Sites for every hospital, clinic and service line, without losing the system brand
A health system that grew by acquisition usually inherits websites with the buildings: a rural hospital on an old CMS, an orthopaedic group on a template site, a foundation run by volunteers, a cancer centre built by an agency for a campaign. This page is about getting those under one brand and one set of rules, what the HHS Section 504 web rule now asks of federally funded providers, and the hard line between a marketing site and anything that touches patient data.
TL;DR
- Most system sprawl is not the main site. It is facility, service-line, physician-group, foundation and recruitment sites, each with a different owner.
- HHS moved its Section 504 web and app deadline: May 11, 2027 for recipients with 15 or more employees, May 10, 2028 for smaller ones. The standard is still WCAG 2.1 AA.
- Keep protected health information off these sites. Appointment requests, symptom questions and portal log-ins belong in your clinical systems, not a marketing form.
- We.Inc gives each facility or service line its own site under the system brand, with per-site switches, single-step approval before a site goes live, an audit log and downloadable code. Book a demo to map your own sites.
Where health-system web sprawl actually comes from
Ask a system marketing team how many websites they run and the first answer is "one". The real number turns up during an acquisition review or a breach scare, and it is rarely below twenty. The sources are predictable.
- Acquired hospitals and physician groups. The deal closes, the sign on the building changes within months, and the old website stays up for years because nobody owns the migration. Phone numbers drift, providers who left are still listed, and the old logo sits next to the new one.
- Service lines. Cardiology, orthopaedics, oncology, women's health and bariatrics each want a site that speaks to their patients and referring doctors. They have budget, so they hire an agency, and the agency builds whatever it builds best.
- Foundations and auxiliaries. Fundraising sites with donation pages, gala pages and volunteer sign-ups, often run by a separate team with separate vendors.
- Recruitment and graduate medical education. Nursing recruitment campaigns, residency programme sites, and fellowship pages aimed at a completely different audience from patients.
- Campaigns and community programmes. A flu-shot drive, a new tower opening, a community health needs assessment. Short-lived, then forgotten.
Each of these is legitimate. The problem is not that they exist. It is that they are built on different platforms, approved by nobody in particular, and owned by whoever signed the original invoice.
A site register for a health system
Before any platform decision, write down what you have. This is the register we suggest; copy it into a spreadsheet.
| Column | What goes in it | Why it matters |
|---|---|---|
| Site name and address | The live web address and any old addresses that redirect to it | Acquired sites often have three domains pointing at one site |
| Entity | Which hospital, group, foundation or programme it represents | Determines which legal entity is responsible and which Section 504 date applies |
| Business owner | A named role in that entity, not a vendor | Somebody must be able to say yes to changes and to retiring the site |
| Editors | Who actually changes content today | Usually a coordinator, a practice manager or an agency |
| Forms on the site | Every form and where its submissions go | The single biggest privacy risk on marketing sites |
| Tracking scripts | Analytics, ad pixels, chat widgets, heat maps | Needs privacy and compliance review on health sites |
| Clinical links | Patient portal, scheduling, bill pay, price transparency files | These must point at the system's real tools, not copies |
| Review date | When content was last checked by the owner | Provider lists and hours go stale fastest |
| Planned end | For campaigns and transitional sites | Stops forgotten sites piling up |
The "forms" and "tracking scripts" columns are the ones that tend to produce surprises. Fill them in first.
The line between a marketing site and patient data
Facility and service-line sites exist to help people find care: locations, hours, services, providers, directions, how to book. They should not themselves collect or store health information about patients.
A workable rule for every site in the register:
- No clinical intake forms. No symptom checkers, no "describe your condition", no medical history fields. Link to the system's patient portal or scheduling tool instead.
- Contact forms ask for contact details only, with wording that tells people not to include medical information.
- Appointment buttons hand off to your existing scheduling system rather than collecting requests in the site's own form.
