Make a free dental practice website, with the patient-privacy limits up front

Can a dental practice put patient information into Onelios?

No. Onelios signs no business associate agreement, the written contract federal HIPAA rules require before a covered dental practice lets a vendor handle patient information. So the quote form, appointment requests, review requests and campaign emails must not be used for health details. Use Onelios for the public side of the practice, and keep patient information elsewhere.

The definitions are in 45 CFR 160.103. A health care provider is a covered entity if it “transmits any health information in electronic form in connection with a transaction covered by this subchapter”, and sending insurance claims electronically is one of those transactions (45 CFR 162.1101). A vendor that “creates, receives, maintains, or transmits protected health information” on behalf of a covered practice, for a function the rules regulate, is its business associate, and 45 CFR 164.502(e) lets the practice share patient information with one only after obtaining “satisfactory assurance”, documented in a written contract or other written agreement. Onelios offers no such contract.

Here is what an Onelios site's forms collect. Everything sent through them is saved in your dashboard and goes into the email alert Onelios attempts to send you: the person's name, their phone or email, any service they picked from your list, the time they asked for on an appointment request, and up to 2,000 characters under “Anything else we should know?”. The form shows no warning about health details, and you cannot change its wording. HIPAA's definition of individually identifiable health information covers information that identifies a person and relates to “the provision of health care” to them, so a name beside “Emergency dentistry” can count, and so can a patient list used for review requests or campaign emails.

If your practice is a covered entity, ask a HIPAA attorney or compliance advisor before you publish, and show them this section; it is general information, not legal advice. Either way, warn visitors before they type: put “Please don't include health details in online requests; call us instead” in the line under your headline, which holds 240 characters and keeps your exact words, and do not send review requests or campaign emails to patients from Onelios.

Does a dental website need a notice of privacy practices?

Yes, if the practice is a HIPAA covered entity. Federal rule 45 CFR 164.520(c)(3)(i) says a covered entity that maintains a website with information about its customer services or benefits must prominently post its notice of privacy practices there and make it available electronically. An Onelios site has no place to post a full notice.

The homepage fields are short: a headline of up to 90 characters and a line under it of up to 240. Service pages are written by the AI from a title and cannot be edited afterward, so a notice would come back rewritten, not word for word. The one outside link you can add sits in the footer, labeled with the linked site's address.

That is a second reason a covered practice needs advice before it publishes an Onelios site, and a fair question to put to any builder you compare: where would our notice go? Whether your practice is a covered entity at all is a question for your advisor, not for a website builder.

What can a general dentist's website say about implants, aligners and specialties?

List what you provide, and say who provides it. The American Dental Association's code of ethics, binding on its members, lets general dentists announce services such as implants or aligners only if nothing expresses or implies specialization, and requires them to state that general dentists provide the services. A national commission recognizes twelve dental specialties.

The twelve, as listed by the National Commission on Recognition of Dental Specialties and Certifying Boards: dental anesthesiology, dental public health, endodontics, oral and maxillofacial pathology, oral and maxillofacial radiology, oral and maxillofacial surgery, oral medicine, orofacial pain, orthodontics and dentofacial orthopedics, pediatric dentistry, periodontics and prosthodontics. Cosmetic dentistry and implant dentistry are not on it. The ADA code says a qualified specialist should announce as a “specialist in” one of these, and that a general dentist may not claim to be certified or a diplomate in an area outside the list unless strict conditions are met, including a statement that the area is not a recognized specialty.

Now apply it to your Onelios site. A dental site starts with six common services, listed further down this page, among them cosmetic dentistry, implants and kids' dentistry. Uncheck any you do not provide before you publish, and name a brand such as Invisalign only if you offer it. “Kids' dentistry” describes a service; “pediatric dentist” names a specialty. The AI writes a line for each service and is instructed not to invent credentials, guarantees or prices, but it can still make mistakes, and when it cannot write them, built-in lines are used. Read every line and change any in the editor, where each holds 220 characters. For the ADA's statement, type something like “General dentistry by Dr. [your name], DDS” into the line under your headline.

Can a dental website show before-and-after photos?

Yes, with the patient's signed authorization and honest labels. HIPAA lists full-face photographs among the identifiers that must be removed to de-identify health information, and a covered practice needs the patient's valid authorization to publish such a photo. California also requires before-and-after photos to name the procedure and say the same results may not occur for all patients.

The federal rules: 45 CFR 164.514(b)(2)(i)(Q) names “full face photographic images and any comparable images”, and 45 CFR 164.508(a)(1) says a covered entity may not use or disclose protected health information without a valid authorization unless the rules permit it another way. A valid authorization includes the patient's signature and the date, among other elements (164.508(c)). Photos of your office, operatories and team raise none of these questions, and they show a new patient the room and the people before the first visit.

California Business and Professions Code section 651 covers dentists and other healing-arts licensees, and the “public communication” it governs includes the Internet. It treats as misleading any image that does not accurately depict the results or has been altered. A photo of a model must say so prominently, and before-and-after views of a real patient must say prominently which procedures were performed, be comparable in poses and lighting, and state that the same results may not occur for all patients. Other states set their own rules, so check with your state dental board.

