Online booking works on a clinic website when the booking system is connected to your real practice calendar, the button is easy to find and use on a phone, patients can choose the right practitioner and appointment type without guessing, and the whole flow is accessible. Around that, Australian clinics have two sets of rules to keep in mind: the Privacy Act, which treats health information as sensitive, and the advertising rules for registered health practitioners under the National Law, which AHPRA administers.
This article explains what the rules are about, not how they apply to your practice. It isn’t legal advice. Check AHPRA’s own advertising guidance, the OAIC’s guidance for health service providers, and your professional association or an adviser.
Embed a booking tool, or build your own?
For almost every clinic, the answer is to use the booking feature of a practice management or booking platform rather than building something custom. Tools such as Cliniko and HotDoc are common examples in Australia, and many practice management systems include online booking. Features differ between products and plans and change over time, so confirm what your system offers today.
The real decision is how the booking appears on your website:
- A link out to the booking page. Simple and reliable, but patients leave your site and may be confused by a different design.
- An embedded widget. Keeps patients on your site. Check it works well on mobile and doesn’t slow the page down too much.
- A custom front end using the platform’s API, where one is available. Gives the most control, but adds cost and maintenance, and is rarely needed for a small clinic.
Whatever you choose, avoid keeping a second calendar. Double bookings happen when the website and the front desk are working from different sources.
Why do patients abandon online booking?
Booking flows tend to lose people at the same few points. Walk through your own as a new patient on a phone and note where you hesitate.
- The button is hard to find. Put “Book online” in the header of every page, not just the contact page.
- Appointment types are confusing. “Initial consult”, “standard”, “long” and “review” mean a lot to staff and very little to patients. Add a short description and the duration to each.
- It’s unclear which practitioner to choose. Link each practitioner to a short profile explaining what they see people for.
- There’s no availability that suits. Say what to do instead, such as call, join a waitlist, or try another location.
- Fees are a surprise. Be clear about fees, gap payments, deposits and cancellation policies before the final step.
- Forms ask for too much too early. Collect only what you need to book, and leave detailed health history for a secure intake form or the appointment itself.
Is your booking flow accessible?
Clinic patients include older people, people with disabilities and people who are unwell or in pain at the time they’re booking. An accessible booking flow is simply a better one. Check that it can be completed with a keyboard alone, that form fields have proper labels, that error messages explain what went wrong, that text has enough contrast, and that time limits don’t cut people off mid-booking.
Embedded widgets are a common weak point, because they come from a third party and you can’t always change them. Test them anyway, and raise problems with the provider. Our WCAG 2.2 guide for small business covers what to check, and the Disability Discrimination Act applies to websites as well as premises.
What does the Privacy Act mean for clinic websites?
Health service providers are generally covered by the Privacy Act regardless of their turnover, so the small business exemption that some businesses rely on usually doesn’t help clinics. Health information is sensitive information under the Act, which means stricter rules about collecting, using and disclosing it, and usually a need for consent.
On the website, that translates into some practical checks:
- Don’t ask for health details on a general contact form, and don’t have them emailed to a shared inbox.
- Use your practice management system’s secure intake forms for health history where possible, rather than a generic website form.
- Make sure analytics and advertising tags aren’t recording which conditions or services a person looked at or booked, especially on booking confirmation pages.
- Put a clear collection notice on every form and keep your privacy policy current.
- Make sure staff and contractors only have the access they need.
Our article on the Privacy Act and your website forms goes into collection notices, storage and retention in more detail.
What are the AHPRA advertising rules for websites?
If your practitioners are registered under the National Law, advertising for a regulated health service, including your website, must follow the advertising rules that AHPRA and the National Boards publish. In broad terms, advertising must not be false, misleading or deceptive, must not use testimonials about clinical aspects of care, must not create unreasonable expectations of beneficial treatment, and must not encourage unnecessary use of health services.
For websites, the common trouble spots are:
- Patient reviews or quotes about treatment outcomes displayed on your pages, including embedded review widgets.
- Claims about results, such as “pain-free”, “guaranteed” or “permanent”.
- Before-and-after photos, which carry particular restrictions in some areas of practice.
- Titles and qualifications that could mislead patients about a practitioner’s registration or specialty.
- Offers and discounts without clear terms.
The rules are detailed, have specific guidance for some professions and procedures, and are updated from time to time. Check AHPRA’s guidance directly, and if a practitioner isn’t registered under the National Law, check which rules apply instead.
A quick checklist for your clinic website
- “Book online” is visible on every page and works on a phone.
- Bookings go straight into the practice calendar, with no second diary.
- Each appointment type has a plain description, duration and fee information.
- The booking flow passes basic keyboard and screen reader checks.
- No health details are collected on general forms or sent by email.
- Tracking tags don’t record sensitive health information.
- Website content has been reviewed against AHPRA’s advertising guidance.
If you only do three things
Connect the website to your real booking system and make the button impossible to miss, keep health information out of general forms and email, and review your pages against AHPRA’s advertising guidance. Our healthcare and wellness page covers more of the work we do for clinics.
Connecting a booking platform cleanly, or fixing a flow that loses patients, is a defined job in our API integrations work, and our accessibility service can audit and fix the booking flow itself. From $600. Most integrations land between $600 and $3,500.
