# How to Audit Your Healthcare Website for FDA/FTC Compliance: A 5-Step Framework You Can Run in Two Weeks

A tactical 5-step framework for auditing a healthcare practice website for FDA/FTC compliance violations. Covers inventory, triage, claim-category scan, source rewrites, and archive retirement.

By RegenCompliance Editorial (FDA/FTC compliance desk). Published 2026-04-24. Reading time 11 minutes.
Canonical page: https://regencompliance.ai/blog/healthcare-website-compliance-audit-framework

A website compliance audit is one of the highest-ROI compliance investments a healthcare practice can make right now. It is also one of the most commonly misrun - either treated as a once-a-year legal review, or as a one-time cleanup that finishes and stays finished. Both approaches fall short under 2026 FDA/FTC enforcement cadence. Here is the framework that actually works.

The goal of the framework is simple: end the audit in a better place than a find-and-replace pass, end it in the same place every time you run it (so outcomes are reproducible), and end it with audit trail that you can show a regulator if you need to respond to a warning letter in 15 business days.

Two-week sprint, not a two-month project

Clinics that run this framework in under two weeks tend to finish. Clinics that treat it as a two-month project tend to stall. Time-box aggressively: the goal is getting the worst risk off the public surface this month, not building a perfect audit program.

## Step 1 - Full marketing-surface inventory

Before you can audit, you need to know what exists. Most clinic owners underestimate this: the marketing surface is always larger than you think.

### What to inventory

- **Website pages.** Pull a crawl from your CMS export, a sitemap, or an SEO tool. Include unlinked pages.
- **Social media.** Every post, story highlight, pinned post, and profile bio across Instagram, TikTok, Facebook, LinkedIn, X, YouTube.
- **Paid ads.** Every active and paused ad + every ad variation across Google, Meta, TikTok, YouTube. Platform ad libraries are public - regulators use them.
- **Email.** Every template in your ESP, every automation flow, every recent one-off broadcast.
- **Scripts and intake.** Sales scripts, on-hold message, intake forms, consent language, after-care instructions.
- **Third-party surfaces.** Your Google Business profile, Yelp, Healthgrades, RealSelf, Zocdoc, directory listings, partner sites that reference you.
- **Archive / Wayback.** Check `archive.org/web/*/yourclinic.com` for pages that have been removed or rewritten. Archived pages are still readable by regulators.

Dump every URL or surface into a single spreadsheet. One row per surface. One column for type. This is your audit universe.

## Step 2 - Pageview-weighted triage

Auditing 200 pages perfectly takes weeks. Auditing the top 10 pages today cuts most of the actual risk. Do the high-traffic surfaces first.

### How to prioritize

1. Pull 90-day pageviews from your analytics (GA4, Plausible, Fathom, whatever you use).
2. Sort descending. Top 10 pages typically carry 60-80% of traffic in a small clinic site.
3. Then overlay: every page that’s a landing page for an active ad. Regardless of pageview count. A low-traffic landing page that pairs with a high-spend ad is a high-risk surface.
4. Then: every social post from the last 12 months that got above-median engagement. Posts that spread are the posts regulators see.
5. Everything else is the long tail. Audit it in the second sprint.

The one long-tail exception

Any page that makes a *hard* claim (cure, FDA-approved, guaranteed, testimonial without disclosure) is high-priority even if it gets ten pageviews a month. A single high-intensity claim on a forgotten page still opens a file.

## Step 3 - Claim-category scan

For each surface in your triaged list, scan against four specific claim categories. These are the categories that drive the vast majority of 2024-2026 enforcement. The [FTC Health Products Compliance Guidance](https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance) documents what substantiation regulators expect for each category.

### Category 1 - Disease claims

Any language asserting the product or procedure treats, cures, heals, reverses, or prevents a named medical condition. This is the single highest-density category. See [the structure/function vs. disease claims post](https://regencompliance.ai/blog/structure-function-vs-disease-claims) for the line.

### Category 2 - Implied or false FDA status

“FDA-approved” language when what you mean is FDA-registered, or when nothing at all is FDA-approved in the procedure chain. See [the 7 banned words list](https://regencompliance.ai/blog/banned-words-healthcare-marketing-2026) for the specific phrases.

### Category 3 - Outcome guarantees and safety absolutes

“Guaranteed,” “100% safe,” “no side effects,” “risk-free.” FTC territory.

