No redirect map
Ask one question before signing: when the new site launches, what happens to the old URLs? If the answer is vague, walk. Every page that had rankings and links needs a 301 redirect to its closest equivalent, and that map gets built before launch, not after traffic drops.
The pattern is always the same. A facility with years of accumulated organic traffic launches a prettier site, the old URLs return 404s, and six months of admissions calls disappear while everyone congratulates each other on the design.
Recovering from it takes longer than preventing it. The rankings do not automatically return when the redirects go up late, because the pages have already lost position to competitors who did not break anything.
SEO treated as an add-on
If the proposal has a line item for design and a separate optional line item for SEO, the site is being built wrong. URL structure, internal linking, page hierarchy, heading structure, and schema are design decisions. They cannot be bolted on afterward without rebuilding the thing.
The tell in the mockups is a single services page with everything on it. A treatment center needs a page per level of care it is licensed for, per condition it treats, and per location it operates, because that is how people search. One beautiful page cannot rank for detox, residential, PHP, and IOP at the same time.
Ask which pages the site will have and why. A designer who answers with a sitemap driven by search demand is doing the job. A designer who answers with "home, about, services, contact" is building a brochure.
No plan for patient information
A contact form on a treatment center site collects information about a person's health condition. Where does that data go? If the answer is "it emails the admissions inbox," ask whether that email is encrypted and whether the form vendor signed a business associate agreement.
Most general web designers have never heard of a BAA. That is not a moral failing, it is a sign they have not worked in healthcare, and it means the compliance question is going to land on you after launch when it is harder to fix.
The same applies to analytics and advertising pixels. HHS has published guidance on tracking technologies used by covered entities, and parts of it have been litigated, but the practical position has not changed: know what your tags collect on pages about health conditions and who receives it.
You do not own what you paid for
Registrar account, hosting account, CMS admin, Google Business Profile, Google Analytics, Google Search Console. All six should be in accounts your organization owns, with the agency added as a user. If any of them sit in the designer's account, you are renting your own site.
This is how bad relationships become permanent. Leaving costs a migration you cannot execute without cooperation from the person you are leaving. Get ownership sorted in the contract, before work starts.
Ask for an export path too. If the site is built in a proprietary builder that no other developer can take over, you have bought a permanent dependency. That may be fine, but it should be a decision rather than a discovery.
No number attached to the work
A designer who talks entirely about look and feel is telling you what they measure. Ask what the site is supposed to do. For a treatment center, the answer is phone calls from people who can admit, and the site either produces more of them than the old one or it does not.
That means call tracking configured before launch so you have a baseline, conversion tracking on forms and click-to-call, and a report that ties traffic to calls. If none of that appears in the proposal, nobody plans to be accountable for the outcome.
Good design matters here. A family in crisis at 11pm needs the phone number visible, the levels of care clear, and the page to load on a phone with two bars. That is a design problem. It gets judged by calls rather than by a portfolio shot.