Is a name-and-email contact form on my website covered by HIPAA?

It depends on what people type into it. A form that asks only for contact details and a scheduling question is low risk. A free-text box invites people to write about symptoms, and then you hold health information in a channel with no BAA. Keep the box about scheduling and add a line asking people not to share clinical details.

Can I use Google Forms for intake?

Only through a paid Google Workspace account where the admin has accepted Google's BAA, and only for services Google lists as covered. A free personal Google account has no BAA. Many therapists skip the question and use the intake forms inside their EHR.

Do I need a BAA for my website host?

Only if the site stores or sends your clients' health information. A public site with no client information on it does not hold that kind of data. The risk comes from adding forms, booking tools or trackers that collect it. Ask each vendor whether it will sign a BAA before you collect anything clinical.

Can I answer a client's email?

HHS says the Privacy Rule lets providers use email with patients if they take reasonable safeguards. That can mean warning the client about the risk, sending the minimum, and offering a more secure option. Your own state rules and licensing board may add limits, so check them.

Does HIPAA apply if I only take self-pay clients?

Possibly not. The rule covers providers who send health information electronically for transactions such as insurance claims. A purely self-pay therapist may fall outside it. Your ethics code and state privacy laws still apply, so ask a lawyer before you assume.

HIPAA and Your Therapy Website: Booking, Forms and Email

Plain-English HIPAA for a therapist's website: do the rules apply to you, what a BAA is, and what is safe on a contact form, booking page and email.

Practice Tools Sahil Ahluwalia October 8, 2026 6 min read

On this page

Does HIPAA apply to me?
What is a BAA?
What can go on a public website?
Which tools will sign a BAA?
What about email?
Watch out for tracking tools
What I do on the websites I build
What to do next

A sunlit desk with a closed laptop, a brass key on a linen notebook, a mug of tea and a trailing plant

Key takeaways

HIPAA covers you if you send health information electronically for things like insurance claims. If you are not sure, ask a lawyer or your professional association.
A BAA (business associate agreement) is a contract with a vendor that handles your clients' health information. Get one before a tool holds that information.
The safest public website asks only for name, email, phone and a scheduling question. Clinical intake, notes and messages belong inside your EHR.
Calendly's terms say your data must not include health information. Wix, Google Workspace and some EHRs will sign a BAA on certain plans.

HIPAA is a federal privacy law. It applies to you if you send health information electronically for things like insurance claims. If it applies, any tool that holds your clients’ health information needs a signed contract, called a BAA, and your public website should not collect clinical details. This post explains each part in plain words.

I am a web designer, not a lawyer. This is general information, not legal advice. Check with your licensing board or a lawyer for your situation.

Does HIPAA apply to me?

HIPAA covers some people and not others. The federal rule calls them “covered entities”. A health care provider is covered when they transmit health information in electronic form in connection with certain transactions. The rule lists health care claims and checking eligibility with a health plan as examples.

So if you bill insurance electronically, you are very likely covered. If you take only self-pay clients and never send those transactions, you may not be. I would not guess. Ask a lawyer or your professional association, because the answer shapes everything else here.

Even if HIPAA does not reach you, your ethics code and your state’s privacy laws still do. Treat client privacy the same way either way.

What is a BAA?

A BAA is a business associate agreement. It is a contract between you and a company that handles your clients’ health information for you. Your EHR (electronic health record system) is a business associate. So is a cloud service that stores your notes.

The BAA says the company will protect that information and follow the rules. The key idea is simple: get the BAA before the tool holds client information. A signed BAA is a good start. It does not make a tool “HIPAA compliant” by itself, and a company’s own claim of compliance is not proof.

Before you rely on a vendor, ask:

Will you sign a BAA with me, and on which plan?
Are the features I plan to use covered by it?
How do I get my data out if I leave?

What can go on a public website?

Your public pages should hold no client information at all. Your bio, services, fees and FAQ are fine. The risk begins when you add something that collects what clients type.

A contact form is the common example. A message from a new client can mention a condition or a crisis. At that point you hold health information in a channel that may not be secure. My rule is to keep the form to logistics:

Name, email and phone.
A short question about scheduling or fit.
A note above the box: “Please don’t share health details or crisis information here.”
Crisis resources next to the form, such as 911 and 988.

Then move the real work into your EHR. Clinical intake, consent forms, notes and messages belong in your EHR’s secure portal.

Which tools will sign a BAA?