### Category 4 - Testimonial and before/after compliance

Testimonials without typical-experience disclosure. Before/after photos without standardization or consent documentation. Paid testimonials without material-connection disclosure. See [before/after photos compliance](https://regencompliance.ai/blog/before-after-photos-compliance) for the full disclosure checklist on patient imagery.

For each surface, mark which of the four categories applies and record the specific phrase and location. Your output from step 3 is a violation map: surface, category, exact text.

## Step 4 - Rewrite at the source, not at the instance

The most common audit failure is fixing each flagged phrase one at a time, letting the same language re-enter next week. The durable fix is to change the writing *source* so violations do not get typed in the first place.

### Three source-level fixes

1. **Marketing style guide update.** Add the seven banned words from the trigger-words post to your clinic style guide, with the approved alternatives written right next to them. This is the most durable intervention.
2. **Testimonial-solicitation workflow update.** Update your testimonial-collection form to ask patients to describe their experience in subjective terms rather than disease terms, and to include typical-experience disclosure automatically when the testimonial is an atypical outcome.
3. **Pre-publish compliance scan.** Every piece of marketing content runs through a scan before it goes live. Pre- publish catches the violation when it is free to fix. Post-publish catches it after the regulator has a screenshot. See the [pre-publish compliance checklist](https://regencompliance.ai/blog/pre-publish-compliance-checklist) for the specific items to verify before any asset goes live.

With all three in place, you ship far fewer violations than a find-and-replace-only program. The difference compounds over a year.

## Step 5 - Archive retirement and audit trail

Two things remain after the rewrite pass.

### Archive retirement

Pages, posts, and ads that were written under an older compliance standard and cannot be rewritten compliantly get retired - not hidden. For a website page that means 301-redirect it to the most relevant compliant page, so any link equity is preserved and the old URL stops serving violative content. For a social post, delete it; do not archive it.

### Audit trail

Every change you made in the audit - what was flagged, what was rewritten, what was retired, by whom, and when - goes into a centralized audit log. If a warning letter arrives nine months from now, this is the file that turns a 15-business-day panic into a 15-business-day administrative task. The [FDA HCT/P warning letter campaign guide](https://regencompliance.ai/blog/fda-hct-p-warning-letter-campaign) covers what to expect at each escalation stage and what a response requires.

> The audit is not the compliance program. The audit trail is the compliance program.

## How often to run this

- **Full audit:** every six months, minimum. Every quarter for higher-risk specialties (regen med, stem cell, GLP-1 weight loss).
- **Pre-publish scan:** every new piece of outward-facing content. No exceptions.
- **Rule refresh:** your compliance ruleset should pick up new FDA/FTC language within 24 hours. Quarterly manual refresh is too slow.
- **Archive sweep:** once a year. Check Wayback, check old-but-still-indexed pages, remove or redirect what no longer meets standards.

## Who on the team does what

For most clinics, the cleanest role split is:

- **Clinical lead (MD/owner):** signs off on rewrites touching disease language or testimonials. Not in the weeds of the audit.
- **Marketing lead or office manager:** runs the inventory, the scan, and the rewrites. Coordinates with vendor if you have one.
- **Vendor (if any):** runs the technical side - redirects, sitemap updates, CMS edits. Does not make compliance calls on copy.
- **Compliance scanner:** does the claim-category classification and produces the violation map. Runs pre-publish on every new piece of content thereafter.

Built exactly for this loop

RegenCompliance runs the step-3 claim scan and the step-4 pre- publish scan in one tool. Every scan is logged for the step-5 audit trail. One-click rewrites are produced in under 15 seconds. [Try a free scan](https://regencompliance.ai/demo).

Key Takeaways

- Time-box the first audit at two weeks. Clinics that run it as a two-month project stall.
- Prioritize by pageviews and active-ad landing pages, not alphabetically.
- Scan every surface against four categories: disease claims, implied FDA approval, guarantees, testimonials.
- Fix at the source - style guide, testimonial workflow, pre-publish scan - so violations stop entering in the first place.
- Keep an exportable audit trail. In a warning-letter response, the trail is the program.

---

RegenCompliance is FDA/FTC compliance scanning software for healthcare marketing, operated by Regen Portal LLC. Educational compliance tool, not legal advice. Not affiliated with the FDA or FTC. Contact: support@regencompliance.ai. Full site index for AI agents: https://regencompliance.ai/llms.txt