The 30-Minute Healthcare Website Audit You Can Run Yourself

A healthcare website audit you run yourself takes 30 minutes if you split it three ways. Ten minutes reading your pages against section 133 of the National Law. Ten minutes reading Google's Core Web Vitals report, which grades you on 28 days of real visits. Ten minutes asking Google's own published trust questions of your best page. Ahpra assessed 775 advertising complaints in 2024/25. Of the practitioners it contacted about non-compliant advertising, 74% corrected it early, before any further action. That is the whole case for a self-audit. Most breaches are fixable by the practice, once someone tells it where to look. This post is the someone.

What can a 30-minute healthcare website audit actually find?

Three things, and each one has a different grader.

The regulator grades words. Google grades speed, using other people's visits. And Google grades trust, using a list of questions it has published. You cannot run all three with one tool, and most "audit checklists" pretend you can. So this one is built as three ten-minute passes, one per grader.

One honest note before the clock starts. A 30-minute audit finds the faults you can see. It does not find the faults Google measures over a month, and it does not find anything about your site that lives off your site. We come back to that in section five. It matters, because a clean 30-minute pass is not the same as a clean site.

Minutes 0 to 10: does any page break section 133?

Start with the regulator, because this is the only one of the three with a fine attached.

Section 133(1) of the National Law says a person must not advertise a regulated health service in a way that does any of five things. Every one of them is a search you can run on your own site with the browser's find box. Here they are, with the phrases that usually trip them.

Two things to know while you search.

First, the defence in subsection (2) is not for you. It says a person does not commit an offence "merely because the person, as part of the person's business, prints or publishes an advertisement for another person". That protects the web developer and the agency. There is no matching defence for the practice whose service is advertised. If the words are on your site, they are your words, whoever typed them. We went through that in what Google actually penalises about AI content.

Second, the numbers say this pass is worth doing. In its 2024/25 annual report Ahpra says its advertising compliance team assessed 775 complaints about advertising. Of the practitioners it contacted about non-compliant advertising, 74% corrected it early, "such that further intervention was not required". The ones who did not are the ones the report counts next.

Read the shape of that chart. Eleven practitioners out of 86 ended up with regulatory action. Every one of them had been told, twice, where the problem was. The audit you are running now is the first telling, done by you, for free.

If the search turns something up, what gets a healthcare website flagged has the compliant rewrite for each of the common phrases.

Minutes 10 to 20: what does Google's speed report say?

This pass is different. You do not run a tool. You read a report Google has already written about you, and the report has a clock on it that most clinic owners have never been told about.

Open Google Search Console and find the Core Web Vitals report. Google describes it as showing "how your pages perform, based on real world usage data (sometimes called field data)". The report groups your URLs into Poor, Needs improvement and Good, across three metrics.

The three metrics and their passing marks are published on web.dev. Largest Contentful Paint "should occur within 2.5 seconds of when the page first starts loading". Interaction to Next Paint should be "200 milliseconds or less". Cumulative Layout Shift should be "0.1 or less".

Now the clock. The report does not grade your average visitor. It grades the 75th percentile. Google's words on the LCP column: "75% of page requests took this amount of time or less to reach largest contentful paint in the last 28 days." The same wording applies to the other two. So a quarter of your visits can be slower than the number you see, and the number is a 28-day window, not today.

Two consequences follow, and both change what the ten minutes are for.

One. If you fix something today, the report will not say so today. Google's own fix-tracking in the report starts "a 28-day monitoring session", and the issue "is considered fixed" only if it does not appear during that window. Nobody gets a same-day result on speed. Anyone who promises you one is selling a lab number, not the grade Google uses.

Two. Many small clinic sites will open the report and see "No data available". Google says that means "either that your property is new in Search Console, or that there is not enough data available in the CrUX report to provide meaningful information". A suburban practice with a few hundred visits a month can sit in that state for a long time. That is not a fail. It is an absence of a grade, and it means Google is not using speed to rank you either way.

Write down three things and stop: the status of your busiest URL group, the metric it fails on if any, and the date. You will need the date, because the next time you look, the window has moved.

