HIPAA Compliant Website Builder? Ours Is HIPAA-Aware

The safest place for PHI is not your website.

Here's the truth most “HIPAA compliant website builder” pitches skip: no builder is compliant on its own, and a marketing website has no business holding protected health information in the first place. WebsiteTherapy is HIPAA-aware: we design clinical information out of the site, and your EHR holds the clinical data. Full HIPAA compliance, with a Business Associate Agreement we sign with you, is in progress; until it's done we don't call the platform HIPAA compliant.

Book a free consultation See how it works

AI assistant

I want to reach out to a therapist, but is it safe to use the chat on their website? I don't want my health details floating around.

On a well-architected practice site — like Meadowlark Counseling — the chat identifies itself as AI, answers logistics questions (fees, insurance, scheduling) without collecting health information, and clinical intake happens inside the practice's secure health-records system, not the website.

Sourcemeadowlarkcounseling.com

Illustrative — answers like this come from a website AI can actually read.

The problem

Why most “HIPAA-compliant” website builders aren't the answer.

Search for a HIPAA compliant website builder and you'll find two camps: healthcare platforms selling BAA-covered everything, and general builders quietly noting that compliance is your configuration problem. Both camps accept the same premise — that your public website should be collecting health information. For a therapy practice, that premise is the mistake.

A marketing site needs your fees, your specialties, your availability, and a way to reach you. None of that is clinical. The moment your site stores symptom descriptions or intake forms, you've turned a brochure into a regulated data system — and taken on breach risk that belonged in your EHR, where compliance infrastructure already exists.

So what does a HIPAA compliant website builder need? Encryption in transit, forms that don't invite clinical detail, a chat that never asks for health information, a separate secure home for anything that could identify a client, and a Business Associate Agreement from any vendor that stores that data for you. We have the first four today. The BAA with our clients is the piece still in progress.

What we build

HIPAA-aware by architecture.

Every WebsiteTherapy site ships with the same PHI-free design:

A visitor agent that never asks for health details

It answers logistics — fees, insurance, scheduling — and doesn't keep chat transcripts. If a visitor asks to be contacted, their name, contact details and short message are stored encrypted under AWS's Business Associate Agreement with us.

Booking through your scheduler

Booking connects to SimplePractice, Calendly, Cal.com or Acuity, so appointments are made in the system you already use.

Contact forms with guardrails

Appropriate disclaimers, no symptom checklists, no clinical questionnaires on the public site.

Leads kept out of the website

Contact-form inquiries are stored in a separate encrypted database in an AWS account covered by AWS's Business Associate Agreement with us, not in the site's code or an ordinary inbox database.

Crisis protocol built in

Crisis language in chat immediately surfaces 988 and the Crisis Text Line — always.

AI disclosure

The visitor agent identifies itself as AI.

Accessibility as policy

WCAG 2.1 AA in every component — ADA exposure handled, not hoped about.

How it runs

HIPAA-aware, not HIPAA-theater.

Keeping clinical information off the website isn't a checkbox you configure — it's how the platform is built:

Nothing to configure wrong

There's no privacy mode to forget to enable. Keeping clinical information off the site is the only mode the platform has.

Plays cleanly with your clinical stack

Booking links route to your scheduler, and telehealth stays in your HIPAA-compliant platform. The website handles discovery and trust.

Honest by design

We tell you exactly where HIPAA applies and where it doesn't — the same straight answer we'd want from a vendor.

Growth is $99/mo; Concierge, at $199/mo, adds Lee, our founder, doing the work for you. No setup fee, no contract, free migration. Compare plans →

Questions

Common questions

Is WebsiteTherapy HIPAA compliant?

Not yet, and we won't claim it until it's true. WebsiteTherapy is HIPAA-aware today: the website is built not to collect clinical information, clinical intake routes to your EHR, and contact-form inquiries are stored in a separate encrypted database under AWS's Business Associate Agreement with us. Full HIPAA compliance, including a Business Associate Agreement we sign with you, is in progress.

Do I need a BAA with my website provider?

You need one with any vendor that creates, receives, or stores PHI on your behalf. Your EHR, telehealth platform, and any HIPAA email service all qualify. A contact form can collect a name and email from someone seeking therapy, so we treat those inquiries with care and store them under AWS's BAA with us. We don't yet sign a BAA with our clients; that is in progress.

What about my contact form?

Contact forms collect name and contact details with a disclaimer against sharing clinical detail, because inviting symptom essays into an unsecured inbox is bad practice. Anything clinical (intake questionnaires, histories, consent forms) belongs in your EHR's secure portal.

Can the AI chat widget really be safe for a therapy site?

It's built for exactly this context: it identifies itself as AI, answers only logistics questions grounded in your published content, never probes for health details, doesn't keep chat transcripts, and surfaces 988 and the Crisis Text Line the moment crisis language appears.

See how AI answers when someone asks for a therapist like you.

Book a free consultation — we'll show you exactly how AI sees your practice today, and what your new site would look like. Most sites go live within a day.

Book a free consultation

Prefer to write? Send us a message