The launch checklist for a senior living or long-term care website

Updated 2026-10-16 · 7 minute read

How to use this checklist

Print it, give each section an owner, and do not launch until every line has a name and a date next to it. The owner for content is usually the administrator or executive director. Notices belong to the compliance officer. Photos belong to whoever runs marketing, with compliance signing off on consent. The technical items belong to your web team or vendor, but you should be able to check every one yourself.

Where a line is about a law or regulation, it says what the rule says and links to it. That is not legal advice. Confirm with your compliance officer or counsel how each rule applies to your organization.

1. Content families actually need

Start with the questions your admissions or intake team answers ten times a week. If the site answers them, the calls you do get are better calls.

• Levels of care you actually provide, each on its own page, in plain words. If you do not offer memory care, do not imply it.
• Who pays: Medicare, Medicaid, VA and private pay, explained accurately, with the year next to every dollar amount.
• How to schedule a tour or start care, with a phone number a person answers and the hours they answer it.
• Address, map, parking and visiting information on the contact page.
• Real staff names and roles for the leadership team, kept current. A former administrator's photo on the About page is a common and avoidable embarrassment.
• A careers page with pay, shifts and a short apply step.
• For home health and hospice: service area by county, eligibility in plain words, a referral page and a 24/7 number.
• No claims you cannot prove. Ratings, awards and "best in" language need a source and a date.

2. Photos and consent

Real photos of your building, staff and daily life beat stock photography every time. They also carry real obligations.

For nursing homes, CMS told state survey agencies in S&C 16-33-NH (August 5, 2016) that photographing a resident or a resident's private space without the written consent of the resident or their designated representative violates the resident's right to privacy. Its examples include a resident eating in the dining room and a resident taking part in an activity in a common area. That is exactly the kind of photo marketing teams want.

If you are a HIPAA covered entity, full face photographs are listed as identifiers in 45 CFR 164.514, and 45 CFR 164.508 generally requires an individual's authorization to use protected health information for marketing. Your compliance officer should decide which form you use.

• Written consent on file for every resident, patient or family member shown, approved by compliance.
• A signed release for every staff member shown, and a process to remove photos when someone asks or leaves.
• No photos that could demean or embarrass anyone, consent or not.
• Descriptive alt text on every meaningful image.
• A consent log that lists each photo, the person in it, the form and the date, so you can answer a question quickly.

3. Required and expected notices

Put a "Notices" or "Privacy and accessibility" link in the footer of every page and collect these there.

• Notice of privacy practices. Under 45 CFR 164.520(c)(3), a HIPAA covered entity that maintains a website about its services must prominently post its notice on the site and make it available electronically.
• Notice of nondiscrimination, where Section 1557 applies. 45 CFR 92.10 requires covered entities to post a notice of nondiscrimination at a conspicuous location on their website, covering nondiscrimination, free auxiliary aids and language assistance, how to request them, the Section 1557 coordinator if applicable, the grievance procedure if applicable, and how to file a complaint with HHS's Office for Civil Rights.
• Notice of availability of language assistance and auxiliary aids. 45 CFR 92.11 requires it on the website as well, in English and at least the 15 languages most commonly spoken by people with limited English proficiency in the relevant state or states.
• Accessibility statement: the standard you aim for, how to report a problem, and a named contact who responds.
• Any state-required postings or links your licensing agency expects, such as inspection reports or the long-term care ombudsman. Check with your state.

Section 1557 applies to health programs and activities that receive federal financial assistance from HHS, among others. Whether and how it applies to your organization is a question for your compliance officer or counsel.

4. Accessibility

Many visitors to a senior living site are older adults or adult children reading on a phone in a hospital hallway. Accessibility is simply good service for them. It may also be a legal requirement. HHS's Section 504 rule requires recipients of HHS financial assistance to meet WCAG 2.1 Level AA for web content, and in May 2026 HHS extended the compliance dates to May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for smaller ones. Publicly owned providers should also review the ADA Title II web rule.

• Build to WCAG 2.1 AA at minimum. WCAG 2.2 adds criteria such as minimum target size and focus not obscured that matter for older users, so it is a sensible target.
• Every page usable with a keyboard alone, with a visible focus outline.
• Text contrast that passes, and body text large enough to read without zooming.
• Captions on videos and real text, not images of text, for menus and calendars.
• PDFs (activity calendars, menus, admission packets) tagged and readable, or replaced with web pages.
• Tested with a screen reader before launch, not just with an automated checker.

5. Local search and structured data

Families search "assisted living near me" or "nursing home in" a town name. Your site and your Google Business Profile have to agree.

