The more I work on websites and digital systems for therapy practices, the more I realize this is something practice owners need to understand at least a little bit. And, I also realize this is probably the last thing someone opening a practice really wants to dive into. When you set up a website for your private or group practice, you’ll hear things like:
Make sure your website has SSL
Use a HIPAA-compliant form
Get a BAA
Don’t use Google Analytics
Some of this advice is useful, some is incomplete, and absolutely none of it is particularly helpful if you don’t understand where client information actually moves through your website.
Ultimately, when you’re working on your website as a therapist, you need to be asking yourself this question: Where can someone give me information, where does that information go, and who has access to it along the way?
You don’t need to become a cybersecurity expert to ask this question, but your website is one of the first places a prospective client will interact with your practice today. It’s worth knowing what is happening behind the scenes.
TLDR: Download the HIPAA Checklist
First: not every therapist is automatically covered by HIPAA.
HIPAA applies to health plans, clearinghouses, and health care providers that conduct certain standardized transactions electronically. Many therapy practices are covered entities, especially those that bill insurance electronically, but simply being a therapist does not automatically make you subject to HIPAA.
However, even if HIPAA does not apply, privacy still matters. State laws, licensing requirements, ethical obligations, contracts, and other privacy laws may still apply.
If you are not sure whether your practice is a HIPAA-covered entity, clarify that separately with a legal advisor or attorney. For the rest of this article, I am talking about practices that are operating under HIPAA.
What counts as PHI on a therapist’s website?
HIPAA protects protected health information, or PHI. HHS defines PHI as individually identifiable information relating to someone’s past, present, or future physical or mental health, the healthcare they receive, or payment for that care, when that information is held or transmitted by a covered entity or its business associate.
So, a person’s name isn't PHI everywhere it appears on the internet, and neither is an email address. But, here’s where context matters, and how that information is used also matters.
For example, if I submit a form to a therapy practice using my full name, “Amy Brown” and say on the form that I’m looking for help with panic attacks and want to use United Healthcare insurance, the practice I submitted this to now has enough identifying information to connect my mental health and insurance to my identity. Now, it’s PHI.
I think it’s useful to think about where the data is going rather than memorizing a list of what is or isn't considered PHI. And I don't think it makes sense to remove the possibility of collecting PHI on your website, because it can be genuinely useful information before a consultation call or first appointment.
What we should ask is:
What information does my website collect?
What could it reveal about the person submitting the form?
Where does the data go?
What companies have access to the data?
Your website is not automatically a HIPAA problem
I do want to clarify that your ordinary public-facing content, like therapist bios, service descriptions, office hours, rates, articles, location pages, and more, is generally just public website content. There has been recent debate about whether IP addresses, combined with a visit to a particular health-related webpage, automatically become PHI. For now, it is not considered PHI.
So, someone reading a page about trauma therapy does not mean the analytics data generated by the visit is PHI, but it also does not mean analytics and tracking technology can be ignored. The situation changes if the website starts collecting information connected to an individual’s health care or request for care. Most therapy websites do start collecting that information somewhere on their site because the website is ultimately meant to help people find the right care and reach out for care. It’s not wrong to have that on the website, but it is important to be careful how that information is collected, and what information is collected.
The first place to look: contact forms
A basic contact form seems harmless because every business has one. However, for a therapy practice, people may share information that qualifies as PHI. For example, if you ask a question like, “Tell us what you’re looking for help with,” and someone answers with detailed information about what exactly they are struggling with, you now have identifiable mental-health information.
It’s okay to collect this, and useful in many cases, but you have to collect it properly. Whenever you collect that data, you need to know where you store the submission, how you transmit it, who can access it, whether third-party plugins receive it, and whether the vendors handling it will enter into an appropriate Business Associate Agreement.
Even the boring contact us form you put on your site 6 years ago is something you should probably review.
Collect less information when you can
One of the best website privacy strategies is also one of the least exciting: Do not collect information you do not actually need right away.
HIPAA’s Privacy Rule generally incorporates a “minimum necessary” principle, requiring covered entities to make reasonable efforts to limit PHI uses, disclosures, and requests to what is needed for the purpose.
That principle is useful for website design even beyond the situations in which the formal minimum-necessary rule applies. Your initial contact form does not need someone’s life story. It probably does, however, need:
Their name
Contact information
A general idea of what they need
Insurance or payment information (at least an initial idea of how they plan on paying)
Preferred format
Enough information to get them to the right therapists
The clinical history can wait for the EHR. Your website does not need to become that EHR.