Vendors differ, and plans change. This is what the vendors’ own pages said in November 2026. Confirm on the day you sign up.

Tool	BAA status	Source
Calendly	Its terms say you must not put protected health information in it.	Calendly terms
Wix	Lets you sign a BAA after you turn on its health-information protection, on Business-level and higher plans.	Wix help
Squarespace	Only Acuity Scheduling is covered, on its Powerhouse or Premium plan. The BAA does not cover other Squarespace features.	Squarespace help
Google Workspace	The admin must accept Google’s BAA first. Without it, do not put health information in Google services.	Google admin guide

Two notes on this table. First, a free personal Gmail or Google Forms account has no BAA. Second, if Calendly only books a free phone call and you ask for no health details, that is your call to make with your lawyer. I would still keep client scheduling in your EHR.

I compare the EHRs themselves in my practice management software guide. Most of them offer online booking, forms and a client portal in one place, which is why I point therapists there first.

What about email?

You may email clients. HHS says the Privacy Rule lets providers use email with patients if they apply reasonable safeguards. In practice, I would suggest:

Use a business email address on a service that offers a BAA, not a free personal account.
Say in your intake paperwork that email is not fully secure.
Keep clinical content short, or move it to your EHR’s messaging.
Offer the secure portal to any client who prefers it.

Texting and chat apps are harder. Many do not offer a BAA, so I would keep care details out of them.

Watch out for tracking tools

Some sites carry ad or analytics trackers, such as a Meta or Google Ads pixel. HHS has guidance on tracking technologies used by covered providers. In 2024 a federal court struck down part of that guidance about public pages, so the picture is still shifting.

My plain advice is cautious. Keep ad pixels off any booking, intake or login page. If you run ads, ask a lawyer how to set them up.

What I do on the websites I build

HealerSites sites hold no patient records. The contact form is for first contact only. It sends messages over an encrypted (HTTPS) connection straight to your inbox and does not store them. It is not a secure or HIPAA-compliant channel, and I do not offer a BAA. The form includes a notice asking visitors not to share clinical details, plus 911 and 988. Booking links to the EHR you choose. I add no advertising trackers unless you ask in writing. A site costs $75 a month on a 12-month plan, or a $1,500 build fee, paid in two halves (at design approval and at launch), plus $25 a month. I give no legal or compliance advice, so the final privacy wording is yours to review.

What to do next

Find out whether you are a covered entity. Ask a lawyer or your professional association.
List every tool that touches client information, then ask each vendor for a BAA.
Trim your contact form to logistics and add the “no health details” note.
Move intake and messages into your EHR, and read how to build a therapy website for the full launch checklist.
If you are choosing a builder, see Wix and Squarespace for therapists.

This is general information, not legal advice. Check with your licensing board or a lawyer for your situation.

Topics: HIPAA, Online Booking, Practice Management Software, Getting Started

Frequently asked questions

Is a name-and-email contact form on my website covered by HIPAA?: It depends on what people type into it. A form that asks only for contact details and a scheduling question is low risk. A free-text box invites people to write about symptoms, and then you hold health information in a channel with no BAA. Keep the box about scheduling and add a line asking people not to share clinical details.
Can I use Google Forms for intake?: Only through a paid Google Workspace account where the admin has accepted Google's BAA, and only for services Google lists as covered. A free personal Google account has no BAA. Many therapists skip the question and use the intake forms inside their EHR.
Do I need a BAA for my website host?: Only if the site stores or sends your clients' health information. A public site with no client information on it does not hold that kind of data. The risk comes from adding forms, booking tools or trackers that collect it. Ask each vendor whether it will sign a BAA before you collect anything clinical.
Can I answer a client's email?: HHS says the Privacy Rule lets providers use email with patients if they take reasonable safeguards. That can mean warning the client about the risk, sending the minimum, and offering a more secure option. Your own state rules and licensing board may add limits, so check them.
Does HIPAA apply if I only take self-pay clients?: Possibly not. The rule covers providers who send health information electronically for transactions such as insurance claims. A purely self-pay therapist may fall outside it. Your ethics code and state privacy laws still apply, so ask a lawyer before you assume.

Written by Sahil Ahluwalia

Founder of HealerSites, websites for therapists

I write, build and look after websites for therapy practices. I handle the words, the design, your booking link, your Google and Psychology Today profiles, and the upkeep after launch, so your time stays with your clients.