Most advice about web design for psychologists stops at color palettes and calming photography. Those matter. They are also not the part that puts a practice at risk.
The harder questions are narrower. Can your contact form legally hold what a client types into it? Does your site meet the accessibility standard your Medicaid or Medicare participation ties you to? Will the platform you picked sign a document that makes any of it defensible?
Mental health professionals get told to invest in search engine optimization and a softer palette. Almost nobody tells them which regulations apply to a therapy website, or when. This guide answers that first, with the rules named and dated, then covers the design decisions that bring right fit clients to a practice website.
Do websites need to be HIPAA compliant?
Only if the site creates, receives, maintains, or transmits protected health information. A brochure site listing your credentials, fees, and office hours is not covered. The moment you add an intake form, a symptom quiz, a portal login, or booking that captures why someone is reaching out, HIPAA applies to that part of your website.
This distinction gets missed constantly. A therapist website with a plain “name and email” contact form sits outside HIPAA. Add a dropdown for “what brings you in today” and the same form is now collecting PHI, which pulls in the Security Rule at 45 CFR Part 164 Subpart C and the Privacy Rule at Subpart E.
An SSL certificate is necessary and nowhere near sufficient. Encryption in transit says nothing about who receives the data or whether they signed anything. The same goes for the notification your form sends you, because HIPAA compliant emails require a covered mail provider, not a padlock in the address bar.
Tracking scripts are the other trap. HHS Office for Civil Rights issued a bulletin in December 2022, revised in March 2024, on tracking technologies and PHI. On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated the portion covering an IP address tied to a visit to an unauthenticated public page about a specific condition, and HHS withdrew its appeal that September. The rest of the bulletin still stands, including this: a cookie banner or a privacy policy does not authorize disclosing PHI to a vendor, and a vendor that promises to de-identify data after receiving it has already received it.
How can I create a HIPAA compliant website?
Four steps. Identify every place the site could capture PHI. Get a signed business associate agreement from each vendor touching that data, which 45 CFR 164.502(e) and 164.308(b) require. Route PHI only through covered tools. Then remove or configure analytics and advertising scripts on any page where PHI is in play.
Most practices get the first step wrong by auditing only the obvious form. The full list usually includes the contact form, appointment booking, any live chat widget, email notifications that forward form contents to your inbox, your web hosting environment, and your backups. Each one is a separate vendor relationship and a separate BAA.
The script audit is where small practices are most exposed. A Meta Pixel or a Google Ads remarketing tag on a booking confirmation page is a disclosure, and no consent banner fixes it. On a custom website we keep PHI pages script free and measure only on marketing pages instead of blanket tagging the entire site, which also keeps your analytics usable.
What websites are HIPAA compliant?
No website builder is HIPAA compliant on its own. Compliance is a property of your configuration plus a signed BAA, not of a logo on a pricing page. What varies between platforms is whether a BAA is available at all, which plan it requires, and which features it actually covers.
Here is how the platforms independent practices usually consider compare on the one question that decides everything else.
| Platform | BAA available? | What it requires | Main limitation for PHI |
|---|---|---|---|
| Wix | Yes | Business, Plus, Elite, Business Elite, or Enterprise plan, on Harmony Editor, Wix Studio, or Wix Headless, with PHI protection activated | Third party apps are not covered, legacy Wix Forms must be deleted and rebuilt, booking notes may conflict |
| Squarespace | No BAA offered for the website platform as of this writing | Not applicable | Native forms cannot hold PHI, so intake must move to a third party tool |
| WordPress, self hosted | Depends entirely on the host | A BAA from your web hosting provider plus a covered form plugin | You own the configuration, patching, and backup chain |
| SimplePractice | Yes, published at simplepractice.com/baa | A paid practice management plan | Built for practice management first, so website design flexibility is limited |
| Therapist hosts (Brighter Vision, TherapySites) | Usually yes, confirm in writing | Their hosted plan | Therapist specific templates mean less differentiation from nearby practices |
Two notes on reading this table. First, “BAA available” is not “BAA signed,” and an unsigned BAA protects nobody. Second, ask any vendor to confirm in writing which specific services the BAA covers. A builder may cover its forms and not its chat widget.
