Website Hosting for Dental Practices

Hosting is the part of your website nobody sees until it breaks. A slow or unavailable site loses patients who were ready to call, and a poorly secured one can put patient information at risk. This guide explains the options and the questions worth asking before you sign.

TL;DR

• Shared hosting is cheap, but it often means slow pages and less reliable service.
• Managed hosting, where the provider handles updates, backups and security, suits most dental practices.
• Check uptime, backups, HTTPS, speed and support, and ask what happens if the host fails.
• Make sure your practice owns the domain and holds the logins.
• If patient information sits on the host, ask for a BAA.

The main types of hosting

Shared hosting

Many websites share one server. It is the cheapest option, and one busy neighbor can slow your site. It can work for a simple brochure site, but it is a weak base for a practice that depends on its website for new patients.

Virtual private server (VPS)

You get a reserved slice of a server. It performs better than shared hosting but needs someone technical to set it up and keep it updated.

Managed hosting

The host looks after updates, security patches, backups and performance for your site, often with caching and a content delivery network built in. For most dental practices, this is the right trade-off between cost and effort.

Dedicated server

A whole server for one site. It is rarely needed for a single practice and requires technical management.

Website-builder platforms

If your site is on a hosted builder, hosting is part of the package. You trade control for convenience, so check whether you can export your content and keep your domain if you leave.

Prices vary a great deal between providers and change often, so compare current quotes in writing rather than relying on a general range.

What to check

Uptime

A 99.9% uptime promise allows about 8.8 hours of downtime a year, and 99.99% allows about 53 minutes. Ask how uptime is measured, whether you get a credit when it is missed, and whether the host monitors the site and tells you when it is down.

Speed

Hosting is one factor in Google's Core Web Vitals, along with your images and scripts. Ask about caching, a content delivery network and server location relative to your patients. Then test the result; see our guide to dental website speed optimization.

HTTPS and security

Chrome marks plain HTTP pages as not secure, and anything patients type into a form should travel over an encrypted connection. Ask about:

• A certificate that renews automatically.
• A firewall and malware scanning.
• Automatic updates for the software your site runs on.
• Two-factor sign-in for admin accounts.

Backups

Daily backups, kept away from the web server, with a simple way to restore, are a reasonable minimum. Ask how long backups are kept and how long a restore takes. Test a restore at least once.

Support

Find out when support is available, how fast they respond to an outage and whether you reach a person who understands your setup.

HIPAA and your web host

HHS guidance on HIPAA and cloud computing says a cloud provider that creates, receives, maintains or transmits protected health information for a covered entity is a business associate, even if it only stores encrypted data and can't read it. For a dental website, ask yourself where patient information goes:

• Contact and appointment forms: does the submission email or database sit on the host?
• Chat or booking tools: who stores the conversation?
• Backups: do they contain stored form entries?

If the answer is yes, you need a business associate agreement with the host or the form tool. The simplest approach is to keep clinical details out of web forms, and to use a form or booking tool that signs a BAA for anything that needs them.

Own your assets

• The practice should be the registrant of the domain, with your own email on the account.
• Keep the hosting account and the DNS settings in your name, or have written confirmation of how to get them.
• Keep a copy of the site's content, images and login details in a safe place.
• Put renewal dates in a calendar. An expired domain takes the site and your email address offline.

Questions to ask a host or web vendor

1. Where is the site hosted, and who has admin access?
2. What is the uptime guarantee, and what do I get if it's missed?
3. How often are backups made, where are they kept and how fast can you restore?
4. Will you sign a BAA if patient information is stored on the site?
5. Who owns the domain and the hosting account?
6. What happens to my site, my content and my domain if I leave?

Frequently asked questions

What is the best type of hosting for a dental practice website?

For most practices, managed hosting from a provider that handles updates, backups and security is the best balance. Shared hosting is cheapest but can be slow and less reliable, and a dedicated server is rarely needed for a single-location practice.

What does 99.9% uptime actually mean?

It allows about 8.8 hours of downtime a year. 99.99% allows about 53 minutes. Ask whether the host credits you if it misses its guarantee, and how it measures uptime.

Do I need a BAA with my web host?

It depends on what is stored. HHS guidance on cloud computing says a provider that creates, receives, maintains or transmits protected health information for a covered entity is a business associate, even if it can't view the data. If form submissions or databases with patient information live on the host, ask for a BAA. Better still, keep patient information out of your website database.

Is HTTPS required for a dental website?

Treat it as required. Chrome marks pages served over plain HTTP as not secure, and a secure connection protects any form patients fill in. Most hosts include a free certificate.

Who should own my domain name?

Your practice should be the registrant of the domain, with your own login. If an agency or vendor owns it, moving the site later can be difficult.

How often should a dental website be backed up?

Daily backups, stored somewhere other than the web server, are a reasonable minimum. Ask how long backups are kept and how quickly you can restore.

Related: see how Aron handles dental websites.