Built Your Practice Website With AI? A Reality Check

If you built your practice website with ChatGPT or Claude, you have every reason to be proud of it. A few years ago a good looking website meant hiring a designer and waiting weeks. Now it can take a weekend. That is real progress, and nothing in this article is meant to talk you out of it.

This is a reality check, not a scare piece. Building the website was the easy part, and AI made the easy part easier. Everything that comes after launch is still yours: hosting it, securing it, protecting patient information, staying inside the rules for healthcare advertising, and getting new patients to actually find it. In most industries, a shortcut costs you time. In healthcare, shortcuts carry risks to your patients, your license and your practice.

Below is what the demo leaves out, why AI is the wrong judge of its own work, and where the real value is now: experts using AI to solve problems at scale, measured by outcomes.

The weekend website is real. So is everything after it.

When you ask an AI tool for a website, it shows you the parts that are easy to see: the design, the pages, the words. What it does not show you is the list of jobs that starts the day the site goes live. Every one of them has your name on it.

None of this is new. Agencies and web developers have always owned that right column, or were supposed to. What is new is how fast you can reach the starting line, and how easy it is to believe you have already crossed the finish.

AI is trained to agree with you

This is the part most people miss, and it matters more than any design choice.

AI chat tools learn partly from people rating their answers. People tend to rate answers that agree with them more highly. Researchers who studied five AI assistants found exactly that: when an answer matched what the person already believed, people were more likely to prefer it, and sometimes preferred a convincing agreeable answer over a correct one. The tools learn what gets rewarded.

This is not a theory. In April 2025, OpenAI rolled back an update to ChatGPT that it described as "overly flattering or agreeable." The company said the update "focused too much on short-term feedback," and that the model "skewed towards responses that were overly supportive but disingenuous."

A study published in Science in 2026, led by Stanford researchers, tested 11 leading AI models and found they affirmed users' actions 49% more often than other people did, even when users described deception or harm. People who got the flattering answers rated them as higher quality and wanted to come back for more. The feature that makes the advice worse is the same one that makes it feel good.

Ask an AI tool whether your website is good, and it will probably say yes. That reflects how it was trained, not a judgment about your website. Here is what that looks like for a practice.

"Say we're the best implant dentist in town"

It will write it, confidently. It probably won't mention that dental and medical boards regulate advertising claims, or that the ADA's code of ethics asks general dentists who offer services like implants or orthodontics to avoid implying they are specialists. A claim you can't prove is a claim you may have to defend, and the AI won't be there when you do.

"Add some patient testimonials"

Many tools will happily write a few, complete with first names and five stars. Since October 2024, the FTC's rule on fake reviews and testimonials has banned fake testimonials, explicitly including ones generated by AI, and lets the FTC seek civil penalties from knowing violators.

Real testimonials carry their own rule in healthcare. A patient's name or face next to their treatment is protected health information, and putting it on your website needs the patient's written HIPAA authorization. HHS investigated a physical therapy practice that posted patient testimonials with full names and full face photos without that authorization. The practice agreed to pay $25,000 and take the patients' information off its website.

"Is my site secure?"

It will look at the code it wrote and tell you it looks good. Of course it does: it wrote it. Asking AI to check its own work is like asking the doctor who wrote the treatment plan to also be the second opinion.

Your prompt is your bias

AI builds what you asked for, not what patients search for. Ask for "a modern site that shows off our technology" and you will get one. Patients don't search for your technology. They search for "emergency dentist open Saturday," "Botox near me" and "how much do implants cost." The strongest practice websites start from where people are already searching and build from there. When what you want to promote matches what patients want, great. When it doesn't, demand should win.

You can push back on the agreement problem. These prompts help:

They help. They don't replace knowing what you're building. The machine doesn't know what you don't know, and it won't stop to ask.

Why shortcuts cost more in healthcare

In most businesses, a rough website costs a sale. In healthcare, the same mistake can expose patient information, mislead a patient about their care, or put a license on the line. That is why healthcare has HIPAA, dental boards and medical boards in the first place.

