Compliance
Why Your Therapy Practice's Contact Form Might Be a Compliance Problem
The form nobody thought about
Your contact form was probably built in an afternoon by someone whose job was making the site look good. And it works. Messages arrive. But in behavioral health a contact form isn't a generic widget. It's often the first place a family discloses something sensitive: a diagnosis, a crisis, a child's name attached to a mental health concern. Which makes it worth asking a question most practices never ask. Where does that information actually go, and what did your website promise about it on the way? One note on scope. This is general information about common risk patterns, not legal advice, and privacy obligations vary by state and by how your practice operates. For your specific exposure, talk to a healthcare attorney or a compliance professional.
Three common problems
**It collects too much.** Fields asking for diagnosis, medications, insurance member IDs, or history invite disclosures before any treatment relationship exists, and before you've decided whether this inquiry becomes a client at all. Every extra field adds to what you're now responsible for protecting. A careful intake form asks for the minimum needed to reply: name, contact method, general reason for reaching out. **It overpromises.** "Your information is completely confidential." "HIPAA-secure form." These appear on thousands of practice websites, usually put there by a designer who meant well. But a standard web form that emails submissions to a shared inbox is not confidential in any technical sense, and putting the word HIPAA on a form does nothing to the pipeline behind it. Overpromising is worse than saying nothing. It creates expectations, and possibly obligations, that you can't meet. **The pipeline behind it is a mystery.** Where do submissions actually go? If the answer involves a free form tool, a marketing platform, or analytics scripts watching form activity, sensitive information may be moving through vendors nobody vetted for it. Regulators have paid a lot of attention lately to health-adjacent websites sharing visitor data with advertising and analytics platforms. "We didn't know the tracking pixel was there" has not worked well as a defense.
What a careful form looks like
Minimal fields. Honest language, including a phone number for people who'd rather not type anything sensitive, and no promise of confidentiality the technology can't deliver. A stated response window so families know what happens after they hit send. A submission pipeline you could draw on a napkin: who receives it, where it's stored, which third parties touch it. And no advertising trackers anywhere near it. One more thing we treat as non-negotiable. A person responds. No AI answers inquiries on a site we run. When a family reaches out about their child, what comes back should be written by a human being. In this field that isn't a feature. It's a floor.
Check your own form
Open your contact page and read it the way a worried parent would. Then read it the way a regulator would. If either reading makes you uneasy, our free Referral-Readiness Audit covers your contact paths and the promises your site is making. Written findings, no sales call.