Claude Code for healthcare practice websites: safe jobs, health claims and patient data

A healthcare practice can use Claude Code for much of the technical work on its website: page templates, service and location pages, structured data, accessibility fixes, speed, redirects and the forms that bring in new patients. It edits the site's files, runs checks and shows every change before anything ships. Two things it should not be left to handle alone are the health claims on the pages and anything that touches patient information.

Those two areas are where the rules sit. Health claims are advertising, and the FTC expects them to be backed by evidence. Patient information brings in HIPAA if your practice is a covered entity. This guide reflects rules and product terms as of October 2026 and is not legal advice. Your compliance officer or healthcare attorney should confirm how they apply to your practice.

Jobs that suit Claude Code on a practice website

Claude Code is strongest at the same change across many pages, with a check that proves it worked. Our list of what Claude Code can do for a business website covers the general jobs. On a practice site, they sort like this:

Accessibility deserves a note. Automated checks can't confirm everything a screen reader or keyboard user experiences, so pair Claude Code's fixes with manual testing. Our guide to finding and fixing accessibility issues with Claude Code covers what automated checks miss.

Health claims need evidence and a clinician's sign-off

The FTC's Health Products Compliance Guidance states the general rule plainly: "claims about the health benefits or safety of foods, dietary supplements, drugs, and other health-related products require substantiation in the form of competent and reliable scientific evidence." It is staff guidance, and the FTC notes it "doesn't have the force or effect of law," but it explains how the agency reads advertising. It also says advertisers should assess the "net impression" an ad conveys as a whole, not just individual phrases.

That matters for AI-drafted copy. A model asked to make a service page "more compelling" can add outcome language, timelines or comparisons that no one at the practice would sign. Give Claude Code your rules, ask it to flag claims, and have a clinician approve every page that describes a treatment, a condition or a result.

Anthropic's own rules point the same way. Its Usage Policy version effective September 15, 2025, in force until November 12, 2026, prohibits using Claude to "Provide false or misleading information related to medical, health or science issues" and treats healthcare uses such as "medical diagnosis, patient care" and "other medical guidance" as high-risk, needing a qualified professional's review and disclosure that AI was used. The updated policy, which takes effect on November 12, 2026, keeps those requirements and names diagnosing a condition or "interpreting an individual's symptoms or test results to triage" as high-risk. It excludes "General information or educational content, including explaining ... how a condition or treatment works ... without applying it to the individual's circumstances." A page explaining what a procedure involves is general information. A symptom checker that tells a visitor what they have is not.

Google adds a search angle. Its guidance on generative AI content says "It is critical to manually factcheck and review all AI-generated content for accuracy and trustworthiness before publishing," including titles, meta descriptions, structured data and image alt text. Our article on AI-generated versus human-edited content covers that editing step.

Keep patient information out of the project

The simplest rule for a practice site is that patient information never enters a Claude Code session. Website work rarely needs it. Practical steps:

• Don't paste patient stories, messages or appointment details into prompts. Use published content or clearly fictional placeholders.
• Don't keep form exports, scheduling exports or database copies with patient data in the website repository.
• Add deny rules so Claude's file tools can't read .env files or export folders, and turn on the sandbox for operating-system enforcement of shell commands.
• Never put passwords or API keys in prompts or CLAUDE.md.
• Test forms on a staging copy with fictional data.

Choose the plan with this in mind. Pro and Max are consumer plans, and Anthropic trains on their data when the user's training setting is on. Team and Enterprise fall under commercial terms, where Anthropic says it does not train models on code or prompts sent to Claude Code unless the customer opts in.

HIPAA and Anthropic's BAA, briefly

If your practice is a HIPAA covered entity and Claude Code would ever handle protected health information (PHI), you need a business associate agreement (BAA) that covers it. According to Anthropic's legal and compliance page, a BAA with Anthropic extends to Claude Code in two configurations: the HIPAA configuration (the CLI or the desktop app's Code tab on a Claude for Enterprise account with HIPAA enabled) or Zero Data Retention. Under the HIPAA configuration, "cloud sessions, Remote Control, Claude Code in the Claude mobile app, and Claude Code routed through a third-party cloud provider or a gateway aren't covered."

