A small business website for a 501(c)(3) outpatient counseling practice in New Jersey

The project

An outpatient substance use disorder counseling practice in central New Jersey, a 501(c)(3) organization offering IOP, individualized counseling, anger management, and reiki/meditation. The site is the practice's primary intake channel — the form on the contact page, the tap-to-call button on mobile, the Google Business Profile linkage, the address and hours on the footer. Bilingual English/Spanish on the key sections. WCAG 2.1 AA accessible (verified by Lighthouse + axe-core CI gate + a manual screen-reader pass).

The legacy site ran on a vendor-managed WordPress installation (Town Square Interactive / Beacon Easton theme) at a recurring annual cost of $1,788. The site worked, but the audit found four structural issues worth fixing:

• Third-party trackers on every page. Five trackers were running: Universal Analytics (deprecated), two GA4 properties, Google Tag Manager, and Facebook SDK. For a SUD treatment program, that creates a federal 42 CFR Part 2 disclosure surface — Facebook can see which specific pages visitors land on.
• A Google Maps API key exposed in the page source. Anyone could steal it; the bill would be the practice's.
• Live testimonials with full names. Combined facility + patient status in a way that creates a 42 CFR Part 2 risk profile. Each one requires a signed authorization to publish.
• Vendor owns the code. The practice could not move the site, edit it freely, or hand it to a new developer without paying the vendor.

What was already working and worth keeping: the address, phone, hours, services, mobile sticky Call button, Google Business Profile linkage, and email on Google Workspace (which lives independently of the website host — good for the cutover).

Before and after — the numbers

The headline metrics. Each row is verified against the engagement receipt on file.

The build — what was built instead

A single-page, statically generated website. Every legacy URL on the old install still works via a permanent redirect, so anyone with an old link still lands in the right place and any prior Google ranking transfers. The site is bilingual (English / Spanish) on the key sections, with a top-bar language toggle and a full hreflang cluster for search engines. Zero third-party trackers; zero analytics JavaScript; zero profile-building scripts.

What is on the page

• Hero with primary CTA. The tap-to-call button is above the fold on mobile — the practice's primary intake path.
• Services grid. IOP, individualized counseling, anger management, reiki & meditation — the four services the practice offers, with plain-language descriptions.
• About / mission section. 501(c)(3) status, founding era, Ocean County context.
• Crisis resources, always visible near the footer. 988 Suicide & Crisis Lifeline, SAMHSA National Helpline, NJ ReachNJ, plus a 911 emergency-handling line. Required for 42 CFR Part 2 — within two taps from any viewport state.
• Contact form + map + hours. The map is OpenStreetMap (no Google Maps API key, no third-party tracker on the page).
• FAQ section. The intake team's top 10 most-asked questions, in plain language, with structured FAQPage JSON-LD for search engines.
• 42 CFR Part 2 footer notice. The required language for SUD treatment programs.

What is NOT on the page (intentional)

• No live testimonials. Federal 42 CFR Part 2 requires a signed authorization for each one. The existing 7 testimonials need a quick legal review before re-publishing. The section is scaffolded and ready; content lands when the practice has time.
• No third-party trackers. No Google Analytics. No Facebook Pixel. No Tag Manager. The site ships zero profile-building JavaScript. (Cookieless analytics is available if the practice wants it later — but turned off by default for compliance.)
• No online booking or appointment scheduling. The contact form + tap-to-call are the intake path. A HIPAA-compliant scheduling tool is a separate engagement.
• No donations or payment processing. The practice does not currently accept online donations; if they want to later, that's a small additional engagement.
• No social media embeds. Facebook and Instagram stay the practice's responsibility on their own channels.

The process — 4 weeks from deposit to launch

The engagement ran on a phased cutover. The site was built on a separate host (so the legacy WordPress site stayed live the whole time), reviewed at the demo, then cut over at the DNS change. The practice was never offline.

Screenshots

Desktop and mobile views, before and after. (Screenshots are added by the dev when the page is personalized — these slots mark where the desktop / mobile / before / after shots go.)

