Medical website disclaimers and terms of use

Scroll to the bottom of a practice website and you will find a line like “The information on this site is not medical advice.” Click the footer links and there is a terms of use page, a privacy policy and, for a covered entity, a notice of privacy practices. These pages are easy to copy from another site and forget. They are also the pages a practice reaches for when something goes wrong: a patient who acted on a blog post, a symptom sent through a contact form on a Friday night, a chat message about self-harm.

This guide covers what a medical advice notice can and cannot do, wording for contact forms and chat, emergency notices, how terms of use differ from a privacy policy, and why telehealth consent belongs somewhere else. For the privacy side, see our practice website privacy policy guide and our cookie consent guide. What a form should collect, and where the data goes, is in our HIPAA and website contact forms guide. Chat tools have their own guide: AI chatbots on a practice website. For the full site review, start with our medical practice website checklist. If your terms of use mention reviews or feedback, see our guide to review gag clauses in patient agreements.

This is general information, not legal advice, and we do not sell disclaimer or terms templates. Sources cited were checked on October 30, 2026: 15 U.S.C. 45 and 15 U.S.C. 7001 (United States Code, 2023 edition), 45 CFR 164.530(h) (eCFR), the FTC staff guide .com Disclosures (March 2013), the AMA Code of Medical Ethics opinion on patient-physician relationships, SAMHSA’s 988 Suicide and Crisis Lifeline page and the Department of Justice guidance on web accessibility under the ADA. When a patient relationship begins, how a website agreement is enforced, and what telehealth consent requires are set by state law and differ by state. Have a health care attorney licensed in your state review your notices and terms.

What a “not medical advice” notice can do

A short notice does real work when it matches how the site is used. It tells a reader that an article is general education, that it does not replace an exam, and that questions about their own care go to a clinician. It sets expectations for people who will never call you, and it reminds your own team what the blog is for.

Use: plain words near the content it qualifies, such as a line under each health article: “This article is general information. It is not a diagnosis or treatment plan for you. Talk with a clinician about your own care.”
Use: a date on each health article showing when it was written or last reviewed, and the name of the clinician who reviewed it, if one did. Our medically reviewed content guide covers that process.
Use: a way to contact the practice to book a visit, right after the notice, so the reader has a next step.
Avoid: a notice so long and so legal that nobody reads it.
Avoid: a notice that contradicts the page, such as “not medical advice” under a page that tells readers which dose to take or which symptoms they can safely ignore.

What a disclaimer cannot do

A disclaimer is not a shield against the content around it. Three limits matter for practices.

It cannot fix a misleading claim. Section 5 of the FTC Act, 15 U.S.C. 45(a)(1), declares unfair or deceptive acts or practices in or affecting commerce unlawful. The FTC staff guide .com Disclosures says a disclosure can only qualify or limit a claim to avoid a misleading impression, that it cannot cure a false claim, and that if a disclosure contradicts a material claim, the claim itself must be modified. A results page that overpromises does not become accurate because of a footer line. Our healthcare marketing rules hub covers claims in more depth.

It cannot take away patients’ HIPAA rights. Under 45 CFR 164.530(h), a covered entity may not require individuals to waive their rights under the HIPAA Privacy Rule, the breach notification rule or the complaint process as a condition of treatment, payment, enrollment in a health plan or eligibility for benefits. A terms of use clause that says patients give up privacy rights by using your portal or booking online works against you, not for you.

It may not decide whether a patient relationship exists. The AMA Code of Medical Ethics says a patient-physician relationship begins when a physician begins to serve a patient’s medical needs. That is an ethics statement, and the legal answer is a question of state law, but the direction is the same: what your clinicians actually do in a reply matters more than the label on the form. If a clinician answers a stranger’s specific question about their own symptoms, a footer line saying no relationship was formed may not carry the weight you hope.

Where notices go on the page

The FTC staff guide on online disclosures was written for advertising, but its placement advice is a useful standard for any notice you need people to read:

Disclosures that are an integral part of a claim should not be communicated through a hyperlink. They belong on the same page, next to the claim.
Hyperlinks labeled only “disclaimer”, “details”, “terms and conditions” or “fine print” do not convey the importance or nature of the information and are likely to be inadequate.
Necessary disclosures should not be relegated to terms of use and similar contractual agreements.
Disclosures should be prominent: size, color and graphic treatment matter in relation to the rest of the page. Where scrolling is needed to find one, use text or visual cues to prompt it.

