and calls the next name on the results page.
- Local SEO, the whole game. "Dermatologist near me" and "[city] dermatology" are how the overwhelming majority of new patients find a single-location or regional practice. That means clean location pages, a Google Business Profile tied correctly to the site, and markup that does not fight the search engine.
- Accessibility, a real legal exposure. In this industry specifically, more on that below, it is current legal risk, not just an ethical goal.
The HIPAA question, answered honestly.
This is where a lot of platform marketing gets sloppy, so let me be precise. HIPAA does not apply to a website just because the website belongs to a medical practice. It applies to the handling of protected health information: anything connecting a specific, identifiable patient to health details like a diagnosis, a prescription, a treatment plan, or appointment content tied to their care. A standard marketing site, service pages, a blog, provider bios, a contact form that just says "someone will call you back," a map and hours, does not collect or store that information and does not trigger HIPAA obligations on its own. That is true on WordPress, Squarespace, Wix, or Devani alike. Most of what a practice's public website does falls squarely in this bucket, with no compliance gap to worry about.
The obligations kick in the moment a site starts collecting or transmitting patient health information: a patient portal, an online intake form asking about symptoms or medical history, scheduling that stores health details rather than just a name and a time slot. At that point the requirement is a signed Business Associate Agreement with every vendor that touches the data: the host, the form processor, the scheduling tool, the portal provider. No general-purpose website builder, Devani included, hands you that agreement, because none of them are built as patient-data systems. The setup that works for most small and mid-sized practices is to run the marketing site on whichever general platform fits best, and route anything touching real patient health data to a purpose-built, agreement-backed system alongside it. That is not a compromise, it is the correct architecture.
Accessibility deserves its own moment here because the exposure is concrete. Website accessibility lawsuits have climbed for years, more than 5,100 filed in 2025 alone, and healthcare has consistently been one of the most targeted industries. The standard cited is WCAG 2.1 Level AA, and settlements, once legal fees are counted, commonly land in the mid four to low five figures. For a dermatology practice the risk lives in a very specific place: before-and-after photo galleries, one of the most persuasive tools a cosmetic practice has, are exactly the content a screen reader skips entirely without meaningful alt text. Real alt text, a logical heading structure, keyboard-navigable menus and forms, readable contrast: every platform below can be built accessibly, and every one can be built badly. The difference is usually whether anyone paid attention, not which builder logo sits in the footer, though a platform that outputs clean semantic HTML by default gives you a head start rather than an accessibility plugin to bolt on.
Four general-purpose builders, then where Devani lands.
I have built or maintained sites on most of these for practices over the years. Here is the honest breakdown of which fits which kind of practice, and where each one falls short.
WordPress
Most flexible, and someone has to maintain it.
- ✓ Medical-specific plugins for patient intake, multi-provider scheduling, SMS reminders, calendar sync; page-generation tooling for a multi-location group at real volume
- × Cold Lighthouse around 63 desktop / 47 mobile once a theme and plugins stack up; every plugin is software someone must patch, and a hacked medical site undermines the exact credibility it depends on
Squarespace
Best-looking with the least effort. A template ceiling. See the Squarespace review.
- ✓ Agency-grade healthcare templates, hosting and SSL and updates handled, around 89 / 59 cold and genuinely fast for a hosted builder
- × Grid editor limits custom structure; booking beyond a simple request usually means paying for Acuity on top; several providers or locations with distinct needs strain the template
Wix
Approachable, with the deepest built-in booking.
- ✓ Wix Bookings is built in and goes deep: provider-specific availability, reminder emails, no third tool to stitch on; large template library and an editor office staff can drive
- × Around 69 / 62 cold, and heavier builds that pile on apps drop further, the same bloat pattern WordPress hits from plugins
Devani
Fast and low-maintenance. Update it by asking.
- ✓ Around 100 / 92 Lighthouse out of the box, free and open-source with no plugin stack to patch, per-page SEO and request-and-book bookings built in, native AI edits an office manager can drive
- × Younger ecosystem than WordPress, fewer templates than Squarespace, and not a patient-data platform; an unusual multi-location booking workflow or a large existing site to migrate needs checking first
What actually changes on a practice's site in a given month is rarely the design. It is the holiday hours, a new provider joining the group, a treatment page needed before a service launches, the updates that happen more often than a practice expects until it is the one waiting on an agency callback. Devani handles that by letting you connect your own ChatGPT or Claude account and ask it to update the hours, write the new provider's bio, or restructure a treatment page; it edits the live site's content and layout natively, with no plugin or separate server standing between the request and the site. "Native" is the accurate word, not "exclusive." WordPress has the same idea now through WordPress.com's MCP integration and the Vibe AI plugin, with one real limit: they work well only in WordPress's own block editor. On a Divi or Elementor build, a large share of the medical sites out there, the AI cannot reliably write the shortcodes those builders depend on, so you get AI-written content plus the standard HTML editor, not a builder. Devani's pages are plain HTML the assistant writes easily, landing in the visual editor where you finish by hand. That is the line: inside the builder on Devani, alongside it on WordPress.