Price is the other axis, and it rarely tracks compliance. No free plan or basic plan includes a BAA on any platform that offers one, and annual billing discounts do not change what the agreement covers. Weigh customization options against the learning curve: self hosted WordPress gives the most control and demands the most maintenance, while a hosted therapist platform gets you live fastest.
Is Wix website HIPAA compliant?
Wix can be. It offers a BAA you sign from the HIPAA Compliance page after activating PHI protection, and it requires a Business, Plus, Elite, Business Elite, or Enterprise plan on the Harmony Editor, Wix Studio, or Wix Headless. Wix’s own documentation is clear that third party apps are your responsibility.
The details matter before you commit a practice website to it. Once PHI protection is on, non-compliant apps are hidden from App Market search, though they can still be installed and may break. Legacy Wix Forms cannot be converted and have to be deleted and recreated. Visitor analytics that could identify an individual are hidden. If you transfer the site, the new owner signs a fresh BAA because the old one is void. If you cancel the qualifying plan, data stays protected for 30 days and then the site is no longer compliant.
Which website builder is HIPAA compliant for therapists?
Pick by where your PHI actually lives, not by the builder’s marketing. There is no single best website builder for therapists. Many website builders that advertise websites for therapists cover their scheduling under a BAA while leaving their chat widget outside it, so the answer depends on which features you plan to use.
A group practice billing insurance has a different answer from a solo clinician running a cash practice online. If intake and scheduling live in practice management software that already has your BAA, almost any builder works for the public site. If you want intake on the website itself, you need a builder that covers forms under a BAA.
That second path is the one most solo clinicians should question. Splitting the work is usually cheaper and safer: a fast, well designed public site with no PHI on it, and intake handled by a covered tool you link to. You get design freedom on the marketing side and a much smaller compliance surface.
The accessibility deadline most private practices have not heard about
If your practice receives federal financial assistance, which includes Medicaid and most Medicare participation, HHS’s Section 504 rule at 45 CFR 84.84 requires your web content and mobile apps to meet WCAG 2.1 Level AA. Section 1557 of the Affordable Care Act reaches the same result at 45 CFR 92.204, which requires that health programs and activities provided through websites and mobile apps comply with Section 504.
The dates moved recently, and most practice owners missed it. HHS published an extension on May 11, 2026 at 91 FR 25496 (RIN 0945-AA30). Recipients with 15 or more employees went from May 11, 2026 to May 11, 2027. Recipients with fewer than 15 employees went from May 10, 2027 to May 10, 2028. Nothing else in the 2024 rule changed.
Two practical points. A responsive website is the floor, not the goal, because WCAG 2.1 AA covers contrast, keyboard navigation, focus order, and form labels, and a mobile breakpoint fixes none of those. And the required standard is 2.1 AA, not 2.2, so you are not behind if you built to 2.1. WCAG 2.2 is a W3C Recommendation dated December 12, 2024 and adds four AA criteria worth building to anyway: Focus Not Obscured (2.4.11), Dragging Movements (2.5.7), Target Size (2.5.8), and Accessible Authentication (3.3.8). WCAG 2.0 and 2.1 remain Recommendations, so 2.2 does not supersede what you already did.
If you want the compliance and accessibility side handled as part of the build rather than retrofitted, that is what our website design for wellness and health practitioners work is built around.
What is the best website design for a therapist?
The best therapist website design answers a nervous person’s three questions in the first screen: do you treat what I have, can I afford you, and how do I start. Warmth and a calm palette help someone stay. Specificity is what makes them act.
Look at therapist website examples that convert and the pattern holds. The headline names a population and a problem, not a modality, so the right clients self-select. Fees appear on the site instead of behind an email. There is one clear next step repeated down the page. Photos are of the actual clinician and the actual room.