- Tracking scripts are reviewed before they go on any page, including pages that look harmless, such as a service-line page or a provider profile. The HHS Office for Civil Rights has published guidance on the use of online tracking technologies by HIPAA covered entities; your privacy office and counsel should decide what is allowed.
- Donations go through the foundation's payment provider, not a home-made form.
We.Inc is a website platform for marketing and information sites. We do not offer a business associate agreement and we do not present the platform as suitable for protected health information. Use it for the public face of a facility, and keep anything clinical in the clinical systems you already run.
Section 504: the dates that now apply
The Department of Health and Human Services' 2024 Section 504 rule requires recipients of HHS federal financial assistance (which includes hospitals and clinics that take Medicare or Medicaid funding) to make their web content and mobile apps meet WCAG 2.1 Level AA. In May 2026 HHS published an interim final rule that moved the compliance dates back by one year:
- May 11, 2027 for recipients with 15 or more employees.
- May 10, 2028 for recipients with fewer than 15 employees.
The standard itself did not change, and HHS said the extension does not delay other Section 504 duties. A large system will almost always fall in the first group, but separately owned affiliates and small physician practices may not; your counsel should confirm which entity is the recipient for each site in the register. Public hospitals owned by a county or a hospital district may also be covered by the ADA Title II web rule, which has its own dates; see our ADA Title II deadline guide and the Section 508 vs Title II vs WCAG explainer.
What this means for the long tail: a vendor-built service-line site is still the provider's content. PDFs matter too, especially patient forms, financial assistance policies and price lists. A platform cannot make content conform on its own. Templates can be built to help, but alt text, heading order, link wording, colour contrast and every uploaded document need checking by your own team or an auditor. Our accessibility checklist is a practical starting point.
How the sites map onto We.Inc
We.Inc is a white-label site platform. The system runs one brand account under its own name, and each facility, service line, foundation or programme gets its own client account and site inside it.
*The client manager in the brand console (demo brand). In a health system, each row would be a facility, a service line or a programme, tagged by region or entity.*
Different switches for different owners
Every site has its own switches: whether it can publish, connect its own domain, see the code, run a blog, take form submissions and change SEO settings. A rural clinic's page can have forms switched off entirely. The foundation can have forms and a blog. A residency programme might get a blog but no custom domain.
*Per-site switches, including "Publishing needs my approval". Forms can be switched off for any site that has no reason to collect anything.*
Single-step approval before a site goes live
System marketing can require approval before a site goes live, as the default for every site or for selected ones. Requests wait in a queue where an admin can approve and publish, or ask for changes. It is a single approval step by the brand account, not a multi-stage clinical or legal review chain, so if your process needs compliance and legal sign-off as separate steps, those happen before the request is approved.
*The approval queue. The request in this demo screen was staged for the screenshot.*
A record of who changed what
The audit log records organisation actions, such as changes to a client's settings, so you can answer "who switched forms back on for this clinic?" without asking around.
*The audit log in the brand console. In this demo it shows two edits made to a client's settings.*
Domains that match the signage
Each site can sit on its own domain or on a subdomain of the system domain. Acquired hospitals can keep a familiar address during the transition and move later, and the system decides per site whether its editors may connect a domain at all.
*Connecting a domain from inside a site's editor.*
Editing for people who are not web staff
Practice managers and service-line coordinators can describe a change in plain English and the AI makes it, or click a heading or button and change it directly. Every change they make still goes through approval if the site requires it.
*The visual editor. Content changes still need your own accessibility check before publishing.*
Code you keep
Each site's code can be downloaded as a ZIP or synced to GitHub. If a facility is sold, or the system changes platform, the site leaves with its code rather than being rebuilt. The contract side of that is in our vendor exit plan guide.
*The code panel, with the full source of the site and a download button.*
What We.Inc is not, for a health system
- It is not a patient portal, scheduling system, provider directory database or price transparency tool. Link to those.
- It does not come with a business associate agreement, security certifications, accessibility conformance claims, uptime commitments or data-region guarantees. If your vendor review needs written answers on any of these, ask us and we will tell you plainly what we can and cannot provide.
