Why Does My Medical Practice Website Say 'Not Secure'?

A dermatologist forwarded us a screenshot last month with one line: "a patient texted me this, is my site hacked?" The screenshot was her own homepage with the words Not Secure sitting right next to her web address. Her site was not hacked. But that two word label had been scaring people off for who knows how long, and she only found out because one honest patient bothered to ask instead of just leaving.

If you have seen that warning on your own practice site, this is the article for you. It is one of the most common questions we get from owners, and the good news is that it is usually cheap and fast to fix. The bad news is that while it sits there, it is costing you patients you never hear about.

What Not Secure actually means

It does not mean your website was broken into. It means your site is loading over plain HTTP instead of HTTPS. The extra S stands for secure, and it is the difference between a connection anyone on the same network could read and one that is encrypted end to end. HTTPS is turned on by an SSL certificate installed on your site. No certificate, no padlock, and the browser fills the gap with a warning.

This is not new and it is not optional anymore. Back in July 2018, Google shipped Chrome 68 and started labeling every HTTP page as Not Secure, a change documented in detail by Cloudflare at the time. Every other major browser followed. So a practice site still on HTTP in 2026 is not just a little behind. It is flashing a red flag that the rest of the web retired years ago.

How common is HTTPS now? According to Google's own Transparency Report, around 95% of pages loaded in Chrome use HTTPS. Running on plain HTTP today makes your practice the rare exception, and not in a flattering way.

Why this hits a medical practice harder than a pizza shop

Any business looks sketchy with a Not Secure label. A healthcare practice looks worse, for a simple reason: the whole relationship runs on trust, and the patient is about to hand you sensitive information.

Think about what a patient does on your site. They read about a condition that worries them. They type their name and phone number into an appointment request. Maybe they describe a symptom in a contact form. If the browser is shouting that the connection is not secure at the exact moment they are about to share something personal about their health, a lot of them stop cold. And they should. That instinct is correct.

We know people react to this. A GlobalSign consumer survey found that 84% of people would abandon a purchase if they knew the data they shared would be sent over an insecure connection. Swap "purchase" for "appointment request" and the math only gets worse, because health information feels far more private than a credit card number.

Remember too that patients size up your site fast. Research on first impressions has shown people form an opinion about a web page in a fraction of a second, long before they read the content. A security warning is one of the first things the eye lands on. You can have the best reviews in town and the kindest staff in the state, and still lose the patient in that first blink because the browser told them to be careful.

It drags down your Google rank too

The trust problem is the big one, but there is an SEO cost sitting underneath it. Google confirmed all the way back in 2014 that HTTPS is a ranking signal. On its own it is a light nudge, not a make or break factor. But it does not act alone.

When patients hit your site, see the warning, and bounce straight back to the search results, Google reads that behavior as a sign the page did not serve them well. High bounce rates and short visits feed back into how you rank locally. So the Not Secure label hurts you twice: once directly as a weak ranking signal, and again indirectly by pushing visitors away, which tells Google your result was not the one they wanted. If you are serious about showing up for "near me" searches, this is low hanging fruit. We covered the wider picture in our guide to healthcare SEO, and a secure site is step zero.

Is this a HIPAA issue?

It can be, and it is worth being clear eyed about it. A plain brochure site with no forms is mostly a trust and SEO problem. But the moment your site collects patient information, an appointment request, a contact form, an intake questionnaire, that data becomes electronic protected health information once it is tied to a person. The HIPAA Security Rule expects that kind of information to be protected in transit, and encryption is the standard way to do it. A form sitting on plain HTTP sends it in the clear.

We are not lawyers and this is not legal advice. But if you are a covered practice collecting patient details through an unencrypted site, that is exposure you do not want, on top of the patients you are already losing. HTTPS is the floor, not the ceiling.

The good news: fixing it is usually quick and cheap

Here is the part owners are relieved to hear. The certificate itself is often free. Let's Encrypt issues SSL certificates at no cost, and most modern hosts and website platforms bundle HTTPS in by default now. So this is rarely about buying something expensive. It is about setting it up correctly.

Doing it right means a few things beyond flipping a switch:

• Install a valid SSL certificate for your domain and keep it on auto renewal so it never lapses.
• Redirect every HTTP page to its HTTPS version so old links and bookmarks still land somewhere secure.
• Hunt down mixed content, the images, fonts, or scripts still loading over HTTP, because a single one of them can keep the warning on even after the certificate is in place.
• Update your Google Business Profile, directories, and ads to point at the secure address.

For a typical small practice site, a person who knows what they are doing can usually sort the whole thing in an afternoon. The trap is the DIY attempt that installs the certificate but misses the redirects or the mixed content, so the site stays half broken and the warning never fully clears. If your current site is this fragile, it is often a sign it is overdue for a rebuild anyway. We get into what a modern practice site should cost and include in how much a medical practice website costs.

Our honest take

A Not Secure warning is one of those problems that feels technical and small, so it sits on the to do list for months while the practice wonders why web leads are soft. Then we fix it in a day and the owner is a little annoyed it went unaddressed for so long. It is not a growth strategy. It is basic hygiene, like flipping on the lights before you open for the day.

What we care about more is why it was allowed to linger. Usually it is because nobody owns the website. The doctor is seeing patients, the front desk is answering phones, and the site some vendor built in 2016 just sits there, slowly aging, until a patient has to point out that it is scaring people. A website is not a one time build. It needs someone watching it, the way you would never leave your waiting room unattended. Security is just the most visible example.

This connects to something we say a lot: your website is often the first real impression a patient gets, and it has to earn trust in seconds. A warning destroys that before you get a chance. We build websites that convert and stay secure for healthcare practices, fast, encrypted by default, easy to book on, and actually maintained, so you never find out about a problem like this from a patient.

Where EtherealMinds fits

We are a healthcare only growth agency. When we take on a practice, a secure, fast website is part of the foundation, not an upsell. It plugs into the rest of the patient acquisition system: local SEO so patients find you, a site that earns their trust the second it loads, and booking that works day or night. No single piece carries the whole thing, but a site that tells patients to stay away undermines every other dollar you spend to get them there.

So open your own site right now, on your phone, and look at the address bar. If it says Not Secure, do not panic, and do not ignore it. Fix it this week. Every day it stays up is a day you are paying to send patients to your door and then warning them off at the handle.