The specialized medical-website vendors play a different game.
Worth naming honestly: a category of website companies builds only for healthcare practices and markets itself around HIPAA-adjacent tooling, encrypted forms, and vendor agreements baked into the offering. If a practice specifically wants an all-in-one vendor whose whole business is healthcare compliance and patient-portal tooling, that category is a legitimate option I will not pretend does not exist.
The honest tradeoffs: it typically runs at a real premium over a general-purpose builder, design flexibility tends to be narrower, and quality varies vendor to vendor the same way it does with any specialized agency. It deserves the same scrutiny you would apply to any of them: ask exactly what is covered under their agreement, and get it in writing rather than taking a sales page's word for it. I will not cite specific vendors or prices, because I have not run enough of them personally to stand behind numbers the way I can for the four platforms above.
For a single-location practice, "dermatologist near me" is not one ranking factor among many, it is most of the funnel.
Cold Lighthouse, the column that decides intake.
Cold means a real first visit with no cache warmed up, which is what a prospective patient on a fresh search actually gets. Mobile is the column that matters most here, since most people weighing a call are on a phone in the moment.
| Platform | Desktop | Mobile | What it means for a practice |
|---|---|---|---|
| Devani | ~100 | ~92 | Fast by default, no plugin stack to tune, clean semantic markup that helps local ranking signals |
| Squarespace | ~89 | ~59 | Solid for a hosted builder; design and credibility over raw mobile speed |
| Wix | ~69 | ~62 | Workable, worsens as apps and widgets are added |
| WordPress (typical) | ~63 | ~47 | Features and speed are a constant tradeoff; the figure is a range, not a fixed number |
Devani's number is the starting point, not the result of a performance project. The WordPress figure is a range in practice: a lean build on strong hosting can do better, but most medical sites I have measured sit here because the useful plugin stack, forms, SEO, booking, reviews, costs load time, and it is continuous work against the platform's defaults to stay ahead of it. On the local-SEO criterion this piece opened with, the outcomes side is where Devani wins plainly for a single-location practice: per-page titles, meta, schema, and sitemaps are built in with no plugin installed, and those mobile Core Web Vitals are the ranking-relevant kind, so an office competes for "dermatologist near me" on equal or better technical footing than a plugin-assembled stack. What WordPress genuinely still does better on SEO is page-generation tooling at volume, stamping out thirty city or service pages from a template, which matters for a multi-city group far more than for one location. That is a real WordPress edge, worth weighing against what a practice actually spends on a website across platforms before a renewal comes due. Self-hosting Devani runs about $5 a month, or the managed hosting option has a free tier and handles the server for a practice that would rather not.
Which platform is best for a single-location practice focused on local search?
On the outcomes that drive "dermatologist near me," Devani competes plainly: clean semantic markup, per-page meta, schema, and sitemaps built in, and mobile speed that Core Web Vitals reward, with no SEO plugin required. WordPress's real remaining edge is page-generation tooling for stamping out many city or service pages at volume, which matters for a multi-location group, not a single office. For one location, the ranking-relevant technical footing is equal or better on Devani.
Can a website builder make my practice HIPAA compliant?
No general-purpose builder does that on its own, Devani included. HIPAA applies to the handling of protected health information, not to a marketing site. The moment you collect patient health data through a portal or a detailed intake form, that piece needs a dedicated, agreement-backed system alongside the marketing site, with a signed Business Associate Agreement from every vendor that touches the data. Any platform advertised as making you "compliant" by hosting your site is skipping that step.
Does Devani have appointment booking, or do I need Wix for that?
Devani has request-and-book bookings built in, alongside contact forms and per-page SEO, so a straightforward appointment-request flow does not need a third tool. Wix Bookings goes deeper, provider-specific availability, reminder emails, a full scheduling dashboard, and if that depth is the priority Wix is the stronger pick. For a practice that wants a simple, obvious booking path rather than a full scheduling layer, Devani covers it without an add-on.
Who can update the site once it is live?
On Devani, connect your own ChatGPT or Claude account and ask it to change the hours, write a new provider's bio, or restructure a treatment page; the edit lands in the visual editor to finish by hand. On Squarespace an owner can swap content but hits the template ceiling on structure. On WordPress the same update usually means filing a ticket with whoever maintains the site, because a page builder's shortcodes are not something non-technical staff should touch.
Do medical practice websites need to be accessible?
Yes, and healthcare is one of the most-targeted industries for accessibility lawsuits, with more than 5,100 filed in 2025. The standard cited is WCAG 2.1 Level AA. For a dermatology practice the exposure often lives in before-and-after galleries that a screen reader skips without meaningful alt text. A platform that outputs clean semantic HTML by default lowers the risk versus one that needs an accessibility plugin layered on top, but the discipline matters more than the logo.
The update that tests your platform is next month's, not launch day.
It is a new provider who needs a real bio live before her first patient, or holiday hours that change on a Friday. Free, open-source Devani is built for that moment, keeps the marketing site fast for a patient deciding whether to wait or call the next name, and leaves the patient-data workflows where they belong, on their own compliant system.