On Onelios, photos upload from your phone and each can carry a caption of up to 160 characters, enough for “Before and after: two porcelain veneers. The same results may not occur for all patients.” Onelios signs no business associate agreement, so ask your advisor before any patient photo is uploaded.

What can a dental website say about fees, insurance and payment plans?

Exact facts, not teasers. California lets dentists advertise their fees, the insurance or health plans they accept, and that they regularly take installment payments, but requires price ads to be exact, without “as low as” or “and up”. Under federal credit rules, a monthly payment amount in an ad for installment credit brings required terms, including the annual percentage rate.

The California rules are in Business and Professions Code section 651. Subdivision (h) lists what may be advertised, including your fees, the private or public insurance or health care plans you provide services under, and that you regularly accept installment payments. Subdivision (c) says any price advertisement must be exact, with the price for each service clearly identifiable. Subdivision (b) treats as misleading a fee statement, other than a standard consultation fee or a range of fees for specific types of services, that does not fully disclose all variables, and a claim of superiority that cannot be substantiated with objective scientific evidence.

The federal rule is Regulation Z, 12 CFR 1026.24(d): an ad that states a down payment, the number of payments, the amount of any payment or a finance charge must also state the down payment, the full repayment terms and the “annual percentage rate”. The Consumer Financial Protection Bureau's official interpretation says all persons must follow these advertising rules, not only lenders, and names merchants among them. If you work with a financing company, ask it for the full terms before a monthly figure goes on your site.

Onelios's AI is instructed not to write prices you did not give it, but it can make mistakes, so check every figure before you publish. There is no insurance field and no new-patient switch: name the plans you accept, and whether you are taking new patients, in the line under your headline or in a service line. Onelios does no invoicing and takes no payments.

How do appointment requests work for a dental practice?

Once you save your days, hours and one appointment length, people can request a start time in the next two weeks, and you confirm it. Onelios does not read your practice-management schedule or any other calendar, and it holds one request per start time for the whole practice, so two chairs cannot be booked for the same time.

Every service shares that one length, so set it to your usual new-patient visit rather than your longest procedure. There are no text messages and no automatic reminders, and nothing checks a request against your other appointments beyond its start time. Without saved hours, visitors use the quote form, which on every trade, dental included, is headed “Request a quote”.

A verified owner can confirm the time by email when the person left an address; the confirmation names the service, and a reply to it reaches you. Someone who left only a phone number is yours to call. Every request carries a name and contact details linked to your practice, so settle the privacy question above before you save your hours.

Which website builders sign a business associate agreement?

Some do, on paid plans. Wix says HIPAA compliance, with a business associate agreement signed in the site dashboard, is available on its Business, Plus, Elite, Business Elite and Enterprise plans. Squarespace says only its Acuity Scheduling is designed for HIPAA obligations and its form block cannot be part of a compliant setup. Onelios signs none, and is free.

Read on each vendor's own page on September 23, 2026. Wix's help center says activating its PHI protection could disable, restrict or remove some features of a site, and recommends collecting no protected health information until protection is active and the agreement is signed. Squarespace's help center, last updated January 20, 2026, says its agreement does not cover other Squarespace features and that you should not maintain or transmit protected health information outside Acuity. Acuity Scheduling lists signing a business associate agreement under its Premium plan, at $49 a month paid yearly or $61 a month paid monthly.

Both make the same point: an agreement covers only the features it names, so ask any builder which forms, emails and storage it covers. Onelios covers none. What it can carry for a practice is the public side: who you are, what you provide, where you are and how to call you. What is not built is listed at onelios.com/what-it-does, and what it costs is at onelios.com/#pricing.

Sources

• eCFR, 45 CFR 160.103, Definitions (business associate, covered entity, health information, protected health information), read September 23, 2026
• eCFR, 45 CFR 164.502(e), Disclosures to business associates, read September 23, 2026
• eCFR, 45 CFR 162.1101, Health care claims or equivalent encounter information transaction, read September 23, 2026
• eCFR, 45 CFR 164.520, Notice of privacy practices (paragraph (c)(3), electronic notice), read September 23, 2026
• eCFR, 45 CFR 164.508, Uses and disclosures for which an authorization is required, read September 23, 2026
• eCFR, 45 CFR 164.514(b), De-identification identifiers, read September 23, 2026
• American Dental Association, Principles of Ethics and Code of Professional Conduct (advisory opinions revised to March 2023), sections 5.F, 5.H and 5.I, read September 23, 2026
• American Dental Association, Code of Ethics (binding on ADA members), read September 23, 2026
• National Commission on Recognition of Dental Specialties and Certifying Boards, Recognized dental specialties, read September 23, 2026
• California Business and Professions Code section 651, read September 23, 2026
• eCFR, 12 CFR 1026.24, Advertising (Regulation Z, closed-end credit), read September 23, 2026
• eCFR, 12 CFR part 1026, Supplement I (official interpretations), comment 2(a)(2)-2, Persons covered, read September 23, 2026
• Wix Help Center, HIPAA Compliance for Your Wix Site, read September 23, 2026
• Squarespace Help Center, Acuity Scheduling and HIPAA (last updated January 20, 2026), read September 23, 2026
• Acuity Scheduling, Pricing, read September 23, 2026