Availability
Emergency numbers, address and directions must load even if a plugin or database fails.
Blog · WebJi® India
Hospital Website Hosting
Quick answer
Hospital website hosting should give a 99.9% uptime target, HTTPS on every page, tested off-account backups and a patched CMS, with appointment forms that collect only name, phone and department. Patient records stay in the hospital information system, not the website. Under the DPDP Act 2023 the hospital, not the host, carries the compliance duties.
For hospital, clinic and diagnostic-centre managers in India choosing hosting for a public website and appointment forms.
✓ In business since 2005
✓ INR + GST billing
✓ 24/7 Email Support — avg reply < 60 min
GuideWebJi®
knowledge
knowledge
- Read time
- 4 min
- Sections
- 9
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What does a hospital website need from its hosting?
A hospital website needs reliable uptime, HTTPS on every page, restorable off-account backups, a patched CMS and minimal-data enquiry forms; patient records belong in the hospital information system, not on the website host. The site's job is helping a patient or attendant reach the right department, doctor and phone number.
Encryption
TLS on every page, auto-renewing, with no mixed-content warnings.
Recovery
Daily backups kept off the hosting account, with one restore actually tested.
Minimal data
Forms that collect only what staff need to call back.
Why should the hospital website and patient records be separate?
Keeping clinical data in the hospital information system (HIS) and off the marketing website limits the damage if the website is hacked, because a compromised CMS then exposes brochure content, not reports or histories. It is the most useful design decision for a hospital site.
If patients need to see lab reports or bills online, build a portal that queries the HIS through an authenticated API, hosted on its own server with separate access control. Health records exchanged under the Ayushman Bharat Digital Mission (ABDM) likewise flow between registered HIS and health-locker systems, not through a public website's contact form.
What does the DPDP Act 2023 require of a hospital website?
Under the Digital Personal Data Protection Act 2023 the hospital is the data fiduciary: it must give notice, take consent for a stated purpose, collect only what that purpose needs, protect the data and report breaches. These duties stay with the hospital, not the host.
- Notice: a plain-language line beside each form saying what is collected and why.
- Consent: an unticked checkbox for anything beyond the immediate callback, such as health-camp alerts.
- Purpose limits: appointment data used for appointments, not for unrelated marketing.
- Breach reporting: to the Data Protection Board and affected individuals.
- Processors: the host, email provider and any booking tool are processors and belong in the privacy notice.
Before DPDP, the IT (SPDI) Rules 2011 listed medical records and history as sensitive personal data; the DPDP Act now covers all digital personal data under one regime. The DPDP compliance page explains the paperwork side.
What should a hospital appointment form collect?
Name, phone number, preferred department or doctor and a time window are enough for staff to call back and confirm; anything clinical should be collected in person or in the HIS. A form that collects less is easier to secure and to defend.
| Ask | Do not ask on the website |
|---|---|
| Patient or attendant name | Diagnosis, symptoms in detail, test results |
| Mobile number | Aadhaar, PAN or ABHA number |
| Department or doctor | Insurance policy numbers |
| Preferred date and time window | Uploaded prescriptions or scans |
Deliver form submissions to a mailbox the hospital controls, on its own domain, rather than to a staff member's personal Gmail. Business mailboxes on the hospital domain are covered by business email hosting.
Which uptime and security controls matter most for hospital sites?
Plan around a 99.9% uptime target, about 43 minutes of downtime in a 30-day month, and five security controls you can check before signing: TLS, a WAF, off-account backups, prompt updates and two-factor admin login. Uptime is a target, not a guarantee that a page is always reachable.
- Hard-code emergency numbers, address and visiting hours into the page template so they render without the database.
- Put a web application firewall in front of the CMS to block known plugin exploits; see what a WAF is.
- Keep daily backups outside the hosting account and test one restore every quarter.
- Update the CMS, theme and plugins promptly and delete anything unused.
- Give every administrator their own login with two-factor authentication; never share one admin password.
Healthcare sites are frequent ransomware targets; ransomware protection for websites covers recovery planning.
Should a hospital use shared hosting, a VPS or a dedicated server?
A brochure site with an appointment form fits shared hosting; a patient portal with logins or an HIS integration needs a VPS or dedicated server with its own resources and security boundary. Shared accounts cap concurrent processes and share the server with other customers.
| Site type | Fits | WebJi® option |
|---|---|---|
| Departments, doctors, contact form | Shared hosting | Webji Launch ₹299/month |
| Multi-specialty site with blog and many staff mailboxes | Shared, more headroom | Webji Turbo ₹399/month |
| Hospital group with several branch domains | Shared, multi-domain | Webji Scale ₹699/month |
| Patient portal, teleconsult or HIS API | VPS or dedicated | VPS hosting from ₹499/month, sized by quote |
Final amounts are confirmed at checkout. Teleconsultation itself must follow the national Telemedicine Practice Guidelines, which govern the doctor-patient interaction rather than the hosting.
What can a web host promise a hospital, and what can it not?
A host can state in writing who can access the account, how backups and restores work and which security controls run; it cannot give consent for the hospital, audit DPDP compliance or certify HIPAA. A hosting invoice is not a compliance certificate.
WebJi® hosts hospital and clinic websites, does not claim HIPAA certification (a United States law), does not sign business associate agreements, and does not audit hospitals. Clean-up and hardening after an attack are handled by website security services. Questions go to support@webji.services, answered 24/7 in Hindi and English with an average first reply under 60 minutes.
FAQ
Frequently asked questions
Can a hospital show doctor profiles and fees on its website?
Yes, factual profiles with qualifications, specialities and consultation timings are common and useful. Keep claims factual and check professional conduct rules on advertising with your medical director, since those rules govern content, not hosting.
Should a hospital website use WhatsApp for appointment requests?
A WhatsApp button is convenient for patients, but messages then sit on staff phones. Use a business account managed by the hospital, avoid asking for reports over chat, and mention WhatsApp as a processor in the privacy notice.
How quickly must a hospital fix a hacked website?
Immediately, because patients rely on the phone numbers and a hacked site may redirect them or serve malware. Restore a clean backup, change all passwords, patch the cause, and assess whether any personal data was exposed and must be reported.
Does NABH accreditation require particular website hosting?
NABH standards assess the hospital's clinical and management processes, including information management, rather than prescribing a web host. Hospitals often display their accreditation on the site; keep the certificate details current and accurate.
Legal summaries from the DPDP Act 2023 text; not legal advice · Reviewed by the WebJi® team, Jaipur.
WebJi® since 2005
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.