Does a Therapist Website Need to Be HIPAA Compliant?
· 5 min read · Therapist SEO Company editorial team
Not all of it. A brochure website, meaning pages that describe your practice and collect nothing, is not itself a HIPAA system. The parts that collect, store or send health information are a different matter: contact forms that invite people to describe what's going on, intake and booking tools, client portals, and possibly the tracking scripts that load on your pages. Those need the same care as the rest of your records. This is general information, not legal advice, and the details depend on your practice.
One question comes before the others: whether your practice is a HIPAA covered entity at all. That depends on things like how you bill, and it's a question for a compliance advisor rather than a website post. Even where HIPAA doesn't apply, your ethics code still requires you to protect confidentiality, and many states have privacy laws of their own, so the steps below are worth taking either way.
A practical way to look at a practice site is in three zones.
Zone one: pages that only publish
Your home page, specialty pages, bios, fee page, blog posts and contact details. They describe the practice and take in nothing from visitors. Text about your services isn't health information about anyone.
What matters on these pages is accuracy, under your code's advertising standards, and one notice. If you see uninsured or self-pay clients, the No Surprises Act has required since January 1, 2022 that you give them a Good Faith Estimate and post a notice about the right to one in your office and prominently on your website.
These pages can still leak information indirectly, through the scripts that load on them. That's zone three.
Zone two: places that collect
Anywhere a visitor types or uploads something: the contact form, a booking widget, an intake packet, a client portal, a chat box.
Contact forms cause the most trouble. A form with a large "How can we help?" box invites people to write about symptoms, history or medication. That text then sits in your email inbox and in the form provider's database. A safer form asks only what you need to reply:
- Name
- Email address
- Preferred way to be contacted
- In person or telehealth
- Insurance or private pay
- How they heard about you
Then add a plain line above the submit button: "Please don't include health details in this form. We'll talk about what brings you in by phone or through our secure intake." The actual intake, with history and consent forms, belongs in a system built for it, such as your practice management or EHR platform, set up under a business associate agreement.
People will still sometimes write more than you asked for. Treat any inbox that receives form submissions as if it could hold health information, and choose that email service with that in mind.
Two more lines belong near the form. One says when you reply, for example within one business day. The other says the form isn't monitored for emergencies and points to 911 and to 988, the Suicide and Crisis Lifeline. If the form sends an automatic reply, keep it short, repeat both lines, and don't copy the visitor's message back to them, so whatever they wrote doesn't travel by email a second time.
Booking widgets and chat boxes belong in this zone too. A scheduling tool that asks for a "reason for visit", or a chat widget that stores transcripts with a third party, is collecting information that may need protecting.
Business associate agreements
Under HIPAA, a vendor that stores or handles protected health information for a covered entity is a business associate and needs a business associate agreement (BAA) with you. For a therapy website, the vendors to think about usually include:
- the form provider, if forms might receive health information
- the email service where form submissions land
- the scheduling, intake or portal platform
- any chat or messaging tool on the site
Ask each one directly whether they sign a BAA, and on which plan. Some offer it only on a higher tier, and a website builder's standard form may not be covered at all. If a vendor won't sign one, keep health information out of that tool entirely, which usually means changing what the form asks.
Zone three: things that watch
Analytics tools, advertising pixels, session-recording scripts, embedded maps and videos, and chat widgets all send data about the visitor to a third party: at minimum an IP address and the page being viewed, sometimes much more. On a therapy site, "this visitor read the page about eating disorders and then opened the contact form" can be sensitive on its own.
HHS issued guidance on online tracking technologies for HIPAA-regulated entities in 2022 and updated it in 2024. Later in 2024, a federal court vacated part of that guidance. Where things stand for a particular script on a particular page is a question for your compliance advisor. The guidance is on the HHS website, with notes on what changed.
A cautious approach holds up however the legal questions settle:
- Keep advertising pixels off specialty pages, forms and any page shown after a form is sent.
- Don't run session-recording tools on pages that have forms.
- If you use analytics, choose a setup that doesn't record form contents or tie visits to identifiable people, and ask the vendor about a BAA.
- Make an inventory. Load each main page with your browser's developer tools open, or ask whoever maintains the site, and list every third-party domain the page contacts. Themes, templates and plugins sometimes add scripts that nobody chose on purpose.
A short checklist
- The contact form asks practice-level questions only and carries a "no health details" line.
- Intake happens in a platform covered by a BAA.
- Every vendor that might receive health information has signed a BAA, or receives none.
- No advertising pixels or session recording on specialty pages or forms.
- A current list of the third-party scripts on the site.
- A Good Faith Estimate notice posted, if you see uninsured or self-pay clients.
- A plain privacy page that says what the site collects and where it goes.
Again, this is general information. HIPAA, state privacy laws and your ethics code may apply to your practice in ways a general article can't settle. Your compliance advisor, your malpractice carrier's risk management service or your professional association can help with specifics.
If you're planning a new site or rebuilding an old one, these are much easier to settle before launch than to untangle later. Our page on therapist website design covers how we build practice sites, starting at $400.