This page explains the basics of the Health Insurance Portability and Accountability Act (HIPAA) as it relates to therapist websites in the United States, and how TherapyLaunch can support a responsible configuration. This is general information, not legal advice. HIPAA compliance depends on your full setup and your vendors, not on a website theme alone.
1) Understand when HIPAA applies
HIPAA applies to covered entities and their business associates when handling Protected Health Information (PHI). If your website collects or transmits PHI (for example, detailed health information through an intake form), HIPAA obligations are triggered for you and for any vendor processing that data. If your site is informational only and does not collect PHI, HIPAA may not apply to the site itself.
2) Use secure transport (TLS/SSL)
All TherapyLaunch sites are intended to run over HTTPS to protect data in transit. Always ensure your domain has a valid TLS certificate and avoid mixed content. Do not place forms on non-HTTPS pages.
3) Collect the minimum necessary
Design forms to collect only what you need to respond or schedule. Avoid asking for detailed health histories on public web forms. Use free-text fields sparingly and provide examples of what not to submit in the form instructions.
4) Choose HIPAA-ready form and messaging tools
If you collect PHI, use a form processor or patient portal that offers encryption, access controls, auditing, and a Business Associate Agreement (BAA). Connect your TherapyLaunch site to that tool and store submissions there, not by email. Avoid sending PHI over regular email or SMS.
5) BAAs with your vendors
HIPAA requires BAAs with vendors that create, receive, maintain, or transmit PHI for you (e.g., form processor, EHR, secure messaging, file storage). Keep signed BAAs on file. Your web host and any integrated analytics tool that can access PHI should also be reviewed.
6) Limit tracking on PHI pages
Avoid third-party trackers (ads pixels, remarketing tags) on pages that collect or display PHI. Use privacy-friendly, IP-anonymized analytics where possible and disable tracking on intake or portal pages.
7) Access control and authentication
Use strong admin passwords and multi-factor authentication for your website account and any connected tools. Restrict admin access to staff who need it. Remove unused accounts promptly.
8) Security configuration
Configure security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy where appropriate). Keep integrations and dependencies updated. Back up content regularly through your chosen provider.
9) Privacy notice and consent
Publish a clear privacy notice that explains what information you collect, why, how it is protected, who has access, and how clients can contact you. If you are a covered entity, also link to your Notice of Privacy Practices.
10) Email and texting
Standard email and SMS are not appropriate for PHI unless your vendor provides secure options and a BAA, and clients have been informed of risks. Prefer secure messaging in your EHR or client portal for sensitive details.
How TherapyLaunch helps
Design and structure: Our templates make it easy to present clear information, limit form fields, and steer clients toward secure contact options.
HTTPS by default: We expect sites to be served over TLS/SSL to protect data in transit.
Integrations: You can connect to HIPAA-ready form services or your EHR portal for intake and messaging. Store submissions in those systems rather than email.
Content patterns: Templates include space for a privacy notice and patient communications policy. You can add warnings to avoid sharing sensitive information in general contact forms.
Access hygiene: Use strong passwords and multi-factor authentication for your admin login and connected tools.
Important notes
A website platform cannot make your practice “HIPAA compliant” by itself. Compliance is an ongoing process that includes your policies, your vendors, your devices, and staff training. Review your setup with a qualified professional and keep documentation up to date.
