Almost every therapist website has the same form on it. Name, email, phone, and a big text box that says something like "What brings you to therapy?" or "Tell me a little about what you're looking for."
You probably don’t realize it, but that box might be a problem. The moment someone types "I've been having panic attacks since my divorce" into it, your website is handling protected health information. And on most of the sites I audit, nobody ever asked where that information goes next.
I check this on every therapist site I work on, and most of them fail at least one of the questions below. Not because the therapist was careless, but because the form came with the template, it looked fine, and no one told them to think any more about it.
So here's the check I run. It takes about two minutes. Pull up your own site in another tab and go down the list.
(Quick note: I'm a web designer, not a lawyer, and this is general information, not legal advice. If any of this makes you nervous, the fixes are at the bottom, and I'll check your form for free if you'd rather not do it alone.)
First: does HIPAA even apply to you?
Probably, but it's worth knowing why. HIPAA covers healthcare providers who send health information electronically for things like insurance claims and eligibility checks. If you bill insurance electronically, or your EHR or billing service does it for you, you're covered. If you're a cash-only practice that never files a claim, you may not technically be a "covered entity."
Here's why that doesn't let you off the hook. California's medical privacy law (the CMIA) applies to you either way. Your licensing board's confidentiality rules apply either way. And your clients assume the thing they typed into your website is private, either way. So build the form as if HIPAA applies. The fixes are cheap, and the alternative is explaining to a client why their intake note ended up in a Mailchimp list.
The 8-point check
1. Does your form ask why they're reaching out?
If there's a free-text box inviting people to describe their situation, you're collecting health information. Name and email alone is contact info. "What brings you to therapy?" is a clinical disclosure. Everything else on this list only matters if you answered yes here, so if your form is just name, email and phone, you can stop reading and go have a nice day.
2. What's the form built with?
The forms that come built into Squarespace, Webflow and WordPress are not HIPAA compliant, and the companies won't sign a Business Associate Agreement for them. Squarespace says it plainly in its own help center: Acuity Scheduling is the only Squarespace product designed for HIPAA, and you shouldn't send health information through any other part of the platform. Wix is the exception, and only since April 2026: on a Premium or Studio plan you can turn on "PHI protection" and sign a BAA inside your account. If you're on Wix and haven't done that, your form is in the same boat as everyone else's.
3. Has the company behind the form signed a BAA with you?
A Business Associate Agreement is the contract that makes a vendor legally responsible for protecting health information on your behalf. No BAA, no compliance, no matter how secure the tool says it is. If you're using Hushmail, Jotform, Google Workspace or IntakeQ, there's a BAA to accept somewhere in your account, and "somewhere" is the catch. Several of my clients were paying for a HIPAA-capable tool and had never clicked the button. Find yours. Know where it is.
4. Where do the submissions get emailed?
This is the one that trips up people who got everything else right. Your compliant form sends a notification to… where? If it lands in a personal Gmail, a Yahoo address from 2009, or your practice email on a free Google account, the chain is broken. A personal Gmail address cannot be covered by a BAA at all. The inbox has to be covered too: Hushmail, a paid Google Workspace account with the BAA accepted, or your EHR's messaging.
5. Does the notification email include what the person wrote?
Most form tools, including Squarespace's, email you the full submission. That means the panic-attacks-since-the-divorce sentence is now sitting in an email, which is a second copy in a second place. The compliant tools either send you a "you have a new submission, log in to read it" notice or send the content only inside a covered account. Check what your notification actually looks like. If the client's words are in the email body and that inbox isn't covered, that's a no.
6. Is the submission stored anywhere else?
Forms love to be helpful. Squarespace can save submissions to a Google Sheet or Mailchimp. Zapier can pipe them anywhere. Your form plugin keeps a copy in the WordPress database. Every one of those is another place health information lives, and every one needs to be covered or turned off. The cleanest setup is a form whose submissions live in one covered place and nowhere else.
7. Does your booking tool sign a BAA?
If "contact me" on your site is really "book a consult," the booking tool is a form too, and the same rules apply. Calendly does not sign BAAs, and its own help pages say it isn't designed to collect health information, so a Calendly link with a "what would you like to discuss?" field is a problem. Acuity does sign one on its Premium plan. Your EHR's client portal (SimplePractice, TherapyNotes, Jane) is already covered by the BAA you signed when you set it up, which is why linking straight to it is often the easiest fix.
8. Is the inbox where replies land covered?
You wrote back. Now there's a conversation about their mental health happening over email. If that's a paid Google Workspace account with the BAA accepted, or Hushmail, you're fine. If it's a personal address, see question 4. People forget that the form is only the first message.
If you answered "no" to any of these
Good news: every one of these is a known fix, and none of them require rebuilding your site. Here's what I actually set up for clients, roughly in order of how often I reach for it:
Hushmail for Healthcare. Built for therapists. The Starter plan ($11.99 a month) gets you encrypted email plus two secure web forms, with a BAA included. One subscription fixes the form, the notifications and the inbox at once. This is my default for a solo practice.
Google Forms, if you already pay for Google Workspace. Google's BAA covers Forms, Gmail, Drive and Calendar on any paid Workspace plan, including Business Starter at $7 a month. Accept the BAA once in the Admin console, build the form, embed it in your site. Nothing extra to buy. The catch is that everything has to stay inside that Workspace account. No forwarding to a personal address, no piping to tools that aren't covered.
Jotform on the Gold plan ($99 a month billed annually). The most flexible option, with logic, uploads and e-signatures, and HIPAA is included. Priced for group practices.
Link to your EHR's portal instead. If you already pay for SimplePractice or TherapyNotes, point your "request a consult" button at its client portal and delete the website form entirely. Already covered, and the information lands where you'll use it.
Acuity Premium ($61 a month) if you want HIPAA-compliant booking on the page itself.
Or just remove the box. The simplest fix of all: take the free-text question off your form. Name, email, phone, and a note that says "I'll reach out to set up a free call." You lose a little context and gain a form you don't have to think about.
One thing to check before you pick: how the form embeds. A simple embed code through Squarespace's Embed block works on every plan. Embeds that rely on JavaScript in a code block need the Core plan or higher. Most tools offer both.
Want me to check it for you?
If you went down this list and aren't sure about one or two of the answers, that's normal. Half of these only show up when you look inside the settings, and the settings are in four different places.
Send me your website and I'll check your contact form on a free 15-minute call. I'll tell you exactly which of the eight you pass, which you don't, and the cheapest way to fix it.
