HIPAA-Compliant Contact Forms, Intake and Scheduling for Therapists: Choosing the Right Setup

A HIPAA-ready setup for a therapy website means every tool that collects, stores or sends client health details is covered by a Business Associate Agreement (BAA), and every other tool is kept away from that data. In practice, that means picking the right vendor for each job: the contact form, the intake paperwork, the scheduler and the notifications they send.

This guide compares the main setups and shows what each vendor's own pages say about HIPAA and BAAs, checked on 29 October 2026. It is part of our Therapy Practice Marketing Guide. For the bigger question of whether your whole site is compliant, start with Is your therapy website HIPAA-compliant?. This is marketing guidance, not legal advice: confirm your setup with your compliance advisor.

What counts as PHI on a therapy website

Protected health information is health information that can be tied to a person. On a therapy site, the risk usually sits in three places:

• Contact forms that ask "What brings you to therapy?" or offer a free-text box.
• Intake forms with history, symptoms, medications or insurance details.
• Scheduling tools where the appointment type itself (for example, "Trauma intake") reveals a health detail.

A name and email alone, sent through a general "contact us" form, is less sensitive than a symptom checklist. But once someone types "I have panic attacks" into a free-text box, that message may be PHI. Design your forms with that in mind.

When you need a BAA

Under the HIPAA definition in 45 CFR 160.103, a business associate is a person or company that "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity. "Maintains" matters: a vendor that only stores your form entries still counts.

So ask one question of every tool on your site: does client health information pass through or sit in this tool? If yes, you need a signed BAA with that vendor, on a plan the vendor says is covered.

Option 1: A short contact form plus EHR intake

This is the setup many solo therapists end up with.

1. Your website has a brief contact form: name, preferred contact method and "how did you hear about us."
2. The form tells people not to share clinical details.
3. Once you reply, you invite the client into your EHR's client portal for intake and paperwork.

Most therapy EHRs handle intake and e-signatures inside the portal. For example, SimplePractice publishes its Business Associate Agreement on its own site. Check your own EHR's BAA page before relying on its portal. Our roundup of the best EHR software for private practice compares options.

Pros: Fewer tools, less data on the website, one place for client records. Cons: A small step between the website and the first appointment.

Even a "non-clinical" contact form should use a secure, covered tool if there is any chance people will type health details. Many will, no matter what the form says.

Option 2: A BAA-backed form tool embedded on your site

If you want richer forms on the website itself, use a form vendor that signs a BAA and embed its form.

• Jotform. Its HIPAA page says HIPAA features come with the Gold or Enterprise plan and that covered entities who turn those features on receive a signed BAA. Its BAA page limits the BAA to HIPAA customers operating in the USA.
• Hushmail. Its Squarespace form page says every Hushmail for Healthcare plan includes a signed BAA, and explains that you build the form in Hushmail and paste its embed code into your site.

Pros: Works with any website platform. Forms can be detailed. Cons: Another subscription, and you must set up notifications carefully.

Option 3: Your website builder's own HIPAA features

Some builders now offer HIPAA features on certain plans. Coverage is narrow, so read the details.

Squarespace and Acuity Scheduling

Squarespace's HIPAA article says Acuity Scheduling is "the only Squarespace feature currently designed to offer services consistent with HIPAA obligations." It also says:

• The BAA "doesn't cover other Squarespace features," and the form block cannot be part of a HIPAA-compliant solution.
• You can make an Acuity account HIPAA-enabled on the Powerhouse or Premium plans.
• "Email and text notifications may contain Protected Health Information (PHI) by default."
• Many third-party integrations, such as Stripe, do not support HIPAA.

Wix

Wix's HIPAA article says HIPAA compliance is available on Business, Plus, Elite, Business Elite and Enterprise plans. Key points from that page:

• Sign the BAA and turn on PHI protection before collecting any PHI.
• Old Wix Forms must be deleted and recreated with the new Wix Forms.
• Notes on individual bookings may conflict with HIPAA.
• Non-compliant channels like Facebook and Instagram must be disconnected from Wix Inbox.
• Wix "cannot guarantee HIPAA compliance for apps or services we do not control."

For a full platform comparison, see Squarespace vs Wix vs WordPress for therapists.

Option 4: Scheduling inside your EHR

Many EHRs include a booking widget you can embed or link from your website. The advantage is that appointment data lands in the same covered system as your notes and billing. Confirm on your EHR's own pages that the booking feature is covered by its BAA.

Whether to offer self-booking at all is a separate question. Our guide on whether therapists should use online booking weighs it up.

Email: the part people forget

Form tools often email you a copy of each submission. If that copy includes health details, your email provider is now handling PHI.

• Google's Workspace HIPAA page says administrators must review and accept a BAA before using PHI in Google services, and that customers who have not signed one "must not use PHI" in Google Workspace.
• The same page says third-party apps and add-ons are not included in the BAA.

A safer pattern: set notifications to say "You have a new submission" with a link to log in, instead of sending the answers in the email body.

Comparison at a glance

Setup mistakes to avoid

• Using the builder's standard form for intake. On Squarespace, its own article says the form block cannot be part of a HIPAA-compliant solution.
• Leaving tracking tags on form pages. Google says it does not offer a BAA for Google Analytics and advises against tags on authenticated pages. Read tracking pixels on therapy websites before adding any pixel near a form.
• Appointment names that reveal diagnoses. Use neutral names like "Initial session" instead of "Depression intake."
• Forwarding submissions to a personal inbox. Keep PHI inside covered accounts.
• Assuming the BAA covers everything. Every vendor above limits coverage to certain features or plans.
• Forgetting site security. A covered form is only as safe as the site it is embedded on. See our website security services.

A practical checklist

1. List every tool on your site that touches a form, booking or message.
2. For each, find the vendor's own HIPAA or BAA page and save a copy with the date.
3. Confirm you are on a plan the vendor says is covered.
4. Sign the BAA inside the vendor's dashboard and keep the signed copy.
5. Change notifications so they do not include form answers.
6. Remove analytics and ad tags from form and booking pages.
7. Test the full journey yourself, from website to confirmation email.
8. Review the setup every year, or whenever you add a tool.

Next step

Forms and scheduling are only part of the vendor picture. Our HIPAA checklist for marketing vendors covers agencies, call tracking, email marketing and more. If you would like help setting this up, eSEOspace builds websites for mental health practices with covered forms and privacy-safe tracking from day one.

Frequently asked questions