AI did not change any of those rules. It made it faster to break them without noticing. A tool that writes a full website in an hour also writes a misleading claim, a fake testimonial or an unprotected form in an hour, and tells you it all looks great.

The AI doesn't hold your license. You do.

You still have to host it: the WordPress lesson

Every website lives on a computer somewhere. A website you built with AI is no different. Before it goes live, somebody has to answer these questions:

• Where does it live, and who pays the bill?
• Who renews the domain, and what happens when the card on file expires?
• Who gets the alert when the site goes down on a Saturday night?
• Where do form submissions go: an inbox someone checks every day, or a spam folder?
• Who makes the backups, and has anyone ever tried restoring one?

WordPress shows what happens when a practice website has no clear owner. It runs about 4 in 10 of all websites, according to W3Techs. Patchstack, a WordPress security firm, counted 11,334 new WordPress security weaknesses in 2025, and 91% of them were in plugins, the add-ons sites install for forms, galleries and reviews. And last week, a flaw called PHP2Shell, in the software that runs underneath WordPress, put websites at risk even when every plugin was up to date. We covered it in detail in PHP2Shell: WordPress Security Risks for Practice Websites.

The lesson is not "WordPress is bad." Every website runs on software that someone has to keep patched, for as long as the site is online. With an agency website, that someone is supposed to be the agency. With a website you built yourself, it's you. A site built with AI in a weekend faces the same questions as one built in 2015. It just reaches them faster.

Security matters more now, not less

AI writes code quickly, and on most DIY websites nobody reads that code. That is the gap.

When Veracode tested AI models on 80 coding tasks in 2025, the code had a known type of security flaw in 45% of them. In plain terms: given a safe way and an unsafe way to do something, the AI picked the unsafe way almost half the time, and the code still worked.

The real world looks the same. In 2025, a security researcher checked 1,645 apps built with Lovable, a popular AI app builder, and found 170 whose data could be read by anyone on the internet. What was exposed included names, email addresses, phone numbers and, in some cases, payment details. The apps worked. They looked finished. The data was open.

By the numbers

45%of AI coding tasks produced code with a known security flawSource: Veracode, 2025

170of 1,645 apps from one AI app builder left user data open to anyoneSource: CVE-2025-48757, 2025

For a practice, the gaps that matter most are simple to name:

• Hidden keys left in plain sight. Passwords to other services sitting in the website's code, where anyone can read them.
• Open data. Form submissions stored somewhere anyone on the internet can read.
• Unprotected forms. No spam protection, so bots flood the inbox your front desk depends on.
• Patient details sent by plain email. Easy to set up, and easy to intercept.
• Nobody watching. No alert when the site goes down or something on it changes.

A security problem rarely stays a website problem. If patient information is exposed, HIPAA generally requires telling affected patients within 60 days, and breaches affecting 500 or more people are also reported to HHS. The letters go out under your practice's name, and the phone calls come to your front desk. Google can also flag a hacked website in search results with a "This site may be hacked" warning, right where new patients are looking for you.

For your web person: check access rules on every database table, keep API keys on the server, add bot protection to every form, encrypt submissions at rest, and set up uptime and change alerts.

The liability the chatbot won't mention

Patient information and HIPAA

A form that asks for a reason for the visit, a symptom or insurance details is collecting protected health information the moment a patient fills it in. That information needs to be encrypted, stored somewhere secure and handled only by vendors that sign a Business Associate Agreement (BAA) with your practice. Some website builders offer a BAA only on certain plans or for certain features, and many low cost hosts don't offer one at all. Get the answer in writing before your first form goes live.

Tracking code

When you ask an AI tool to "add the Meta pixel" or "add Google tracking," it will. That code can send what patients do on your website to advertising platforms. HHS warned healthcare providers about this in 2022 and updated its guidance in 2024. In June 2024 a federal court struck down one part of that guidance, covering public pages a visitor simply reads. The rest of the guidance still stands. Pages where patients log in, or type in their own health details, are a different story, and the AI won't know which of your pages is which.

