It’s one of the first questions therapists ask about their website: does it need to be HIPAA compliant?
The honest answer is that the question is slightly the wrong shape. A website isn’t “HIPAA compliant” or not, the way a light is on or off. What matters is whether any part of it collects or sends private health information, and if it does, whether the company handling that information has agreed to protect it.
We don’t give legal advice, and this isn’t a legal checklist. It’s a plain explanation of where the risk actually sits, so you can find it on your own website and fix it.
The short version
- A website that only describes your practice (who you are, who you help, your fees, a booking button) usually holds no health information. That part isn’t the issue.
- The parts that collect things are. Contact forms, intake forms, chat boxes, “request an appointment” forms, and tracking or advertising tools.
- If any of those collect health details, the company behind them should sign a business associate agreement with you, or they shouldn’t collect health details at all.
Who HIPAA applies to
HIPAA covers health care providers who send health information electronically for things like insurance claims. In the words of the federal Medicare agency, providers who submit HIPAA transactions, like claims, electronically are covered. Most therapists who take insurance, or use a system that sends claims for them, fall into that group.
If you’re private pay only, HIPAA may not apply to you in the same way. But your clients don’t know that, and they expect the same privacy either way. Your ethics code and your state’s privacy laws may expect it too. So the practical advice in this article is the same whether HIPAA strictly applies to you or not. If you’re unsure which group you’re in, check with your compliance advisor.
What a “business associate agreement” is
When a company handles health information for you, HIPAA expects you to have a written agreement with them. The U.S. Department of Health and Human Services (HHS) says covered providers generally need contracts with their business associates so those companies protect the information properly.
Your booking or records system very likely offers one. Most systems built for therapists do, so check your account settings or ask their support. Many website builders and form tools don’t, or only on certain plans. For example, Squarespace says its own form blocks can’t be used as part of a HIPAA-compliant solution. (We compare the options in Squarespace for therapists.)
That’s the whole puzzle in one line: health details should only go to companies that have agreed in writing to protect them.
Where health information sneaks onto a therapist website
1. Contact forms
The most common one. A box that says “Tell us what brings you in” invites people to write about panic attacks, a divorce or a diagnosis. That message then sits in whatever form tool you use. We wrote a whole article on this: Is your contact form a HIPAA risk?
2. Intake and “request an appointment” forms
Forms that ask about symptoms, medications, insurance member IDs or reasons for therapy belong in your booking or records system, not on your website. Your website should link to them.
3. Chat boxes and “text us” widgets
A friendly chat bubble in the corner can collect exactly the kind of message you’d never want in a generic inbox. If you use one, check who stores the messages and whether they’ll sign an agreement.
4. Tracking and advertising tools
This is the one most practices don’t know about. Many websites have small bits of code from advertising or analytics companies that report what visitors do.
In 2022, HHS published a bulletin warning health providers about these tools, and updated it in 2024. It says tools on pages behind a login generally have access to health information, and that tools on public pages can too, for example when they pick up someone’s email address or the reason they’re seeking care while they book. When that happens, HHS expects a business associate agreement with the tracking company.
In June 2024, a federal court in Texas struck down one part of that bulletin: the idea that a tracking tool simply noting someone visited a public page about a condition is, by itself, health information (American Hospital Association v. Becerra). The rest of the bulletin still stands, including the parts about forms and pages behind a login.
Two practical points:
- Google says it doesn’t offer a business associate agreement for Google Analytics and makes no claim that it meets HIPAA (Google’s own help page). So it should never receive health details.
- Regulators outside HIPAA care too. In 2023, the Federal Trade Commission ordered the online counseling company BetterHelp to pay $7.8 million for sharing health questionnaire answers with advertisers like Facebook after promising to keep them private.
The simplest approach for a small practice: no advertising trackers at all, and if you want to know how many people visit, a privacy-friendly visitor counter that doesn’t follow anyone around.
5. Email
Messages from your website usually arrive by email. If a form does collect health details, those details are now in your inbox too. Another reason to keep forms short.
A 10-minute check you can do yourself
Open your own website on your phone and go through this list:
- Contact form: does any field ask what someone is going through, their symptoms or a diagnosis? Dropdowns and checkboxes count.
- Is there a note under the form asking people not to include health details?
- Intake: do intake or consent forms live on your website, or in your booking system? They belong in the booking system.
- Chat: is there a chat bubble or “text us” button? Who stores those messages?
- Booking: does your “Book now” button go to your booking system? Good. That’s where details should be shared.
- Trackers: did anyone add Google Analytics, a Facebook or Meta pixel, or ad tracking? If you’re not sure, ask whoever built the site.
- Agreements: for every tool that might receive health details, do you have a signed business associate agreement? If not, remove the tool or stop it collecting those details.
- Pages behind a login: if your website has a client login area, make sure no tracking tools run inside it.
If any answer worries you, it’s usually an easy fix: shorten the form, remove the tracker, move intake into your booking system. If you’d like a second opinion, our free website check looks at your forms and tracking tools from the outside and tells you what we find, in plain words.
How we handle this on Stepflow websites
We build every website so this question mostly goes away:
- No client information is stored on the website. Booking, intake and records stay in your booking system.
- Contact forms ask only for a name, an email and a short message, with a gentle note not to include health details.
- No tracking cookies or advertising tools. Visitors aren’t followed around the internet because they looked at a therapist’s website.
You can read all 12 protections on our security page. If you’re on SimplePractice’s built-in page and want something fuller, here’s how it compares: the SimplePractice website vs a website you own.
None of this replaces advice from your compliance advisor about your practice as a whole. But it means your website is the easy part.