Here’s a scenario we see all the time when reviewing therapy websites: a beautiful, calming homepage, a warm “About” page… and a contact form that quietly emails every submission — including whatever a distressed visitor typed into the message box — straight to a regular Gmail inbox, unencrypted, stored forever.
The uncomfortable truth is that most WordPress contact forms are not private enough for a counseling practice out of the box. If a potential client writes “I’ve been struggling with panic attacks and my psychiatrist suggested therapy” into your form, that message is protected health information (PHI) the moment it’s connected to their name and email. And the standard setup — Contact Form 7 or a default WPForms install sending email notifications — was never designed to protect it.
The good news: fixing this is very doable, it doesn’t require a developer, and a privacy-conscious contact form actually converts better — because the anxious first-time visitor (which is most of your visitors) can feel that you take their confidentiality seriously before they ever meet you. In this guide we’ll walk through five practical steps you can apply this week. One quick note before we start: we’re web people, not lawyers — treat this as practical guidance, and confirm your specific obligations with a HIPAA compliance professional.
Three things make an ordinary contact form risky for a practice owner. First, email notifications: most form plugins send the full submission to your inbox. Regular email (Gmail, Outlook, GoDaddy mail) is not encrypted end-to-end and there’s no Business Associate Agreement (BAA) covering it. Second, plain-text storage: many form plugins store every entry unencrypted in your WordPress database — so a site hack becomes a potential PHI breach. Third, no BAA with your vendors: HIPAA requires a signed BAA with any company that handles PHI on your behalf, and most mainstream form plugins and hosts simply won’t sign one on standard plans.
None of this means you need to rip out your website. It means you need to make one honest decision about your contact form: either keep it so minimal that no PHI ever passes through it, or upgrade it to a genuinely compliant tool. Let’s do both properly.
The simplest way to reduce risk is to collect less. For a first-contact form, you really only need: name, phone or email, and preferred way (and time) to be reached. That’s it. Remove the big open “Tell us what’s going on” message box, or replace it with a constrained dropdown like “What are you contacting us about?” with options such as “Scheduling a first appointment,” “Insurance question,” or “Something else.”
This feels counterintuitive — don’t you want to know more about the client? You will, in the consultation call. A shorter form also converts dramatically better: every extra field on a form is a place where a hesitant visitor can change their mind. For someone nervously reaching out to a therapist for the first time, a three-field form is a kindness as much as a compliance measure.
Avoid fields like “Reason for seeking therapy,” “Current medications,” “Insurance member ID,” or date of birth. All of these belong in a proper secure intake form after first contact — inside your practice management system (SimplePractice, TherapyNotes, Jane and similar all offer secure client portals for exactly this).
If you want visitors to be able to write anything free-form at all — and many practices do — use a form provider that offers HIPAA compliance with a signed BAA. In 2026 the realistic options for a WordPress site include HIPAAtizer and HIPAA Forms (both built specifically for embedding compliant forms in WordPress), Jotform’s HIPAA-enabled plans, and Hushmail for Healthcare forms. These encrypt submissions in transit and at rest, store them outside your WordPress database, and — crucially — will sign a BAA with your practice.
Expect to pay roughly $10–$40/month depending on the provider and plan. If that feels like a lot, compare it to the value of a single new client — and to the cost of a breach notification. Alternatively, if you follow Step 1 strictly and your form collects nothing but name and contact details, a well-configured standard plugin is a defensible choice; the key is that no health information can flow through it.
This is the mistake we find on more than half the therapy sites we audit. Even practices that bought a “secure” form often leave the plugin’s default notification on — which emails the entire submission to the practice inbox and defeats the whole point.
Open your form plugin’s notification settings and change the notification email so it contains no submitted content — just an alert like: “You have a new contact request. Log in to view it securely.” In WPForms this is under Settings → Notifications (delete the Smart Tags like {all_fields} from the message body); in Gravity Forms it’s Form → Settings → Notifications; compliant tools like HIPAAtizer do this for you by default. You still get an instant heads-up on your phone — the sensitive details stay behind a login.
Now the part that actively wins you clients. A short, warm privacy note under your form does two jobs at once: it steers visitors away from typing sensitive details (protecting them and you), and it signals — at the exact moment of highest hesitation — that confidentiality is something you take seriously. Here’s what it looks like:
Live demo:
To add this to your own site, paste the snippet below into a Custom HTML block directly beneath your contact form (in Divi, use a Code module). Feel free to change the green accent color to match your brand:
<style>
.privacy-note{
background:#f2f7f5;
border-left:4px solid #7fb3a2;
border-radius:8px;
padding:18px 22px;
color:#33443e;
line-height:1.6;
max-width:560px;
}
.privacy-note strong{
display:block;
margin-bottom:6px;
color:#26352f;
}
</style>
<div class="privacy-note">
<strong>🔒 Your privacy matters</strong>
This form is for scheduling and general questions only —
please don't include details about your health or personal
situation here. Anything sensitive can wait until we connect
in a secure, confidential setting.
</div>
Soft green tones, generous padding, and a rounded corner keep the note feeling like reassurance rather than a legal warning — which is exactly the tone a therapy website should strike.
Contact form spam is real, but a “select all the traffic lights” CAPTCHA is a genuine barrier for someone already on the fence about reaching out. In 2026 you have gentler options: enable your form plugin’s built-in honeypot field (an invisible trap only bots fill in — WPForms, Gravity Forms, and Contact Form 7 all support one), or use an invisible verification like Cloudflare Turnstile, which checks visitors silently with no puzzles. Your prospective clients never see a thing, and your inbox stays clean.
Before you close this tab, open your own contact page and check: your form asks only for name, contact details, and preferred contact method; there is no open “describe your situation” box (or it’s moved to a BAA-covered tool); email notifications contain an alert only, never the submission itself; your site runs on HTTPS everywhere (the padlock in the browser bar); a short privacy note sits under the form; and spam protection is invisible to humans. If you can tick all six, your front door is in better shape than the vast majority of practice websites we review.
And if you’d rather have someone do this for you — reviewing your forms, notifications, and hosting setup is exactly the kind of thing we handle for counseling practices every week. Reach out any time (through our very minimal contact form, naturally).
No. Standard installs of Contact Form 7, WPForms, and similar plugins store entries unencrypted and email full submissions, and the vendors don’t sign a BAA on regular plans. They’re fine only if your form collects nothing beyond name and contact details — no health information of any kind.
If your form truly collects only contact details and no information about health, treatment, or the reason for reaching out, many practices treat a standard form as acceptable risk. The danger is the open message box — that’s where visitors volunteer PHI. Remove it, or move it to a BAA-covered tool, and confirm your approach with a compliance professional.
A Business Associate Agreement is a contract in which a vendor that handles protected health information on your behalf accepts HIPAA obligations. For a therapy website, that can include your form provider, email service, scheduling tool, and sometimes your host — any service that touches client health information should have a signed BAA with your practice.
Usually not. A plain email link invites people to write long, sensitive messages over unencrypted email, and it exposes your address to spam harvesters. A minimal form with a clear privacy note gives you far more control over what information arrives and how it’s stored.