• One Google Business Profile per physical location, with the real-world name and no added keywords, per Google's Business Profile guidelines. Service-area agencies hide their address if they do not serve people there.
• The same name, address and phone number on the website, the profile and major directories.
• LocalBusiness structured data on the location page, with at least the required name and address and the recommended telephone, url, geo and openingHoursSpecification, using the most specific type that fits, as Google's local business documentation recommends.
• A page for each location or branch, with town names written the way families search for them.
• A unique title and meta description on every page.
• Search Console verified, with the sitemap submitted, on an account your organization controls.

6. Speed and mobile

Google's Core Web Vitals give clear targets: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift below 0.1. Google says good Core Web Vitals align with what its core ranking systems seek to reward.

• Photos resized and compressed, in modern formats, with width and height set so the page does not jump.
• No autoplaying video with sound, and no pop-ups that cover the content on a phone. Google's page experience guidance asks whether pages avoid intrusive interstitials.
• Phone numbers tappable on mobile, and the tour or referral button reachable with a thumb.
• Tested on a real mid-range phone over cellular data, not just on the office Wi-Fi.

7. Security

None of this is exotic. It is the basic hygiene that keeps a small organization's site from being the easy target.

• HTTPS on every page, with HTTP redirecting to HTTPS. Google's page experience guidance asks whether pages are served securely and points to a Search Console report for checking it.
• Domain registered in your organization's name, with renewal on auto-pay and two people who receive the renewal notices.
• Software, themes and plugins updated on a schedule, with daily backups you have actually tested restoring.
• Strong passwords and two-factor sign-in for every account that can edit the site.
• Form spam protection that does not make older visitors solve puzzles.

8. Analytics without collecting health information

You need to know which pages bring tours and referrals. You do not need, and should not collect, health information in your analytics. Google's own help page says Google makes no representations that Google Analytics satisfies HIPAA requirements, does not offer business associate agreements for it, and that HIPAA-regulated customers must not expose to Google any data that may be considered protected health information. It also says authenticated pages are likely to be HIPAA-covered and should not have Google Analytics tags.

• No analytics or advertising tags on patient portals, family portals or any page behind a login.
• No names, diagnoses, room numbers or form contents sent to analytics, and nothing personal in page URLs.
• Contact, tour and referral forms that do not ask for health details unless the form is built and approved to handle them.
• Advertising pixels reviewed by compliance before they go on any page.
• A short list, kept by compliance, of every third-party script on the site and why it is there.

9. Keep it current after launch

Most care provider websites are accurate on launch day and slowly drift. A simple routine prevents that.

• Monthly: check job postings, events, menus and the leadership page. Remove anything expired.
• Monthly: test every form and the main phone links, and confirm submissions reach a real person.
• Quarterly: review Care Compare data or ratings you mention, and Google Business Profile hours and photos.
• Each year: update Medicare and other dollar amounts when CMS publishes new figures, and re-review notices with compliance.
• Each year: run an accessibility check on new pages and PDFs added during the year.
• Whenever leadership, ownership or services change: update the site the same week.

Checklist

• Every section of this list has a named owner and a date.
• Written consent on file for every person in every photo.
• Notices page linked in the footer of every page.
• Accessibility statement with a real contact.
• HTTPS everywhere and domain in your organization's name.
• Google Business Profile and website show the same name, address and phone.
• No analytics tags on logged-in pages and no health details in analytics.
• Core Web Vitals checked on a real phone.
• A calendar of monthly, quarterly and annual update tasks.

Questions

Sources

1. CMS: S&C 16-33-NH, Protecting resident privacy (photographs and recordings)
2. eCFR: 45 CFR 164.514, De-identification identifiers
3. eCFR: 45 CFR 164.508, Uses and disclosures requiring an authorization
4. eCFR: 45 CFR 164.520, Notice of privacy practices
5. eCFR: 45 CFR 92.10, Notice of nondiscrimination
6. eCFR: 45 CFR 92.11, Notice of availability of language assistance and auxiliary aids
7. Federal Register: HHS extension of compliance dates for Section 504 web and mobile accessibility (May 11, 2026)
8. ADA.gov: Fact sheet on the Title II web and mobile accessibility rule
9. W3C: Web Content Accessibility Guidelines (WCAG) 2.2
10. Google Business Profile: Guidelines for representing your business
11. Google Search Central: Local business structured data
12. Google Search Central: Core Web Vitals
13. Google Search Central: Page experience
14. Google Analytics Help: HIPAA and Google Analytics

This guide is general information, not legal advice. Confirm regulatory and legal questions with your compliance officer or counsel.