Let’s start with the disclaimer, because it’s load-bearing.

We are a marketing studio. We are not lawyers, we are not compliance consultants, and we are not your licensing board. What follows is what we see break on therapy websites over and over, from people who build these for a living. It is not legal advice and you should not treat it as such.

With that said, most of what therapists worry about with HIPAA and their website is not the thing that actually goes wrong.

The good news, first

Your website itself usually isn’t the problem.

A page describing your specialties, your rates, your training, your general approach to anxiety? No protected health information anywhere. You could hand it to a stranger on the street. It’s marketing, and marketing is fine.

HIPAA only enters the room when your website starts collecting or transmitting information about actual people.

Which is a small number of places. So let’s go look at them.

1. Your contact form

This is the one that gets everybody.

A standard website contact form takes what someone typed, emails it to you, and very often stores a copy in your website’s database. Both of those are usually happening without encryption designed for health information.

And people will absolutely write things in that box. Not “I’d like to schedule a consultation.” More like their diagnosis, their medication, what happened last month, their custody situation. They’re not being careless. They’re reaching out for help and telling you why.

What to do: either use a HIPAA-compliant intake form from a provider who’ll sign a Business Associate Agreement, or make your website form genuinely minimal. Name, email, and a single line: “Please don’t include personal health details here. We’ll set up a secure way to talk.”

Then check whether your form plugin is storing submissions in your site database, because most of them do by default and nobody ever looks.

2. Where those notifications land

Related, and somehow even more common.

Your form sends a notification to an email address. Is that address on a HIPAA-compliant email service with a signed BAA, or is it a regular Gmail account you’ve had since 2015?

A regular consumer inbox is not built for this. Neither is your phone’s default mail app, sitting unlocked on the kitchen counter.

What to do: get form notifications going to a compliant inbox. Google Workspace can be configured with a BAA, but the free consumer version cannot. This is a settings problem with a real answer, not a rebuild.

3. Analytics and tracking pixels

Here’s the one almost nobody thinks about.

If you have a Meta pixel or Google Analytics on your site, those tools are collecting visitor behavior. Which pages someone viewed, how long they stayed, where they came from.

Now consider a page called /emdr-for-sexual-trauma/. A tracking pixel recording that a specific person, identified by their advertising ID, spent four minutes on that page is transmitting something that looks uncomfortably like health information to a third party you have no agreement with.

Federal regulators have taken an interest in exactly this pattern in healthcare over the last few years.

What to do: be deliberate about tracking on any page that could reveal why someone is there. Advertising pixels on treatment-specific pages deserve the hardest look. Basic analytics on your homepage or about page is a much smaller question than a Meta pixel on your trauma services page.

4. Chatbots and AI widgets

The newest one, and the one we’re seeing spread fastest.

A chat widget on your site invites visitors to type. Visitors will type anything. That conversation goes to a third-party service, gets stored somewhere, and may be used to train a model.

If you have not signed a BAA with that vendor and you don’t know their retention policy, you’ve built a place for strangers to disclose sensitive information into a system you don’t control.

What to do: if you want chat, use a vendor built for healthcare who will sign a BAA. If you’re using a general-purpose widget, at minimum configure the opening message to say not to share health details, and know where those transcripts live.

5. Testimonials and reviews on your site

Displaying client testimonials is where HIPAA meets your licensing board, and your board is often the stricter of the two.

Even a first name and city can identify someone in a small community. And publishing it confirms that person was in therapy.

We went deep on the ethics of this in our piece on Google reviews, including how to reply to reviews without accidentally confirming someone is your client.

The boring one that matters more than any of the above

Your site needs to be on HTTPS.

If a visitor’s browser says “Not Secure,” anything typed into any form is traveling unencrypted. It’s also a Google ranking factor and it makes people leave.

Certificates are free now. Most hosts will turn it on with one click. If yours won’t, that tells you something about your host.

What is genuinely not a problem

To save you some anxiety:

Writing blog posts about anxiety, trauma, or any clinical topic. Listing your specialties. Publishing your rates. Having a booking link to a compliant scheduler. Using a normal website builder. Displaying your credentials.

None of that touches protected health information. Publish freely.

The five-minute version

Look at your contact form and see what it’s storing. Check where notifications land. Look at what’s tracking on your treatment pages. Confirm HTTPS is on. If you have a chat widget, find out who runs it.

That’s most of the real risk, and none of it requires starting over.

If you want a look at what’s technically happening on your site, our free scan checks performance and setup and tells you what it finds. It won’t audit your compliance, but it will tell you if your site is slow, insecure, or invisible. No email required.

And when we build a site, we build with this in mind from the start, because retrofitting is always worse. Here’s how we work.

Saying it once more: we’re not lawyers. Every practice is different, and if you’re unsure about your specific setup, talk to someone qualified to advise you on it. This is what we see break, not what your attorney would tell you.