The handoff — what the client owns

The site is owned by the client. The hosting account is the client's. The domain is in the client's registrar. The source code is in the client's GitHub (or as a zipped archive if GitHub is too much). The handoff package is six things:

1. Source code in the client's GitHub account, plus a zipped archive as a fallback. Every file is editable in any text editor; no Git knowledge required for 95% of content updates.
2. A non-technical editing guide (markdown document + 30-minute Loom walkthrough) for routine content updates: editing service descriptions, FAQ items, blog posts, the last-reviewed date, the crisis resource numbers.
3. The hosting account in the client's name. The client can log in, see the deploy history, and roll back to any prior version.
4. The domain in the client's registrar account. The client can transfer it to any registrar, point it at any host, or sell it — none of those require permission from anyone else.
5. The compliance audit trail (a markdown document, generated as a PDF for the Board) — every third-party-tracker decision, every accessibility fix, every 42 CFR Part 2 verification, with the date and the rationale.
6. A 30-day post-launch support window — anything that needs a fix or adjustment after the cutover, no charge. After the 30 days, the client is fully self-sufficient and can hire any developer to work on the site.

The compliance angle — 42 CFR Part 2, in plain language

Substance use disorder (SUD) treatment programs are governed by 42 CFR Part 2 — a federal confidentiality rule stricter than HIPAA. The rule says: a patient's status as a patient in a SUD program cannot be disclosed without their written authorization, with limited exceptions. For a website, the practical implications are:

• No third-party trackers that can see which specific pages a visitor lands on. A tracker that reports "user X visited the IOP page" is a disclosure surface — the tracker company now knows the visitor is researching intensive outpatient programs. The rebuild ships zero profile-building JavaScript.
• No testimonials with patient names at launch. Each one requires a signed authorization specifying what can be said, where, and for how long. The existing 7 testimonials on the legacy site need a quick legal review before re-publishing.
• Crisis resources always visible. 988 Suicide & Crisis Lifeline, SAMHSA National Helpline, NJ ReachNJ, plus a 911 emergency-handling line — within two taps from any viewport state.
• A 42 CFR Part 2 footer notice. The required language stating that information collected is governed by the federal rule.
• Intake-only contact form. The form is for general inquiry only — never clinical, never insurance, never substance-use data. (A HIPAA-compliant intake form is a separate engagement with a BAA-covered form provider.)
• No Google Maps. The legacy site exposed a Google Maps API key in the page source. The rebuild uses OpenStreetMap instead — no API key, no third-party tracker, no profile-building JavaScript.

The compliance audit trail documents every decision, the date it was made, and the rationale. The practice can hand it to their attorney, their Board, or an auditor and the trail is complete.

What I learned

Two things stand out about this engagement that I'll carry into the next one.

The 5-year cost of vendor lock-in is the headline number, not the page load. Every prospective client I've talked to since this engagement has been more interested in the $1,773/year savings than the Lighthouse 100. The page load is the proof that hand-coded is better, but the cost is the reason a small business owner picks up the phone. For a 501(c)(3) where every dollar funds a session, the $1,773/year is not a small number — it's a meaningful portion of the operating budget. The break-even math ($2,000 build ÷ $1,773 annual savings = 1 year, 2 months) is the line that closes the deal.

42 CFR Part 2 is a structural constraint, not a feature. It is not optional, not adjustable, and not "we'll add it later." For SUD treatment programs, the compliance posture is the table-stakes requirement — and most page builders are not designed for it. Universal Analytics and Facebook SDK are on by default. Testimonials are presented as a "feature" to turn on. The trap is that a SUD program can ship a Squarespace or Wix site and be non-compliant on day one, without realizing it. The rebuild was an opportunity to build the compliance posture into the architecture, not bolt it on at the end.

If you're reading this and your business has a regulated compliance posture (HIPAA, 42 CFR Part 2, GDPR, PCI, attorney-client privilege) and a page-builder site, the question is not "is the site working" — it is "is the site compliant, and would an audit show that." The rebuild is the right time to answer that question.

FAQ