The Australian dental website compliance checklist

Most compliance checklists for Australian dental websites only cover AHPRA. AHPRA is the one with the $120,000 number attached, so that is understandable — but it is not the only law that reaches your website, and the other three are where the quiet, boring failures live.

Work through this once a year, and again whenever you change agency, add a service page, or buy a practice.

Sitewide

• No superlatives anywhere — “best”, “leading”, “#1”, “world-class”, “cheapest”.
• No outcome promises — “guaranteed”, “painless”, “risk-free”, “permanent”, “perfect smile”.
• No urgency language attached to clinical treatment — “act now”, “don’t miss out”, “for a limited time only”.
• No individual review text about treatment, symptoms, outcomes or practitioner skill.
• “Specialist” and specialty titles used only where the named practitioner holds specialist registration — verified on the Ahpra register, not from memory.
• Non-medical practitioners using “Dr” have their profession stated, e.g. “Dr Jones (dentist)”.
• No prescription-only medicine named by brand.
• Practice name, physical address and phone number are consistent everywhere they appear, including your Google Business Profile.
• Every claim about the practice is something a patient could check.

Homepage

• Any Google rating shown is an aggregate rating and review count only, linked to the source, with no individual review text.
• Any headline claim about experience or volume is factual and current.
• Emergency information is accurate — if you say “same-day emergency appointments”, you can actually offer them.
• Hero imagery is genuine, not stock photography implying it is your practice.

Service pages

• Each page states what the treatment involves, not just what it achieves.
• Risks or potential risks of the treatment are stated. This is a requirement, not a nicety, and it is the most commonly missing element on cosmetic pages.
• Where you claim to treat or help a condition, the page makes clear how the treatment helps it.
• No claim implies a result is typical or assured.
• Any before-and-after imagery meets the full standard — genuine, unedited, standardised capture, treatment stated, risks stated, representative range.

Pricing and offers

• Prices shown are the total price, not an entry-level figure with the crown, abutment or imaging excluded.
• Prices are current. An out-of-date price is a misleading price under both the National Law and the Australian Consumer Law.
• Any gift, discount or bonus states or refers to its terms and conditions, and those terms are clear, accurate and easy to find — not buried in a footer.
• No offer pairs a discount with time pressure on a clinical decision.
• Payment-plan and health-fund claims accurately describe what the patient will actually pay.

Team and about pages

• Every qualification listed is held and current.
• Registration claims are accurate. Anyone described as a specialist holds specialist registration in that field.
• Descriptions of experience are factual — “has placed over 400 implants” rather than “our implant expert”.
• Practitioner AHPRA registration numbers shown are correct.

Enquiry forms, chat and booking

• A collection notice explains what you collect, why, who you disclose it to, and how to access or correct it (Australian Privacy Principle 5).
• Consent to be contacted is explicit and unbundled — a pre-ticked box is not consent.
• If you will send marketing SMS or email, that is consented to separately from the enquiry itself.
• Form submissions are transmitted and stored securely, and you know where they are stored.
• You have a privacy policy, it is linked from every form, and it describes what you actually do.
• If a chatbot collects health information, the same rules apply to it — including its transcript.

SMS and email marketing

Governed by the Spam Act 2003, enforced by ACMA, and entirely separate from AHPRA. Three requirements, all mandatory:

1. 1.Consent. Express or inferred. Replying to a patient’s own enquiry is generally fine; adding every past patient to a promotional list is not.
2. 2.Identify the sender. Every commercial message must clearly identify the practice and include accurate contact details.
3. 3.A functional unsubscribe. It must work, it must be honoured promptly, and it must remain functional for at least 30 days after the message is sent.

Reviews and social

• Your practice Facebook or Instagram page either moderates testimonials or has the reviews function disabled — Ahpra’s stated option where a platform will not allow removal.
• Replies to reviews do not restate clinical content. “Thanks for the kind words” is safe; “glad we sorted that abscess” is not.
• Any reviews you do publish are complete and unedited, not trimmed and not cherry-picked.
• Review request messages meet the Spam Act requirements above.
• No incentive is offered for a review without stating the terms — and preferably no incentive at all.

Technical and accessibility

Not compliance in the regulatory sense, but the same category of avoidable failure — and directly relevant if a patient with a disability cannot book with you.

• The site is usable at WCAG 2.2 AA — real contrast, keyboard-navigable, labelled form fields, meaningful alt text.
• The site works and is legible on a phone, which is where the majority of dental enquiries begin.
• Every page loads over HTTPS.
• Practice name, address and phone match your Google Business Profile character-for-character.

Governance

• One named person is responsible for signing off website copy before it goes live.
• Your agency contract says who checks compliance — and you understand that the obligation stays with you regardless of what it says.
• You re-run this checklist annually, and after every change of agency or ownership.
• You keep a record of what was on the site and when, so you can answer a complaint about a page you changed last year.

How often should we run this?

Annually as a baseline, plus after any change of marketing agency, any practice acquisition, and any time you add a new service page. Most breaches we find were introduced by a well-meaning change nobody reviewed.

Our agency handles compliance. Do we still need to?

Yes. Ahpra is explicit that advertisers are responsible for content produced by others on their behalf, including a marketing agency. Delegating the work does not delegate the obligation.

What is the single most common failure you find?

Individual Google reviews republished on the website. It is on the majority of Australian dental sites we audit, it is almost always added by the developer as a helpful feature, and the reviews nearly always describe treatment.