Accessibility

Plaintiffs filed 3,117 website accessibility lawsuits in federal court in 2025, up 27% from the year before, according to the law firm Seyfarth Shaw. An AI tool builds a page that looks right on your screen. Whether a patient using a screen reader can fill out your appointment form is a separate question, and one a person needs to test.

Claims, photos and words

Advertising claims, specialty language, before and after photos and testimonials all have rules, and the rules differ by state and by profession. The AI will write whatever you ask for. Your board will judge what was published.

"I can be the designer, the marketer and still see patients"

This is the objection we hear most, so let's take it head on. You can. Plenty of owners have done all three for years. The question isn't whether you can. It's which of the three only you can do.

Nobody else can treat your patients. Design and marketing can be done by others, and every hour spent adjusting a homepage photo is an hour not spent chairside, with your team or with your family. That trade can be worth it for a launch. It rarely holds up week after week.

More importantly, a website is not marketing. A website nobody finds is a brochure in a drawer. Marketing is everything that brings people to the website and turns them into patients:

• Being found where people already search: Google, Maps, reviews, and now the answers patients get when they ask ChatGPT or Gemini for a dentist or a doctor nearby.
• Answering fast when someone calls or fills out a form, because the next practice on the list is one tap away.
• Knowing what worked: which calls, forms and bookings came from which source.
• Moving money away from what doesn't bring patients in and toward what does.

Watch for one trap. Searches for your own practice name feel like success, but those people already knew you. A website that ranks for your name is doing its basic job. Growth comes from the people who didn't know you yet: the ones searching for a treatment, a problem or "near me."

None of that is a weekend project. It is ongoing work, every week, guided by real numbers. That is where most DIY efforts stall. Not at the design, but at everything after it.

Outputs are cheap now. Outcomes are the work.

AI has made outputs nearly free. Pages, blog posts, ad copy and images: anyone can produce more of them than ever before. But a practice doesn't grow on outputs. It grows on outcomes: a patient who finds you, trusts you, calls and books.

The gap between the two is expertise. Knowing what to build, where patients are actually searching, what the rules allow, what to measure and when the numbers say stop. AI multiplies whatever it is pointed at. Pointed by experts at the right problem, it delivers good decisions at a scale no single person can match. Pointed by a guess, it multiplies the guess, and tells you the guess is brilliant.

That is the honest answer to "why not just use AI?" You should use AI. The question is whether it is working alone, or working for people who know healthcare, know marketing and are accountable for the result.

What comes next: the website is the old part

The website as a set of pages is quickly becoming the easy, commodity part. What matters now is what the website is connected to, and what it does for the practice while you are with patients. A practice website today should:

• Answer patient questions after hours, accurately and in the practice's own words.
• Send appointment requests straight to the front desk, with nothing to retype.
• Show up when patients ask ChatGPT, Gemini or Google for a practice nearby.
• Tie every call, form and booking back to where it came from.
• Stay patched and monitored without anyone in the office having to remember.
• Keep patient information encrypted, with a signed BAA behind it.

That is not a weekend prompt. It is a system, connected to the practice and looked after every day.

Bring your site, whoever built it

You built it yourself, an agency built it, or it's still running on WordPress: bring it. Patientfy AI moves it over on the same domain, keeps what works and adds what is missing. Hosting, SSL, security patches, encrypted forms, a BAA before launch and a SOC 2 compliant platform come with it.

And it doesn't stop at launch. Patientfy AI is a platform where AI does the work at scale, a real team of specialists supervises it, and you approve every launch. If you are thinking "but you're an AI company too," you're right. The difference isn't AI or no AI. It's AI checked against your real calls and bookings by people who know healthcare, compared with AI that agrees with whoever is typing.

Keep the website you built. Then put it in front of people who will tell you the truth about it.