Does your therapy website need to be HIPAA compliant?
Mostly asked, rarely answered plainly: a brochure-style practice website is usually not where HIPAA lives — but two specific things can drag it into scope, and both are common. Here's the honest map. (This is practical guidance, not legal advice; your situation may differ.)
Where HIPAA actually attaches
HIPAA governs protected health information handled by covered entities and their business associates. Your website describing your practice, listing fees, and showing your photo involves no PHI. The moment the site collects health information from identifiable people— detailed intake questionnaires, symptom checklists, scheduling flows that capture diagnoses — it's handling PHI, and every vendor in that path needs to be treated accordingly.
The two real risks on a therapist's site
1. Advertising trackers
The enforcement wave of the last few years wasn't about contact forms — it was about ad pixels on health pages, where a visitor's browsing itself (reading your "EMDR for trauma" page, then clicking "book") reveals health information to an ad network. The fix is simple: no Meta pixel, no ad-network retargeting on your practice site, and analytics that count visits without identifying visitors.
2. The contact form that grows into a chart
Forms drift. A "what brings you here" box becomes a symptom questionnaire; email replies become a therapy thread. Keep the website form a doorway: minimal fields, a clear not-for-emergencies note with the 988 line, and move every clinical conversation into your EHR the moment someone becomes a client. If you want detailed intake paperwork online, run it through your EHR's HIPAA-covered forms, not your website builder.
The clean setup, in one list
- Brochure site + minimal consult-request form → website builder.
- Clinical intake, scheduling with health detail, session notes → EHR (with its BAA).
- No ad pixels; privacy-first, cookie-free analytics.
- A privacy policy that truthfully describes the little your site collects.
- 988 notice near every contact point.
Common questions
Is a marketing website itself covered by HIPAA?
A brochure site that describes your practice and takes a 'request a consult' message from a prospective client is generally not where PHI lives — HIPAA attaches to protected health information handled by covered entities. The risk starts when your site collects or leaks health information: intake questionnaires, session scheduling with clinical detail, or ad trackers watching visitors on health pages.
What was the tracker problem everyone heard about?
Regulators and litigation targeted hospitals and health sites that ran advertising pixels (Meta, Google) on pages where visitor behavior could reveal health conditions. The lesson for therapists: don't put ad pixels on your practice site, and prefer analytics that don't identify visitors.
Do I need a BAA with my website provider?
You need a BAA with any vendor that handles PHI for you — your EHR, absolutely. For a website vendor it depends on whether the site touches PHI: if your contact form is a minimal consult request and clinical conversation happens in your EHR and secure email, the website vendor typically isn't handling PHI. If you run intake questionnaires through the site, treat that vendor as a business associate and get the BAA.
What should my contact form ask?
Name, email or phone, and an open 'what brings you here' box — with a visible note that the form isn't for emergencies (988) and isn't a secure channel for clinical detail. Keep it a doorway, not a chart.
A practice site that stays in its lane
Answer six questions and watch one of 150 hand-crafted templates become your site — live on a free subdomain, yours to edit forever. Free to start, no card.
Build my site free →