HIPAA compliance for therapists: the marketing and website side

Where HIPAA meets a therapy practice's marketing

HIPAA applies to covered entities, including therapists who bill insurance electronically, and to their business associates. It protects individually identifiable health information, and in therapy the bar for "health information" is low: the fact that someone sought therapy from you is itself sensitive.

Marketing creates PHI in five common places: consult and contact forms, analytics and ad tags on your site, testimonials and stories, replies to reviews, and messages with prospective clients. Each is covered below.

Two Privacy Rule provisions frame the rest:

• Marketing. 45 CFR 164.501 (opens in a new tab) defines marketing as a communication "that encourages recipients of the communication to purchase or use the product or service", with exceptions for treatment and your own services. Under 164.508(a)(3) (opens in a new tab), using or disclosing PHI for marketing requires the person's authorization, except face-to-face communications and promotional gifts of nominal value.
• Psychotherapy notes. 164.501 defines them as notes by a mental health professional "documenting or analyzing the contents of conversation during a private counseling session" that are kept separate from the rest of the record. Under 164.508(a)(2), almost any use or disclosure needs a specific authorization. They should never come near marketing.

If you treat substance use disorders, check 42 CFR 2.12 (opens in a new tab): Part 2 adds stricter rules for federally assisted programs, which can include private practitioners who hold themselves out as providing SUD treatment. For the general rule set, see HIPAA marketing rules.

Consult forms and intake pages: collect only what scheduling needs

A consult form submitted to a therapy practice ties a name and contact details to a request for mental health care. Treat every submission as PHI.

Design the form for what scheduling needs:

• Name and how to reach them, including whether a voicemail is safe
• Preferred times, in person or telehealth
• Insurance carrier, or self-pay
• An optional note, with a line asking them not to include clinical details

Leave out "What are your symptoms?", diagnosis checkboxes and medication lists; collect those in your secure intake system after the first call. Store submissions with a vendor that signs a BAA, restrict access to the people who schedule, and don't route them through a personal email inbox. Our guide to therapy website forms covers layout and wording.

Tracking pixels and analytics on mental-health pages

HHS's online tracking bulletin (opens in a new tab) explains how analytics and ad tags can send PHI to vendors, and notes such disclosures can reveal "frequency of visits to a therapist". Its current status matters:

• On June 20, 2024, a federal court in Texas vacated the part saying HIPAA is triggered when a tracker connects an IP address with a visit to an unauthenticated public page about specific health conditions. HHS says it is evaluating next steps.
• The rest stands. Tracking on logged-in pages such as a client portal generally has access to PHI. Tracking on public pages where someone books an appointment or types a reason for seeking care can disclose PHI. Cookie banners are not HIPAA authorizations, and a vendor that receives PHI needs a BAA.

For a therapy site, that means no Meta pixel, Google Ads tag or session-replay script on consult, intake, booking or portal pages, and no remarketing audiences built from condition pages. Google doesn't allow remarketing lists for mental health counseling (opens in a new tab) anyway. More in tracking pixels and HIPAA.

Testimonials: HIPAA authorization plus your ethics code

Using a client's words, story or photo in marketing requires a signed HIPAA authorization under 164.508. For therapists, the authorization is the smaller hurdle. The ethics codes, checked October 22, 2026:

• APA 5.05: psychologists don't solicit testimonials from current therapy clients or others vulnerable to undue influence (APA Ethics Code (opens in a new tab)).
• ACA C.3.b: counselors don't solicit testimonials from current or former clients or anyone who may be vulnerable, and must discuss implications and get permission for any testimonial used (2014 ACA Code (opens in a new tab)).
• NASW 4.07(b): social workers don't solicit testimonial endorsements, including consent to use a client's prior statement (NASW Code (opens in a new tab)).
• AAMFT 9.2: no soliciting testimonials from current clients or others vulnerable to undue influence (AAMFT Code (opens in a new tab)).

A common misconception is that a signed form solves it. It doesn't: the ethical problem is the asking, given the power imbalance in therapy. Use clearly fictional composites, labeled as such, and let unsolicited public reviews stand on their own. See patient testimonial rules for other specialties' rules.

