Key facts
- £1 a day + VAT managed hosting for practice websites
- CQC Regulation 20A requires registered providers to display their rating on their website
- Health data is special category data under UK GDPR
- Patient-facing forms should not email clinical details in plain text
- Daily backups, free SSL and Cloudflare protection
- Data processing agreement available on request
Your CQC rating on the website
Regulation 20A of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires CQC-registered providers to display their most recent rating on their website if they have one, with a link to the CQC report. CQC provides a widget for this, and it can prosecute for failing to display ratings. The widget is a script that loads from CQC, so a theme update or a strict security setting can quietly break it. We check it's working on practice sites we host.
GP practice website requirements
NHS England expects GP practices to keep an up-to-date website and NHS.uk profile. Recent contract changes have required practices to publish the 'You and Your General Practice' guidance, keep online consultation tools available during core hours, and explain how to complain. Requirements change each contract year, so check with your ICB. Hosting's part is keeping those links and tools reliably online and quick on mobile, because many patients use the site on a phone.
Keep patient data off the website
Health information is special category data under UK GDPR and needs extra care. Practical rules for a practice website:
- Don't build forms that ask for symptoms, medication or test results and then send them by ordinary email.
- Use NHS-approved online consultation and repeat prescription services, linked from the website, for clinical contact.
- Keep general enquiry forms to name, contact details and a short message.
- Limit who can edit the website, with individual logins.
NHS practices also complete the Data Security and Protection Toolkit; we can answer supplier questions for it. See UK GDPR and hosting.
Private clinics, dentists and therapists
Private practices often have online booking for appointments and pricing pages. Booking is usually a third-party system embedded on your site; we keep the embed working and the page fast. Health claims in your marketing should follow advertising rules, and if you're CQC-registered the rating display rule above applies to you too.
Getting started
Order dijitul Complete Hosting at clients.dijitul.uk/order and ask for our data processing agreement. We'll migrate your site, check the CQC widget and links, and switch over. If you need a patient portal or clinical system hosted, talk to us first: that's quoted and needs careful scoping.
Frequently asked questions
Do medical practices have to show their CQC rating on their website?
Yes. Regulation 20A requires CQC-registered providers to display their latest rating on their website, if they have one, with a link to the CQC report. CQC provides a widget for this and can prosecute for breaches.
Can a GP practice website collect patient information through a contact form?
General contact details are fine, but clinical information is special category data and shouldn't be sent through ordinary web forms and email. Use NHS-approved online consultation tools for clinical contact and link to them from the website.
What is the best website hosting for a dental practice?
A UK managed host that keeps the site secure, fast on mobile and backed up, keeps booking and CQC widgets working, and signs a data processing agreement. dijitul hosts dental practice websites for £1 a day + VAT.
Why has the CQC widget stopped showing on our website?
The widget loads from CQC's servers, so it can be broken by a theme or plugin update, a blocked script, a security policy or caching. Check the browser console. dijitul checks the CQC widget on practice sites it hosts.
Does a practice website need to meet NHS data security standards?
NHS organisations complete the Data Security and Protection Toolkit, which covers suppliers. A public website shouldn't hold patient records, which keeps risk low, but you should still have a processor contract and good security with your host.
Can dijitul provide a data processing agreement for our practice?
Yes. dijitul provides a data processing agreement on request to customers using its hosting. Ask when ordering or email info@dijitul.uk.
Related
Set it up and forget about it
Managed hosting, Plesk, Cloudflare DNS, daily backups and your domain for £1 a day + VAT. We move your site for you.