You've probably seen the phrase "HIPAA-compliant website" in a proposal somewhere. It's a good sales line. It's also, in most of the ways it gets used, not quite true — and you're the one who deserves the honest version, since you're the one whose license is on the line if something goes wrong.
The Boundary Nobody States Plainly
HIPAA compliance isn't a feature you install. It's a set of administrative, physical, and technical safeguards around how protected health information is created, stored, and transmitted — and a public marketing website, built and used correctly, generally shouldn't be touching protected health information at all.
That's the actual answer, and it's better news than it sounds like. A website that never collects, stores, or transmits PHI has a much smaller compliance surface to worry about, because the risk it needs to manage is narrower.
So when someone sells you a "HIPAA-compliant website," what they usually mean — and what they should say plainly — is a website built with HIPAA in mind: structured to keep patient information off the public-facing site entirely, so the compliance burden sits where it belongs, in your practice management and EHR systems, not scattered into a contact form nobody thought carefully about.
What a Website Can Actually Guarantee
A contact form with no clinical fields. Name, email, phone, a general message box. Nothing asking about symptoms, diagnoses, or treatment history. If a form on your site is asking "what brings you to therapy" with an open text field, that's PHI being collected and stored somewhere, and that's the actual risk — not the hosting provider, not the SSL certificate.
A booking flow that routes to your EHR, not a generic calendar tool. The scheduling itself should hand off to the system actually built to handle clinical scheduling securely, not live inside a marketing site's plugin.
No third-party scripts logging more than they should. Analytics tools, chat widgets, and marketing pixels can inadvertently capture form data. A site built carefully audits what's actually running and why.
Encrypted transmission (SSL) as a baseline, not a selling point. This is table stakes in 2026 — every legitimate site has it. If it's being sold to you as a premium compliance feature, that's a sign the rest of the pitch may be inflated too.
How easy it is to actually hold this boundary depends a lot on what you're building on. (We compared WordPress, Squarespace, Wix, and Astro on exactly this.)
What No Website Can Guarantee
No web designer, however good, can make categorical claims about your organization's HIPAA compliance as a whole. That determination involves your policies, your staff training, your business associate agreements, your practice management system — most of which has nothing to do with the public website at all.
Be cautious of anyone who states otherwise in writing. It's not just imprecise, it's a liability for both of you if it's ever tested.
How to check if your therapy website is HIPAA compliant
I'm not a lawyer, and this isn't legal advice. What follows is the checklist I run on every therapist site before I touch it. If something here worries you, it's worth a conversation with your compliance advisor.
1. Read your contact form like a stranger would.
Look for a field that asks "What brings you here?" or "Tell me what's going on." If it's there, you're collecting health information through a website form, and it's sitting in whatever inbox or database that form sends to. The fix is simple: ask for name, email and phone, and nothing else. The clinical conversation belongs in your first session or inside your practice software.
2. Follow where the form goes.
Submit a test message and watch where it lands. A free Gmail account isn't covered by a Business Associate Agreement (BAA). Google Workspace can be, if you've signed the BAA. The same question applies to your form tool. If the vendor that stores your messages won't sign a BAA, don't let health information pass through it.
3. Look for tracking pixels.
Facebook (Meta) pixels, TikTok pixels and ad-retargeting scripts are the most common problem on therapy sites. Free tools like Ghostery, or your browser's developer tools, will show what loads. In 2024, a federal court struck down part of HHS's guidance on tracking public web pages. That didn't make tracking safe. HHS still says tracking tools don't belong on pages behind a login, like client portals, and several states now have their own health-privacy laws. For a therapy practice, a privacy-first, cookieless analytics tool is the cleaner choice.
4. Check your booking and intake.
If clients book or fill in intake forms, that should happen inside your EHR or practice software (SimplePractice, TherapyNotes, Jane and so on), which you have a BAA with, not in a form builder bolted onto your website.
5. Check the chat bubble.
Live chat and AI chat widgets store every word someone types. Someone in distress will type things they'd never put in a contact form. If the chat vendor won't sign a BAA, remove the widget.
6. Remove the badge.
If your site says "HIPAA compliant" in the footer, check what that claim rests on. A website can't be certified HIPAA compliant; there's no such certificate. Practices handle information in compliant or non-compliant ways. Promise what you actually do instead: "This site doesn't collect clinical information."
If you go through all six and find nothing, good. If you find three, you're in the majority. Most of what I see isn't negligence. It's a template someone set up years ago that nobody has looked at since.
The Question Worth Asking Instead
Not "is this HIPAA compliant" — ask "does this site avoid collecting anything it shouldn't, and does it route everything sensitive to the systems actually built to handle it." That's a question with a real, verifiable answer, and it's the one that actually protects you. Once that boundary is in place, the next question is whether anyone can find the site. That’s SEO for therapists.