This was not on my bingo card for this year, but I have now fallen far enough down the HIPAA-and-websites rabbit hole that I have strong opinions about Business Associate Agreements, tracking pixels, contact forms, and what exactly happens to the information someone puts into a website before they become a therapy client.
The more I work on websites and digital systems for therapy practices, the more I realize this is something practice owners need to understand at least a little bit. Not every therapist needs to become a cybersecurity expert by any means, and your website does not need to be locked down like a hospital database, but we need to start asking ourselves at least this question:
Where does information about a prospective or current client come into your website? And from there, where does it go? Who all has access to that information along the way?
This is where HIPAA becomes relevant to your site. Unfortunately, the answer is not always a simple one. It doesn’t matter if you have SSL or if your website company says they are secure because it’s up to you to make sure you’re compliant.
Does HIPAA even apply to your therapy practice?
Having a therapist practice does not automatically make you a HIPAA-covered entity. HIPAA applies to:
Health plans
Health care clearinghouses
Health care providers that conduct certain standardized financial or administrative health transactions electronically
This includes many psychologists, counselors, therapists, and group practices that bill insurance either directly or through another company. A provider does not become HIPAA-covered because they use email or have an electronic health record (EHR).
Even if your practice is not a HIPAA-covered entity under federal law, privacy still matters. Many state privacy laws, licensing requirements, professional ethics, contractual obligations, and other consumer-protection laws still apply. The Federal Trade Commission has made it clear that companies handling health information do not get a free pass simply because HIPAA don’t apply to them. In 2023, the FTC and HHS warned health organizations about privacy risks created by website tracking technologies, and noted organizations outside HIPAA can still have legal responsibilities.
If you’re genuinely unsure whether your practice is covered or not, that’s a question worth confirming with an attorney or lawyer. I’ve fallen into the HIPAA rabbit hole, but I’m certainly not able to give out legal advice!
Generally, if you are an insurance-based therapy practice, it’s reasonable to assume HIPAA is part of the picture.
What counts as PHI on a therapist’s website?
HIPAA protects protected health information, or PHI. HHS defines PHI as individually identifiable information relating to someone’s past, present, or future physical or mental health, the healthcare they receive, or payment for that care, when that information is held or transmitted by a covered entity or its business associate.
So, a person’s name isn't PHI everywhere it appears on the internet, and neither is an email address. But the context in which the information is used matters.
For example, if I submit a form to a therapy practice using my full name, “Amy Brown” and say on the form that I’m looking for help with panic attacks and want to use United Healthcare insurance, the practice I submitted this to now has enough identifying information to connect my mental health and insurance to my identity. Now, it’s PHI.
I think it’s useful to think in terms of where the data is going rather than memorize a list of what is or is not considered PHI. And, I also think it doesn’t make sense to remove the possibilities of collecting PHI on your website, because it can genuinely be useful information before a consultation call or first appointment.
What we should ask is:
What information does my website collect?
What could it reveal about the person submitting the form?
Where does the data go?
What companies have access to the data?
Your website is not automatically a HIPAA problem
I do want to clarify that your ordinary public-facing content, like therapist bios, service descriptions, office hours, rates, articles, location pages, and more, is generally just public website content. There has been recent debate about whether IP addresses, combined with a visit to a particular health-related webpage, automatically become PHI. For now, it is not considered PHI.
So, someone reading a page about trauma therapy does not mean the analytics data generated by the visit is PHI, but it also does not mean analytics and tracking technology can be ignored. The situation will change if the website starts collecting information that is connected to an individual’s health care or request for care.
Most therapy-practice websites do exactly that somewhere on their site, and for good reason.
The first place to look: contact forms
A basic contact form seems harmless because every business has one. However, for a therapy practice, people may share information that qualifies as PHI. For example, if you ask a question like, “Tell us what you’re looking for help with,” and someone answers with detailed information about what exactly they are struggling with, you now have identifiable mental-health information.
It’s okay to collect this, and useful in many cases, but you have to collect it properly. Whenever you collect that data, you need to know where you store the submission, how you transmit it, who can access it, whether third-party plugins receive it, and whether the vendors handling it will enter into an appropriate Business Associate Agreement.
Even the boring contact us form you put on your site 6 years ago is something you should probably review.
Collect less information when you can
One of the best website privacy strategies is also one of the least exciting: Do not collect information you do not actually need right away.
HIPAA’s Privacy Rule generally incorporates a “minimum necessary” principle, requiring covered entities to make reasonable efforts to limit PHI uses, disclosures, and requests to what is needed for the purpose.
That principle is useful for website design even beyond the situations in which the formal minimum-necessary rule applies. Your initial contact form does not need someone’s life story. It probably does, however, need:
Their name
Contact information
A general idea of what they need
Insurance or payment information (at least an initial idea of how they plan on paying)
Preferred format
Enough information to get them to the right therapists
The clinical history can wait for the EHR. Your website does not need to become that EHR.
A “HIPAA-compliant platform” does not mean every feature is automatically safe to use
This is one of the most important, and also most anxiety-inducing, things I have learned.
A company may offer HIPAA-supporting services and still have products, plugins, apps, or features that are outside the scope of its BAA.