When it comes to vendors, a “HIPAA-compliant platform” does not mean every feature is automatically safe to use
This is one of the most important, and also most anxiety-inducing, things I have learned. A company may offer HIPAA-supporting services and still have products, plugins, apps, or features that are outside the scope of its BAA. That means when you work with vendors, you have to really vet them, especially if they come in contact with any PHI. You need to ask:
Is the product I am using allowed to handle PHI?
If yes, will the vendor enter into a BAA when one is required?
For a deeper explanation of what a BAA actually is, who needs one, and why signing one isn’t magic compliance, you can read the article I wrote about that subject here.
Analytics deserve more attention than they usually get
Most websites use some form of analytics. People want to understand if people are finding the site and whether the site is actually working. I use analytics for my clients and myself as well. But when it comes to mental health websites, it deserves more thought before we install and start using every tracking tool.
Google Analytics, advertising pixels, cookies, session replay, and other technologies can collect information about how someone is using a website. Depending on the implementation, they may get things like IP addresses, page information, device details, form events, URLs, or other data.
Pageviews are not PHI, but if tracking tools start receiving and collecting information that can be connected to an identifiable person and their request for care, that changes things.
You likely need a Notice of Privacy Practices and a website privacy policy
Surprisingly, these are not the same document! A HIPAA Notice of Privacy Practices (NPP) explains how a practice uses and discloses PHI, what rights clients have, and what responsibilities the practice has. A website privacy policy explains what the website itself collects through tools like forms, cookies, analytics, mailing lists, or other online services.
A covered provider that maintains a website that talks about services in general needs to make its NPP available on the website. If the site uses analytics, cookies, or any data-collection technology, a separate website privacy policy also makes sense. These policies should describe what your practice and website actually do.
Other things to consider
SSL
Your website should absolutely use HTTPS. That little lock in the browser means information is encrypted when it travels between the visitor and the website, which is good. But what happens after that information reaches you matters just as much.
HIPAA doesn’t prohibit communication by email, but there’s an important difference between corresponding with a client and then building a website form that sends detailed mental-health information through an email workflow every time someone contacts the practice. The email notification should only say “You have a new inquiry” and then your therapists can access the actual protected information inside the secure system. This can help control where PHI goes and how exposed that information is. This is something I learned while working on the referral flow tool that I’m working on.
Web Developers or Third-Party Vendors
When people access your data, they may need a BAA. For example, if someone rewrites the service pages, changes the designs, or works only with public website content, they don’t become a business associate immediately. However, if they can access your database or form submissions and can look at PHI while troubleshooting anything, that is different.
This should be discussed before the website work begins. Does the developer need access to PHI? Or will the developer inherently get access to PHI by working on your website? If yes, the relationship may require a BAA.
This also applies for any plugins, integrations, and automations.
Plugins, Integrations, and Automations
If you’re using modern tools, it is likely that you are using some sort of integration, plugin, or automation. One of your forms might connect to an email platform, or an email platform may connect to a CRM, or it may connect to an automation service. Your automation may send information to a spreadsheet. Typically, information travels through multiple companies. Integrations and automations are great in some ways, because they can make practices easier to run. But you should pay attention to where your data is going and what data is traveling where.
Your Website is Part of the Care System
If you’re a therapist or a private practice, your website could be the first step in someone’s process of finding care. They are looking at therapists, insurance options, and may even disclose something about themselves and take a risk, pressing Submit.
The technology underneath that experience matters, and how you store and protect their data is part of their experience.
Frequently Asked Questions
Does a therapist's whole website have to be HIPAA compliant?
Not every piece of public website content involves PHI. The areas that generally deserve the most attention are the places where identifiable health or care-related information is collected, stored, transmitted, or shared with other systems.
Can therapists use online contact forms?
Yes, but if the form may collect PHI, the practice should understand how that information is transmitted, stored, accessed, and shared and whether the vendors involved need Business Associate Agreements.
Can a therapist use Google Analytics?
Potentially, but HIPAA-regulated practices need to be careful about what information Google receives. Google does not offer a BAA for Google Analytics. Read the full guide to GA here.
Does my website need a Notice of Privacy Practices?
If your practice is a HIPAA-covered entity and maintains a website describing its services, the Notice of Privacy Practices generally needs to be prominently available on the site. Read my full guide to Notices of Privacy Practices here.
What is a BAA?
A Business Associate Agreement is a HIPAA-required contract used when certain outside vendors or service providers create, receive, maintain, or transmit PHI on behalf of a covered entity. Read more about BAAs here.
This article is intended as practical educational information and is not legal advice. HIPAA applicability and compliance depend on the specific practice, technology, data flows, vendors, contracts, and applicable state and federal law.