Why keep a therapy contact form short?
A contact form has one job: give you enough to reply. Everything past that is information you now hold in a website tool, which is rarely where clinical records should live. History, symptoms and diagnoses belong in your intake paperwork, inside your records system, after you and the person have agreed to talk.
A short form is also easier to finish on a phone, and it asks less of someone who is writing to a stranger for the first time.
Does HIPAA apply to a therapy contact form?
It can. HIPAA applies to covered entities. A provider is covered if it conducts any HIPAA standard transaction electronically, such as a claim, an eligibility check or a claim status inquiry, including when a billing service or clearinghouse sends it on the provider’s behalf. A therapist who never does any of these may not be covered. Whether you are is a legal determination: CMS’s covered-entity guidance1 includes a decision tool, and an attorney can confirm the answer.
For covered practices, the HHS Office for Civil Rights guidance on online tracking technologies2 is the reference. It went through a court challenge in 2024, and the page now reads like this:
- What was vacated. On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the part saying HIPAA is triggered when a tracker connects a person’s IP address with a visit to a public, unauthenticated page about specific health conditions or providers. The HHS page carries that notice and says HHS is evaluating its next steps.
- What still stands. The guidance says trackers on an unauthenticated page that lets people schedule appointments may have access to protected health information, and gives two examples: an email address, and a reason for seeking care typed or selected by the person. In that case HIPAA applies.
- Vendors. A tracking vendor that receives protected health information must sign a business associate agreement, and a cookie banner asking people to accept tracking is not a valid HIPAA authorization.
For a covered practice, that points to two habits on the contact page. Keep advertising pixels and session-recording scripts off the page with the form. And because the form service receives whatever people type, including a reason for reaching out, use one that will sign a business associate agreement. Even then, keep any free-text note optional and brief. Our guide to what a therapist website costs prices HIPAA-ready form tools and notes what some builders say they will sign.
For a California practice, keep pixels and session recording off the page either way. State privacy law (CIPA) is being applied to both whether or not HIPAA covers the practice; our post on analytics and HIPAA explains how.
What should the form ask?
Our recommendation is three parts:
- Name. Or “what should I call you,” which lets people use a first name only.
- Preferred contact method. Email or phone, the address or number, and whether it’s all right to leave a voicemail or a detailed message.
- An optional note. Label it plainly: “A sentence or two about what you’re looking for. Please don’t include personal history here; we’ll talk about that together.”
Leave out diagnosis, medications, trauma history, detailed symptoms, date of birth and insurance member numbers. If you need insurance details to check fit, the plan name is enough at this stage.
What should the form say about emergencies?
Put a short notice next to the send button, not only in the footer. SAMHSA’s crisis page3 says anyone in danger or having a medical emergency should call 911 or go to the nearest emergency room, and anyone struggling or in crisis can call or text 988, or chat at 988lifeline.org. A version for your form:
This form is not for emergencies, and it isn’t a confidential channel for clinical information. If you are in crisis, call or text 988. If you are in danger, call 911 or go to the nearest emergency room.
Repeat the same lines on the confirmation screen that appears after someone sends the form.
How quickly should I promise to reply?
Promise what you can keep on your busiest week. “I reply within two business days” is a good line if it is true, and a poor one if you are in session all Thursday and Friday. Say which days you check messages, and put the reply window on the confirmation screen as well as the form.
When you are away, change the window or add a dated note saying when you’ll be back.
Should I offer another way to get in touch besides the phone?
Yes. Some people can’t make a private call from home or work, some are deaf or hard of hearing, and some would simply rather write. Next to the form, give an email address and, if your calendar is kept accurate, a link to book a consultation directly.
Few practices do the second. In our own count of 1,576 California practice homepages on September 10, 2026, 14.3% linked to one of six common online booking services. That count covers homepage links only and a sample of therapists who already had a findable website, so read it as a snapshot of that group, not a statewide figure.
A booking link only helps if the times it offers are real. If your openings change weekly, a form with a reply window you keep is the better route. If you book through SimplePractice, our guide to adding SimplePractice booking to your website covers turning on appointment requests and testing them.
If you want an outside read of your current contact page, you can request a website review.
This post is general information, not legal advice. Check the primary text, the HHS tracking guidance, and for your own situation ask your professional association’s legal or ethics line or an attorney.