Minutes 20 to 30: would your best page pass Google's own questions?

The third grader has no report and no tool. It has a list of questions, written by Google, on a page called "Creating helpful, reliable, people-first content". Most clinic owners have never read it. It is the cheapest audit on the internet.

Pick one page. Your busiest service page, not your home page. Then ask it the questions Google asks. These are quoted from the page.

• "Does the content provide original information, reporting, research, or analysis?"
• "Does the content provide insightful analysis or interesting information that is beyond the obvious?"
• "Does your content clearly demonstrate first-hand expertise and a depth of knowledge (for example, expertise that comes from having actually used a product or service, or visiting a place)?"
• "Are you mainly summarizing what others have to say without adding much value?"
• "Is the content mass-produced by or outsourced to a large number of creators, or spread across a large network of sites, so that individual pages or sites don't get as much attention or care?"

Google also frames the whole page around three words. Who created the content, how, and why. On the who, it points at things a reader would look for to decide whether to rely on a page: "clear sourcing, evidence of the expertise involved, background about the author or the site that publishes it, such as through links to an author page or a site's About page". On the why, it says the answer should be that "you're creating content primarily to help people".

For a clinic, that turns into a five-line check you can do by eye.

• Is a registered practitioner named on the page, with the qualification and a link to a bio? If the page is anonymous, the who is missing.
• Does the page say something a competitor's page for the same service does not? If you could swap the clinic name and nothing would change, the original-information question fails.
• Is any clinical statement sourced, with a date? A claim with no source is a section 133(a) risk and a trust failure at the same time.
• Does the page tell the reader what the appointment does not cover? Google's questions reward completeness. So does the "unreasonable expectation" ground.
• Would the page exist if Google did not? If its only job is to rank for a suburb name, Google's own question about content "primarily made to attract visits from search engines" answers itself.

Notice the overlap. Four of those five lines are the same work as the section 133 pass. That is the useful fact in this whole post. In healthcare, the thing the regulator wants and the thing Google wants are nearly the same thing: a named person, saying something specific and true, with the evidence attached. It is not like that in every industry.

If you want the schema side of the who checked as well, schema markup for healthcare websites has its own ten-minute check for that.

What does a 30-minute audit miss?

Four things, and you should know them before you tell anyone the site passed.

It misses the month. The speed grade is 28 days of other people's visits. You read it today. You did not measure it today. Anything you changed this week is not in it yet.

It misses everything that is not on your site. Section 133 applies to advertising a regulated health service, and it does not say "on a website". Social posts, Google Business Profile descriptions, directory listings and ad copy are all advertising. The 775 complaints Ahpra assessed were not all about websites. This audit only read the site.

It misses the pages you did not open. Ten minutes is one search across a handful of pages. A site with 40 service pages and a blog has more than a handful. The scaled content pattern Google names, many pages that differ by a word, is exactly the kind of thing you do not see when you open three of them.

It misses what the regulator is doing now. Ahpra's report says its team can "scan social media and websites for advertising breaches". Enforcement is no longer only complaint-driven, which we covered in what 775 advertising complaints led to. A self-audit is a snapshot. Their scan is not.

What do you do with the result?

There are three outcomes, and each one has a different next step.

The section 133 search found something. Fix it this week, before anything else. It is the only one of the three graders that sends letters. The fix is almost always a rewrite of a sentence, not a rebuild of a page. The 74% figure above is practices doing exactly that, after being asked. You are doing it before being asked.

The speed report says Poor on a URL group you care about. Note the metric. Then hand it to whoever built the site with the metric name and the web.dev threshold, and ask for a date. Then wait 28 days before you judge the result, because the report will.

Your best page failed Google's questions. This is the one that costs the most to fix and returns the most. Put a named practitioner on it. Add the one thing about your approach that a competitor's page does not say. Source every clinical line. That page is now doing the regulator's work and Google's work at once.

And if the audit was clean on all three, put a date in your calendar 28 days out and run it again. The speed window will have moved. The regulator's scan will have moved. Your site will not have, unless you move it.