Thoughtful design makes a page feel warm. Specific writing makes it feel authentic to you. Potential clients decide on the second one. A beautiful website that does not say who it is for will get traffic and no inquiries, while a great website names the problem your ideal clients are already typing into a search box.
What hurts a practice website: a stock photo of a stranger on a couch, a homepage headline about “your journey,” and a modality list with no translation.
How to build a website for a therapist?
Write before you design. Decide the niche and the one action you want, draft the five core pages, then choose the platform based on where PHI will live. Build, test on a phone first, check against WCAG 2.1 AA, and only then worry about visual polish.
Five pages carry almost every therapist opening their own practice: home, about, services, fees and insurance, and contact. Add one page per specialty you want to be found for, because a single page listing eight specific services will not rank for any of them. A group practice needs a team page with individual clinician bios, since each one can rank on its own.
Starting from a blank page is what stalls people for months. Whether you hire a professional designer or build it yourself, the design process starts with words, which is also how our custom web design engagements begin. Any competent web designer will ask for your content. A website designer who works with clinicians should also ask where PHI goes. We build websites for practitioners in that order: compliance scope, then copy, then layout. Getting the words settled first is what keeps a four week build from becoming a four month one.
What are the 7 C’s of website design?
The seven C’s are a marketing framework rather than a published standard, and the list varies by who is teaching it. The version most useful for a therapy practice: clarity, content, credibility, consistency, context, conversion, and compliance. Treat it as a review checklist, not a rule.
Run the entire design against it. Clarity means a visitor knows in five seconds who you help. Credibility means license number, credentials, and real photos. Conversion means one obvious action. Compliance means the two sections above. Most therapist websites do well on content and consistency and lose clients on clarity and conversion.
What is the 2 year rule for therapists?
This question surfaces in web design searches because of ethics rules around testimonials and former clients, but it is not a web rule. It refers to APA Ethics Code Standard 10.08(a), which states that psychologists do not engage in sexual intimacies with former clients or patients for at least two years after cessation or termination of therapy.
The rule that actually affects your website is Standard 5.05: psychologists do not solicit testimonials from current therapy clients or patients, or from others who are vulnerable to undue influence because of their circumstances. Standard 5.01 separately bars false or deceptive public statements about credentials and fees. The current code carries amendments effective January 1, 2017.
Practically, that means no client testimonials on a psychologist’s site. Build credibility instead through specificity: training, populations served, supervision credentials, a clear fee structure, and writing that shows you understand the problem.
Is web design still worth it in 2026?
Yes, and the reason changed. A website used to be where clients compared you. Now it is also the source AI assistants read when someone asks for a therapist who treats their issue, and a directory profile does not give those systems enough to cite.
Google searches and AI answers still deliver most new clients to private practice. Psychology Today and similar directories produce referrals, but they rank you against everyone nearby on their terms. Your own site is how clients find you on terms you control, which is the entire point of an SEO strategy. That is why we treat AI search and AEO and local SEO as part of the same build rather than a separate project.
What a custom website costs for a private practice
Hosted therapist platforms run roughly $60 to $100 a month and trade differentiation for speed. A custom therapist site designed specifically for your niche is typically a one time project cost plus hosting. The real variable is not page count, it is whether PHI touches the site, because a covered configuration adds vendor review, BAAs, and testing.
Many practices treat the new website as a one time expense and the marketing strategy as something separate. For a growing practice they are the same line item, which is why design, copy, and SEO services belong in one scope rather than three.
Before you get quotes, settle three things: whether intake happens on the site or in your practice management software, whether you receive federal financial assistance and therefore owe WCAG 2.1 AA, and how many specialties you want to be found for. Those answers change the scope more than any design preference.
Where to start
If you take one thing from this: audit where PHI touches your site this week, and confirm in writing which products each vendor’s BAA covers. That is a short task and it closes the largest gap most private practices have.
If you would rather have compliance, accessibility, and search built in from the start, that is exactly what we do for mental health professionals and other practitioners. Tell us about your practice and we will tell you what your site actually needs.
