Is Your Clinic Website AHPRA Compliant? How to Check Before Someone Else Does

Most clinics think of compliance as something that happens at accreditation time. But there is one document that is breaching the rules far more often than the manual ever does, and it is public, indexed by Google, and visible to every patient, competitor, and regulator who cares to look: your website.

AHPRA's advertising guidelines apply to everything that promotes a regulated health service, and a clinic website is advertising from the homepage to the footer. This is a plain-English guide to auditing your own site for the breaches that catch clinics out. It is general information, not legal advice. The AHPRA advertising guidelines are the source of truth.

Key takeaways

• A clinic website is advertising from the homepage to the footer, so AHPRA's advertising guidelines apply to service pages, blog posts, image captions, landing pages, and the Google Business Profile and social pages too.
• Testimonials that recommend the clinical aspects of care are not permitted under the National Law, though feedback about reception staff, parking, or how clearly something was explained generally is not a testimonial.
• Before and after photos are high risk because a result presented as typical can create an unreasonable expectation of benefit, and cosmetic procedures carry additional restrictions beyond the general rules.
• The most common breaches are clinical testimonials, outcome or benefit claims, unsubstantiated superlatives, misleading statements, inducements without clear terms, and fear based copy, and they tend to hide in footers, captions and old blog posts.
• This is general information, not legal advice; the AHPRA advertising guidelines are the source of truth, and LUNA Systems offers a free website compliance check against them.

Why the website is the high-risk document

A manual sits in a folder and gets read by your team and a surveyor. A website is read by everyone, all the time, and it stays up unchanged for years. That combination, high visibility plus low maintenance, is exactly why it drifts into breach. A page written when the rules were looser, a testimonial added by a well-meaning staff member, a "best in Brisbane" line that felt harmless: each one sits there quietly until someone notices.

And people do notice. Complaints to AHPRA about advertising often come from competitors, not patients. Your website is the easiest place for someone to find a breach and report it.

The breaches to check for

Walk your own site, page by page, and look for these:

• Testimonials about clinical care. Under the National Law you cannot use testimonials that recommend the clinical aspects of a regulated health service. A patient quote saying a treatment worked is a testimonial. Reviews embedded on your site, patient "success stories", and case studies that describe an outcome all fall in scope.
• Outcome and benefit claims. Anything that creates an unreasonable expectation of benefit, or implies a result you cannot reliably deliver for everyone, is a problem. "Patients leave pain-free" is a claim. So is a before-and-after framed as a typical result.
• Superlatives and comparisons. "Best", "leading", "number one", "safest", and comparisons to other practitioners are classic traps when they cannot be substantiated.
• Misleading or false statements. Claims about qualifications, success rates, or technology that cannot be backed up.
• Inducements without terms. Offers, discounts, or gifts that do not clearly state their terms and conditions.
• Using fear. Copy that pressures someone into a service by playing on fear of a health consequence.

For specific specialties the rules are tighter again. Cosmetic clinics, in particular, have their own additional advertising restrictions that go well beyond the general guidelines.

Before-and-after images: high-risk by default

Before-and-after photos deserve their own warning, because they are common on clinic sites and they concentrate several breach types at once. A before-and-after implies a result. Presented as a typical outcome, it can create exactly the unreasonable expectation of benefit the guidelines prohibit, since most patients will not get the best-case result on display. Used without genuine, specific, marketing-purpose consent, it is also a patient-image problem before it is an advertising one.

For cosmetic procedures the restrictions are tighter again, and they change, so a gallery that was acceptable when it went up may not be now. If before-and-after images appear anywhere on your site, they need current, withdrawable patient consent for that specific use, honest framing about what is and is not typical, and a check against the specialty-specific rules that apply to your procedures. This is one of the clearest cases where guessing is the wrong move and a proper review earns its keep.

The nuance most people get wrong

Not every patient comment is a testimonial. AHPRA draws the line at the clinical aspects of care. Feedback about your reception staff, how easy the parking was, or how clearly something was explained is not a testimonial under the National Law and may be used. "The team were lovely and the clinic was easy to find" is fine. "The treatment fixed my condition" is not.

The hard part is that on a Google Business Profile you do not write the reviews, your patients do, and because the profile is advertising you control, you carry responsibility for managing reviews and reputation under the healthcare safeguards. That is a genuine grey area worth getting help with rather than guessing.

How to actually audit it

1. List every public page, including your Google Business Profile and social pages, not just the website.
2. Read each one as a regulator would, hunting specifically for the six breach types above.
3. Check the corners, footers, image captions, alt text, old blog posts, and landing pages you forgot existed. Breaches hide in the pages nobody maintains.
4. Fix and document. Remove or rewrite the offending copy and note what you changed and when, so you can show the site has been actively managed.

A page-by-page checklist

The six breach types are easier to catch when you know where each one tends to hide. Here is where to look, page by page:

• Homepage. Superlatives and comparisons live here first, "best", "leading", "number one", and the tagline that felt harmless. This is also where a bold benefit claim tends to sit above the fold. Read the hero copy hardest.
• Service and procedure pages. Outcome and benefit claims, and any before-and-after imagery. Check that nothing implies a result you cannot deliver for everyone, and that risks are not glossed over to make a procedure sound simpler than it is.
• About and team pages. Claims about qualifications, experience, and expertise that need to be accurate and substantiated. "Specialist" and protected titles matter here; so does any claim to be the only or the first to do something.
• Testimonials, reviews, and case studies. Anything that recommends the clinical aspects of care. Embedded review widgets, patient success stories, and outcome-based case studies are the highest-risk items on most sites.
• Blog and resources. Old posts written under looser habits, benefit claims in passing, and image captions no one has reread in years. The blog is where breaches quietly age.
• Offers and landing pages. Inducements without clear terms and conditions, discounts, gifts, and campaign pages that were built fast and never revisited.
• Google Business Profile and social. Reviews you did not write but are responsible for as advertising you control, plus posts, captions, and pinned offers. The profile is advertising even though it does not live on your domain.
• Footer, captions, and alt text. The corners a manual read skips: a "trusted number one" strip in the footer, an alt-text description that makes an outcome claim, a caption under a photo. Breaches survive longest where no one looks.

Working the site this way, one page type at a time, turns "audit the website" from a vague job into a list you can actually finish.

Where LUNA fits

Doing this by hand across a whole site is tedious and easy to get wrong, which is why we built a free website compliance check: it scans your live clinic site against the AHPRA advertising rules and gives you a plain-English report of what to change, before a complaint or a competitor finds it first. It is the one part of our practice compliance work with its own quick form, because it is free and we want you to have something useful before we ever speak.

The honest framing on what we do: we audit your site, flag the wording that puts you at risk, and tell you how to fix it. Whether a regulator agrees in any specific case is never something anyone can guarantee, so we are careful about that. What we can do is take the obvious breaches off your site so you are not the easy target. If you have not read your own website with the advertising rules in mind recently, that is the place to start, and the check will do most of the looking for you. Fixing the wording is exactly what our AHPRA-compliant marketing service is built for, and it sits within our wider healthcare work if you want the whole practice reviewed.