Applied to a practice site: if a treatment page needs a qualifier, such as that results differ between patients or that a consultation decides who is a candidate, put that sentence next to the claim, in body text, not only in a footer link.

Contact forms and chat: say what the channel is for

A contact form or website chat is the likeliest place for a visitor to describe their own symptoms. The notice there has three jobs: say what the channel is for, say when someone will see the message, and say what to do if it cannot wait.

Sample wording, to adapt with your attorney:

“Use this form to request an appointment or ask about our services. Please do not include details about your symptoms or medical history.”
“Messages are read during office hours, [days and hours]. We do not monitor this form at night, on weekends or on holidays.”
“Sending a message does not make you a patient of [Practice name], and we cannot give medical advice through this form.”
“If you have a medical emergency, call 911. If you are in a mental health or substance use crisis, call, text or chat 988.”

The notice has to match what your team does. If front desk staff answer clinical questions by email, or a clinician replies to a form with advice, the form text no longer describes the channel. Train the team to move clinical questions into a visit or your patient portal, and keep the reply wording to scheduling and general information.

For chat tools, the same wording appears before the first message, and the tool itself should recognize emergency and crisis messages and give the 911 and 988 instructions without asking more questions. Our chatbot guide covers this, and our AI disclosure guide covers telling people when they are talking to an automated tool.

Emergency notices: 911 and 988

SAMHSA describes 988 as offering 24/7 support for mental health, substance use and more, by call, text or chat, with access for people who are Deaf or hard of hearing and for Spanish speakers. Pairing it with 911 gives a visitor one line that covers both situations.

Use: the notice on the contact page, each form, the chat window, appointment request pages and pages about conditions where a crisis is foreseeable, such as behavioral health or substance use services.
Use: the same words in the after-hours phone message and in automated text or email replies.
Use: plain text, not an image, so screen readers and translation tools can read it.
Avoid: hiding it in the terms of use, where a person in crisis will not find it.
Avoid: telling people to email or message the practice in an emergency.

Terms of use, privacy policy and notice of privacy practices

These three documents get mixed up, and each has a different job.

Terms of use: the rules for using the website itself. What the content is for, that it is general information, how links to other sites work, who owns the site content (see our copyright and image rights guide), how visitors may and may not use the site, and how you will post changes.
Website privacy policy: what the site and its tools collect about visitors, including forms, cookies, analytics and chat, and who receives it. Our privacy policy guide covers it in detail.
Notice of privacy practices: the HIPAA notice a covered entity gives patients about protected health information. It is not a substitute for a website privacy policy, and a website privacy policy is not a substitute for it.

Online agreements can be valid. Under 15 U.S.C. 7001(a), the federal E-SIGN Act, a signature, contract or other record relating to a transaction in or affecting interstate commerce may not be denied legal effect, validity or enforceability solely because it is in electronic form. Whether a particular website terms page binds a visitor is a different question, and the answer depends on state contract law and how the terms were presented. If you need a visitor or patient to agree to something, ask your attorney whether a check box with a link, a signature or a separate document is the right format.

Where a law requires information to be given to a consumer in writing, section 7001(c) lets an electronic record satisfy that only after the consumer affirmatively consents, following a clear and conspicuous statement that includes their right to paper copies and their right to withdraw consent. That is a reason to plan electronic delivery of required patient documents with counsel rather than through a website footer.

Telehealth consent is a separate document

A practice that offers video visits may need informed consent for telehealth. That consent, where your state or a payer requires it, belongs in the intake or visit workflow, signed or recorded for each patient, not in the website terms of use. The website can explain that telehealth visits are offered, which states your clinicians are licensed in, and how to book. Our telehealth marketing guide and our licensure compacts guide cover the advertising side.

Use: a telehealth consent form your attorney approved for your state, in the booking or check-in flow.
Avoid: treating “by booking a video visit you consent to telehealth” in the site terms as the consent itself.

