How to Make Your Therapy Website HIPAA-Compliant
How to Make Your Therapy Website HIPAA Secure
As a therapist, protecting client confidentiality is essential, and this includes how you manage information online. If you're looking to make your therapy website “HIPAA secure,” this guide will walk you through what that means, when it’s necessary, and simple steps to get there.
What Does HIPAA-Secure Mean, and Does My Website Need It?
First, some basics. HIPAA (Health Insurance Portability and Accountability Act) sets the rules that healthcare providers must follow to protect patient information, especially when it’s shared electronically.
You only need a HIPAA-secure website if your site collects, stores, or transmits clients’ Protected Health Information (PHI). Here are some examples to help you determine if your site needs to be HIPAA-secure:
When You Need a HIPAA-Secure Website:
Collecting sensitive client information (e.g., health history, symptoms, or treatment requests) through online forms.
Online appointment booking where clients need to share health information.
Payment processing for therapy services (since payment information may be tied to PHI).
When You Don’t Need a HIPAA-Secure Website:
If your website only provides general information about your practice and services.
Contact forms that collect only basic information (like name and email) without any health details.
If you’re unsure, it’s wise to consult a HIPAA compliance expert. But if your website doesn’t store or transmit PHI, you may not need extra security steps.
Elements of a HIPAA-Secure Website
If your website needs to be HIPAA-secure, here are the key elements, explained simply:
Data Encryption: Ensures that information entered on your website (like forms) is scrambled so only authorized users can read it. It protects data both in transit (while being sent) and at rest (when stored).
Access Control: Think of this as a lock on sensitive data. Only authorized users (like you and your team) can access protected information.
Audit Controls: Tracks who accesses or interacts with sensitive information on your site, such as login attempts or file access, allowing you to monitor and manage PHI access.
Data Backup and Storage: Secure data backups ensure data isn’t lost and can be retrieved safely in case of technical issues. HIPAA-compliant backups are usually stored securely offsite with encryption.
Breach Notification: If a security breach compromises sensitive information, you must notify affected parties, which is key to maintaining trust and compliance.
How to Make a Therapy Website HIPAA-Secure (If It Needs to Be)
If your site collects PHI, here are steps to make it HIPAA-secure:
HIPAA-Compliant Hosting and Website Platforms You don’t need HIPAA-compliant hosting to make your site HIPAA-secure. Instead, you can use your current website platform (like Squarespace, Wix, or WordPress) and secure it by choosing HIPAA-compliant third-party tools for specific functions like forms, email, payments, and scheduling.
Set Up a Secure, HIPAA-Compliant Contact Form If collecting sensitive information, use HIPAA-compliant contact form tools, like JotForm, Hushmail, or Google Workspace (with a signed BAA). For Squarespace users, Google Workspace can integrate well. Just make sure the email where the form data is sent is also HIPAA-secure (e.g., not Gmail, but a Google Workspace account with a BAA).
Use Data Encryption (SSL Certificate) SSL encryption secures data between your website and clients. Most platforms, including Squarespace, offer SSL by default (look for “https” in your URL to confirm).
HIPAA-Compliant Appointment Scheduling Tool Use HIPAA-compliant scheduling tools like SimplePractice or TherapyNotes. These systems keep client information secure and offer a BAA.
HIPAA-Compliant Payment Processing For therapy-related payments, use processors that offer HIPAA-compliant options, such as Stripe (for general use) or the options in platforms like SimplePractice, which integrate with HIPAA-compliant processors.
Set Up Administrative Safeguards Limit access to PHI, track access through logging, and train your team on HIPAA practices. This ensures that only authorized individuals handle PHI responsibly.
Do You Need HIPAA-Compliant Hosting?
In most cases, therapists don’t need HIPAA-compliant hosting to have a HIPAA-secure website. Some hosting services do offer HIPAA-compliant packages with secure forms, email, payments, and scheduling tools built in, but these packages are often costly and not necessary.
Instead, you can achieve HIPAA compliance by using HIPAA-compliant third-party tools like:
HIPAA-Compliant Contact Forms: Providers like JotForm, Hushmail, or Google Workspace (with a BAA) help keep form submissions secure. You can also avoid forms on your site by linking directly to a HIPAA-secure client portal.
HIPAA-Secure Email: When using email for PHI, choose a HIPAA-secure provider like Google Workspace (with a BAA) or Hushmail.
Secure Appointment Scheduling: HIPAA-compliant scheduling platforms like SimplePractice and TherapyNotes ensure client information remains secure.
HIPAA-Compliant Payment Processing: For payments linked to PHI, use processors with HIPAA options, such as those available in client portals like SimplePractice or TherapyNotes.
By combining your website platform (like Squarespace or WordPress) with these third-party tools, you can create a HIPAA-secure website without HIPAA-compliant hosting.
HIPAA and Payment Processing
If you’re accepting client payments on your site, consider these compliance tips:
Stripe and HIPAA: Stripe is not considered HIPAA-compliant, as it doesn’t sign BAAs. To stay HIPAA-secure, limit Stripe’s use to general payment processing without linking it to PHI.
Squarespace Payments and HIPAA: Squarespace Payments does not offer a BAA, so it isn’t HIPAA-compliant. Use a HIPAA-compliant processor if payments are linked to PHI.
For full HIPAA compliance, some therapists prefer using payment processors within HIPAA-compliant platforms, like SimplePractice. You can also use a standalone HIPAA-compliant payment processor like IvyPay. (The APA wrote a nice review of these types of payment processors here.)
HIPAA-Secure Considerations for Squarespace Sites
Many therapists use Squarespace, but it doesn’t meet HIPAA standards by default. Here’s how to make it work:
Form Security: Use Google Workspace forms with a BAA, or third-party HIPAA-compliant forms like JotForm.
SSL Encryption: All Squarespace sites come with SSL enabled (check for “https” in your URL).
Appointment and Payment Tools: Embed HIPAA-compliant scheduling and payment tools, such as SimplePractice or TherapyNotes.
While Squarespace can’t fully store PHI, you can meet HIPAA’s requirements by using compliant third-party tools to handle sensitive data.
Frequently Asked Questions about HIPAA-Secure Websites
Do I need a Business Associate Agreement (BAA) with my web hosting or software providers?
Yes, if they handle PHI. BAAs are essential with any provider that accesses or manages PHI on your behalf.Is email HIPAA-secure?
Standard email, like Gmail, isn’t HIPAA-secure. For PHI, use HIPAA-compliant options like Google Workspace with a BAA or Hushmail.Can I DIY HIPAA compliance for my website?
Yes, many aspects can be managed independently with the right tools. However, consulting a HIPAA expert is wise for peace of mind.
Conclusion
Protecting client information is essential. By following these steps, you can make your therapy website HIPAA-secure. And remember, if you’re handling PHI, HIPAA compliance is key—but only websites that handle PHI need to meet these standards.
Need to set up a Google Workspace form on your website? Here are step-by-instructions.
Disclaimer: The information in this blog post is provided for general informational purposes only and does not constitute legal, financial, or professional advice. HIPAA regulations may change, and individual circumstances can vary, so it’s important to consult with a qualified HIPAA compliance professional, legal advisor, or IT expert regarding specific requirements for your practice. We make no guarantees about the completeness, accuracy, or current validity of the information provided, and we assume no liability for any errors or omissions or for any actions taken in reliance on this information.