Anthropic's support article on BAAs adds detail as of October 2026. The terminal is covered only when members sign in with their Enterprise account and connect directly to Anthropic. The VS Code and JetBrains extensions, connectors and local MCP servers are not covered, and Claude Code on the web and routines aren't available under the configuration. A standard Enterprise plan has no BAA coverage until a Primary Owner accepts the BAA and applies the configuration. Anthropic's rule is to process PHI only with a feature marked covered.

The same logic applies to your website vendors. HHS's page on business associates lists a cloud service provider that creates, receives, maintains or transmits electronic PHI as an example, and says entities that access PHI "on a regular or frequent basis to perform a service on behalf of a covered entity are not conduits." Form processors, hosting with patient data and portal vendors need review by your privacy lead. Our HIPAA considerations for healthcare websites article goes deeper on BAAs, configuration and what each plan covers.

Tracking pixels, analytics and booking

Analytics and ad tags are where website changes meet patient data. HHS's bulletin on online tracking technologies says tracking on "user-authenticated webpages generally have access to PHI," giving "a patient or health plan beneficiary portal or a telehealth platform" as examples, and that tracking vendors that receive PHI on a covered entity's behalf are business associates needing a BAA.

The bulletin also carries a notice: on June 20, 2024, a federal court in Texas vacated the guidance "to the extent it provides that HIPAA obligations are triggered in" circumstances where tracking connects an individual's IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS says it "is evaluating its next steps." This area has moved, so have your compliance lead read the current page before you add or change tags.

When Claude Code sets up events, keep them minimal: record that a booking or form was submitted, not what was typed, and keep tags off portal and telehealth pages unless your privacy lead approves them. Our guide to setting up GA4 events with Claude Code covers the technical setup.

Reviews and testimonials

The FTC's final rule on fake reviews, announced August 14, 2024, covers reviews and testimonials "by someone who does not exist, such as AI-generated fake reviews," or by someone without actual experience of the business. It also requires insider reviews to disclose the reviewer's connection to the business. Publish only real reviews you can document. Patient testimonials can also raise privacy questions, so let your compliance lead decide what you may publish.

A CLAUDE.md and workflow for a practice site

CLAUDE.md holds standing instructions that Claude Code loads each session. Anthropic says Claude treats it "as context, not enforced configuration," so it guides rather than guarantees. A short excerpt:

## Content rules (practice site)
- Never add claims about outcomes, cure rates, timelines or comparisons with other providers. Flag any you find.
- Never invent reviews, testimonials, patient stories or credentials.
- Facts (locations, hours, providers, insurance) come only from facts.md.
- Don't add or change analytics or ad tags without a ticket approved by the privacy lead.
- Mark every page with changed medical wording "NEEDS CLINICIAN REVIEW" in the pull request.

Then run each change through the same steps:

1. Work on a staging copy in git, on a branch, on a business plan.
2. Start in plan mode, where Claude proposes changes without editing files, and approve the plan.
3. Run the checks: build, links, structured data, accessibility, and a look in a real browser.
4. Route the diff: medical wording to a clinician, tracking and forms to the privacy lead, everything else to the developer.
5. A person deploys after approval and records who approved what.

Our guide to running Claude Code safely on a production website covers permission settings that back up these rules.

When not to use Claude Code on a practice site

Don't use it where patient data is in play without a covered configuration and your compliance lead's sign-off. Don't use it to build symptom checkers or triage tools, to write reviews, or to publish straight to a live site. And if no clinician has time to review service pages, the drafting speed won't help: the review is the bottleneck.

Conclusion

Claude Code can take on the repetitive engineering of a practice website, with checks, in git, on a copy. The rules that matter most are not technical: health claims need evidence and a clinician's approval, patient information stays out of the project, and tracking changes go through your privacy lead. Set those rules down first, then let Claude Code do the work around them. If you want help, our Claude Code development team builds and maintains sites this way, with a person approving every deploy. Law firms face a similar split, covered in Claude Code for law firm websites. More guides are in our Claude Code Guide.

Frequently asked questions