Make notices readable for everyone

The Department of Justice guidance on web accessibility says the ADA applies to businesses open to the public under Title III, and lists barriers that include poor color contrast, using color alone to give information, images without text alternatives and inaccessible online forms. For notices, that means:

Use: real text with enough contrast against the background.
Use: a label and text, not only red color, to mark required fields and warnings.
Use: the emergency line as text inside the form, not only as placeholder text that disappears when a person starts typing.
Avoid: a disclaimer or emergency notice baked into a banner image.

Why we do not sell a template

Search for a medical website disclaimer and you will find templates. Copying one has three problems. It may reference another state’s law, services you do not offer or a business structure you do not have. It may contain clauses that cut against you, such as a waiver of patient rights that 45 CFR 164.530(h) does not allow. And it is someone else’s writing, with the copyright issues our copyright guide describes. The safer route is a short list of what your site does, given to an attorney who writes terms that match it.

Where things go wrong

A footer says “not medical advice” while the blog tells readers which symptoms they can manage at home without a visit.
The contact form invites people to describe their symptoms, and a staff member replies with clinical advice.
The emergency notice exists only in the terms of use.
A chat tool keeps asking intake questions after a visitor mentions thoughts of self-harm.
Terms copied from another practice name a different state, a different practice or services the practice does not offer.
Terms of use say patients waive privacy rights by using the portal.
The privacy policy and notice of privacy practices are treated as one document, so one of them is missing.
The emergency line sits in light gray text inside a banner image.

An illustration

The following is an invented illustration, not a real practice or event.

[Practice name], a family medicine practice, has one footer line, “Content is for informational purposes only”, a contact form with a free text box labeled “Tell us about your symptoms”, and terms of use copied years ago from a site in another state.

After review: each health article has a short general information line, a review date and a link to book. The contact form asks for name, contact details, preferred times and the reason for the visit from a short list, and says when messages are read. Above the submit button, in text, it gives the 911 and 988 instructions and says the form is not monitored after hours. The front desk has a script for moving clinical questions into a visit. An attorney in the practice’s state wrote new terms of use that describe the actual site, and the privacy policy and the notice of privacy practices are separate links in the footer. Telehealth consent moved into the check-in flow.

Checklist

Each health article has a short general information notice, a date, and a next step for booking.
No notice contradicts the page it sits on, and no claim relies on a disclaimer to be accurate.
Each form and the chat window says what the channel is for, when messages are read, and that it is not for emergencies.
911 and 988 instructions appear as text on forms, chat, the contact page and after-hours messages.
Staff have a written script for moving clinical questions into a visit.
Terms of use describe this site and were reviewed by an attorney in your state.
No clause asks patients to waive HIPAA rights.
Website privacy policy and notice of privacy practices are separate, current and linked from the footer.
Telehealth consent sits in the booking or check-in flow, not the website terms.
Notices are real text, with enough contrast, and do not rely on color alone.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. On notices, that means forms that ask only for what you need, emergency instructions as text on each form and chat window, health articles with review dates, and footer links to the documents your attorney writes. We do not write or sell legal terms. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Does a “not medical advice” disclaimer protect our practice?

It sets expectations, but it has limits. The FTC staff guide on online disclosures says a disclosure cannot cure a false claim, and a disclaimer that contradicts the page does not fix it. What your clinicians actually say and do matters more than the label.

Where should the disclaimer go on a medical website?

Next to the content it qualifies, in plain text. The FTC staff guide says disclosures integral to a claim belong on the same page and next to it, and that links labeled only “disclaimer” or “fine print” are likely to be inadequate.

What should our contact form say about emergencies?

Tell people to call 911 for a medical emergency and to call, text or chat 988 for a mental health or substance use crisis, say when messages are read, and say the form is not monitored after hours. Put this in text near the submit button.

Can our terms of use say patients waive HIPAA rights?

No. Under 45 CFR 164.530(h), a covered entity may not require individuals to waive their Privacy Rule rights as a condition of treatment, payment, enrollment in a health plan or eligibility for benefits.

Is our website privacy policy the same as our notice of privacy practices?

No. The notice of privacy practices is the HIPAA notice about protected health information. The website privacy policy covers what the site and its tools collect from visitors. A practice that is a covered entity needs both.

Can we put telehealth consent in the website terms?

Treat them as separate. Where your state or a payer requires telehealth consent, it belongs in the booking or check-in flow for each patient, in a form your attorney approved, not in general website terms.

Medical website disclaimers, terms of use and emergency notices