Replying to reviews and comments without disclosing a client

Confirming that a reviewer is your client discloses PHI, even if they posted first. HHS has enforced this against a mental health practice: in 2023 it announced a settlement with Manasa Health Center, LLC (opens in a new tab), a New Jersey provider of adult and child psychiatric services. The complaint alleged the practice disclosed a patient's PHI in a response to a negative online review. Manasa paid $30,000 and agreed to a corrective action plan.

The safe pattern for every review and social comment: thank the person, say privacy rules prevent you from discussing anyone's care, and invite them to call. Never mention sessions, diagnoses or dates. Templates are in Google reviews for therapists.

Email, text and messaging with prospective clients

HHS's email FAQ (opens in a new tab) says providers may communicate with patients by email "provided they apply reasonable safeguards", such as checking the address and limiting what goes into unencrypted messages. If a person writes to you first, you can generally assume email is acceptable to them, and you should honor a request for a different channel.

With prospective clients, that means:

• Reply with availability, fees and the next step; no clinical detail.
• Move sensitive conversations to a phone call or secure portal.
• Ask before leaving voicemails or texting.
• Keep marketing messages separate from care communications; marketing emails and texts carry their own consent rules beyond HIPAA.

Vendors that touch PHI need a BAA

A business associate is, per HHS (opens in a new tab), a person or organization that creates, receives, maintains or transmits PHI on your behalf. For marketing, that commonly includes:

• Your website host, if form submissions are stored or pass through it
• Your form tool
• Your CRM or inbox for consult requests
• A website chat widget
• Any analytics or ad vendor that would receive PHI (most won't sign, which is why pixels stay off those pages)

Ask for the BAA before any client data flows. Our guide to business associate agreements covers what one must contain.

How Medfy handles this: Medfy signs a BAA with each practice before any patient data flows. Form, chat, inbox and CRM data are stored in separate, encrypted HIPAA databases in the US or Canada, with role-based permissions and an audit log. Ad platforms never receive patient data. Medfy is built HIPAA-compliant by design; judge any vendor by its BAA and safeguards rather than badges. Details are on how Medfy protects patient data.

A one-page checklist for a therapy practice

• Consult form asks only for scheduling details, with a "no clinical details" note
• Form tool, host, CRM and chat vendor each have a signed BAA
• No ad pixels or session replay on consult, intake, booking or portal pages
• No remarketing audiences from condition pages
• No solicited testimonials; any fictional example is labeled
• Review and comment replies never confirm a client
• Email and text replies carry no clinical detail
• Crisis note on the site and in auto-replies (988 and 911)
• Psychotherapy notes kept separate and nowhere near marketing tools

A free marketing audit flags privacy risks such as pixels on patient forms, from public information only. For the wider picture, see therapist marketing.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor, such as your attorney or your professional association's ethics consultation service.

Frequently asked questions

Can therapists use client testimonials if the client agrees?

Agreement isn't enough on its own. HIPAA requires a signed authorization before you use a client's information in marketing, and that covers the legal side. Your ethics code is stricter: the APA, ACA, NASW and AAMFT codes bar soliciting testimonials from current clients or others vulnerable to undue influence, and the ACA adds former clients. Asking for one, or for consent to reuse their words, is the problem.

Is a therapy website contact form covered by HIPAA?

Usually, yes. A form that someone fills in to seek therapy links their name and contact details to a request for care, and anything they type about symptoms, diagnoses or insurance adds more. Treat submissions as protected health information: use a form tool and host that sign a Business Associate Agreement, encrypt the data, limit who can see it, and keep ad pixels off the page.

Can therapists text or email prospective clients?

Yes, with reasonable safeguards. HHS says providers may communicate with patients by email, checking addresses and limiting what goes into unencrypted messages, and should honor a person's request for a different channel. In practice: reply with availability, fees and next steps, never clinical details, and move anything sensitive to a secure portal or phone call. Marketing texts raise separate consent rules.

Do therapists need a BAA with their website host?

You need one if the host creates, receives, stores or transmits protected health information for you, for example when consult form submissions are stored on its servers or pass through its systems. A host serving only public pages, with forms handled by a separate HIPAA-compliant tool, may not need one, but that tool does. When in doubt, choose a host that will sign a BAA.