Probably not, and you're in good company. I've looked at a lot of therapist websites this year, and most of their contact forms send whatever someone types straight into a regular inbox. Squarespace forms, Wix forms, WordPress plugins. Early on, a couple of mine, too. These days it's a question I ask on every first call.
The website isn't the problem. The form is.
A practice website is mostly a brochure. If it has no database and no client portal, there are no client records sitting on it to protect. The part of your site that touches HIPAA is the box where a stranger types a message to you.
That message counts for more than people assume. Guidance written for therapists, including Hushmail's piece on prospective clients, takes the position that once a provider receives identifiable information about someone seeking care, it's protected health information, whether or not that person ever books. Someone who writes "I've had panic attacks since my divorce, do you take Aetna?" has handed you exactly that.
Whether your practice is a covered entity at all depends on things like whether you bill insurance electronically. That's a question for your attorney or your professional association, not your web person. Most of the therapists I work with either are covered or would rather act like it.
Where a typical form sends that message
Hit submit on most website forms and the text passes through the form company's servers, then lands in your email. Every company in that chain is handling the message. HIPAA expects a covered practice to have a Business Associate Agreement, a BAA, with any company that handles protected health information on its behalf.
Squarespace doesn't sign one. Most form plugins don't. A personal Gmail account doesn't either, though a paid Google Workspace account can.
So the form looks fine, the email arrives fine, and the weak link is invisible.
Two setups that handle it
Every site I build now gets one of these, and we pick on the first call.
A short form that steers clinical details somewhere else. It asks for a name, a way to reach them and a one-line note, with plain words right above the button: please don't share anything about your health here, we'll get to that by phone or through a secure portal. It costs nothing and keeps most clinical detail out of your inbox. It can't stop someone from typing it anyway, so it lowers the risk without removing it.
A form that runs through a company that signs a BAA. Many EHRs offer a contact or appointment-request widget you can put on your own site, and the message lands inside the EHR instead of your email. If yours doesn't, a secure form service like Hushmail does the same job. These carry a monthly fee from that company. If you already pay for an EHR, you may already have one and not know it.
I'll tell you which one I'd pick for your practice and why. If your clients already use a portal, the second option is usually an afternoon of work.
What about Google Analytics?
It got less scary in 2024. HHS had said that tracking someone's visit to a public page about a health condition could itself be protected information, and that June a federal court in Texas vacated that part of the guidance. The rest of the HHS bulletin still stands, including the parts about logged-in portals and anything a visitor submits.
On practice sites I keep analytics to plain page counts. No ad pixels, and nothing that records what people type.
A five-minute check you can do tonight
Open your own site on your phone and fill out the contact form as if you were a new client. Then look at where it shows up. If it lands in your normal inbox, the sender address or the footer of that email usually names the company that delivered it. Search that company's name with "BAA." If they don't offer one, that's your answer.
While you're there, read the words above the form. If nothing tells people what not to share, that one sentence is the cheapest fix on this page.
If you'd like a second pair of eyes, send me the link and I'll tell you where your form sends things and what it would take to change. I'm not a lawyer, so the legal call stays with you and whoever advises your practice.