Here’s a contact form you’ve probably seen on a lot of therapist websites. Maybe on your own:
Name · Email · Phone
Tell us a little about what brings you in
It looks friendly. It’s meant to be. But that last box can create a privacy problem most practices don’t know they have.
We don’t give legal advice, and this isn’t a list of rules. It’s a plain explanation of the risk, and an easy way to avoid it.
The problem, in plain words
When someone fills in that box, they often write a lot. “I’ve been having panic attacks since my divorce.” “My teenage son is self-harming.” “I was diagnosed with PTSD last year.”
That’s private health information. And it doesn’t go straight from their phone to you. It goes through whatever tool powers your contact form first: a form add-on on your WordPress site, the built-in form on your website builder, or a separate form service. Often it’s stored there too, sometimes for years, in an account you’ve never looked at.
HIPAA expects health providers to protect this kind of information, and to only share it with companies that have agreed in writing to protect it too (a “business associate agreement”). Many generic form tools and website builders don’t sign one, or only on certain plans.
So a well-meaning question on your website can mean sensitive health details are sitting with a company that hasn’t agreed to protect them the way HIPAA expects. That can raise HIPAA concerns. It’s an easy mistake, and an easy one to fix.
It’s not only the big box
A few other places health information can slip in:
- Dropdowns and checkboxes. “What are you seeking help with? ☐ Anxiety ☐ Depression ☐ Trauma” is health information too.
- Insurance details. A form that asks for member IDs alongside a reason for reaching out.
- “Request an appointment” forms that collect intake-style questions before someone has booked.
- Tracking tools. Some websites send visitor information to advertising companies. On a therapist’s website, even knowing someone visited a page about a specific condition can be sensitive. The federal health department has warned providers about this.
What to ask instead
Your contact form only needs enough to reply. That’s it:
- Name
- Email (and a phone number, if you like)
- A short message, with a gentle note underneath:
Please don’t include health details here. We’ll reply within [your usual response time] and can talk more on a private call.
That’s warm, it’s clear, and it keeps the conversation safe. People who want to share more can do so on a consultation call, or in your proper intake process.
Some practices skip the contact form entirely and send people straight to booking a free consultation call in their booking system. That works well too.
Keep intake where it belongs
Intake forms, questionnaires, insurance details and consent forms belong in your booking or records system: SimplePractice, TherapyNotes, Jane, Headway, Alma, Zocdoc or whatever you use. These systems are built for health information, and they usually sign a business associate agreement with you.
Your website’s job is simply to link to them. A clear Book now button on every page does it.
Questions to ask your web person
If someone else built your website, send them these:
- What tool powers our contact form, and where are messages stored?
- Does that tool sign a business associate agreement with us?
- Does any form on the website ask about symptoms, diagnoses or reasons for therapy?
- Are there any tracking or advertising tools on the website?
- Can we change the form to ask only for a name, email and short message?
If the answers are unclear, check with your compliance advisor.
How we build contact forms
Our contact forms (when you want one) ask only for a name, an email and a short message, with a gentle note not to include health details. Messages go straight to your inbox and nothing is kept on the website. There are no tracking cookies or ad tools. Intake stays in your booking or records system. It’s one of the 12 protections built into every website we build.
For the bigger picture, read does a therapist website need to be HIPAA compliant?
Where to go from here
- Look at your own contact form today. If it asks people to describe what they’re going through, that’s the box to change.
- Read 12 protections built into every website we build.
- Or get a free website check. We’ll tell you what your forms ask for, what your website is built on, and anything else that might be costing you clients.