- It is usually not the system's main website if that site is deeply tied to an enterprise CMS and a physician database. The honest fit is the long tail around it.
A 90-day pilot that tells you something
- Weeks 1-2: fill in the register above for one region. Mark every form and tracking script.
- Weeks 3-6: move three sites with different owners: one acquired clinic, one service line, the foundation. Forms off by default, approval on for all three.
- Weeks 7-10: run your own accessibility review on the three sites and fix what it finds. Note how long it took.
- Weeks 11-12: retire the old versions, set redirects, and update the register's review dates.
If that goes well, the same pattern covers the rest. Our governance policy template has wording for owners, review cycles and retiring sites. Book a demo and bring your register.
Sources
Last checked 2026-10-25.
- U.S. Department of Health and Human Services, Office for Civil Rights, Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Content and Mobile Applications of Recipients of Departmental Financial Assistance, interim final rule, Federal Register, May 11, 2026 (91 FR 25496).
- U.S. Department of Health and Human Services, Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
This page is general information, not legal advice. Confirm your obligations with your counsel and privacy office.
Book a demo. Pricing is tailored to your volume and setup, and you get your exact price on the call. 0% transaction fee.
Frequently asked questions
When do hospitals have to meet the HHS Section 504 web accessibility rule?
After the May 2026 interim final rule, recipients of HHS federal financial assistance with 15 or more employees must comply by May 11, 2027, and those with fewer than 15 employees by May 10, 2028. The standard is WCAG 2.1 Level AA.
Can we collect patient information through these sites?
No. We.Inc is for public marketing and information sites. We do not offer a business associate agreement. Link appointment, intake and portal tasks to your existing clinical systems and keep forms to contact details only.
Can system marketing approve changes before a facility site goes live?
Yes. Approval before publishing can be the default for every site or set per site. It is a single approval step by the brand account; any separate legal or compliance review happens before that approval.
Can an acquired hospital keep its own domain?
Yes. Each site can use its own custom domain or a subdomain of the system domain, and the system decides per site whether its editors may connect a domain.
Does We.Inc make our sites accessible?
No platform does that by itself. Templates can be built to help, but your team or an auditor must test each site and every uploaded document against WCAG 2.1 AA.
Keep reading
- White label website builder: the We.Inc platform
- Website governance policy template
- Website accessibility checklist
- Website vendor exit plan: contract clauses
- Website platform procurement checklist
More in White Label
- Property websites for a hotel portfolio that keeps changing
- How to start a website reselling business
- A HubSpot CMS alternative for agencies whose clients are not on HubSpot
- A website for every member agency, without becoming their web designer
- Attorney advertising rules apply to every page. Review has to scale with the sites.
- Your ad reps already sit with every business in town. Sell them a website.
- Your marketing tool is only as good as the website it points to
- Your listed businesses need websites. You already know who they are.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label pricing is tailored to your volume and setup: book a 30-minute demo for a quote.
Product
- AI Website Builder: Describe a site in plain English; it's live in minutes
- White Label Platform: Your brand, your domain, your margin
- Enterprise: SSO, custom SLAs, and dedicated support
- Developer API: Embed site generation into your SaaS
Who It's For
- For Agencies: Resell under your brand
- For Freelancers: Your own branded builder
- For Hosting Providers: Add a builder to your stack
- For SaaS Platforms: Embed site creation via API
- For Startups
- For Financial Services
- For Healthcare
Features
- Drag & Drop Editor
- Built-in SEO Tools
- Custom Branding
- Client Dashboard
- Reseller Billing (Stripe Connect)
Resources
- Blog
- Help Center
- Free Business Tools
- Free UI Components
- Website Templates
- Template Collections
- Website Examples
- Guides
- Comparisons
- Alternatives
- Best Lists
- Reviews
- Pricing Guides
- Use Cases
- Glossary & Guides
- Integrations
- Developers
- Benchmark
- Windows App