Email Is Not Secure: What to Tell Therapy Clients in 2026
A client emails you at nine at night from her work account. She tells you what happened at the family dinner, names her husband, and asks whether you have a Thursday slot. You now have clinical material sitting in two mailboxes, one of which belongs to her employer. Nothing you did caused this. But your website is the place where you get to prevent the next one, and most therapy websites quietly invite it.
Why this is a website problem, not an email problem
Plain email travels between mail servers and sits on them afterward. A client writing to you from a work address is writing into a system her employer can usually access. She does not know that, and she has no reason to think about it — she is upset and your address was the easiest thing on the page to click.
You cannot make her stop. What you can do is remove the easy invitation, tell her plainly what email is and is not, and give her somewhere better to send the difficult part. That is four small edits, and they live on your website rather than in your inbox.
Everything below is general information about how to set up your site, not legal advice. What HIPAA requires of your particular practice depends on your setup, your state, and the services you use, and a compliance question is one for your attorney or your professional liability carrier.
Take the raw email address off the page
Most therapy sites put a plain address in the footer, the header, and halfway down the contact page. Each one is an open invitation to send clinical detail by the least private route available.
Replace them with one link to your contact form, and keep exactly one address on the site for the things email is fine for — scheduling, directions, paperwork questions. Label it that way: "For scheduling and general questions." A label does more work than a warning.
How to know it worked: search your own site for the "@" character. If you find it more than once, keep going.
Time: twenty minutes, or a small ticket for whoever handles your website maintenance.
Say it on the contact page, before they type
One short paragraph above the form, in the client’s language rather than a compliance register:
"Please keep this first message brief — your name, how to reach you, and roughly what you would like help with. Email and web forms are not fully private, so save the details for our first conversation."
That sentence does two useful things at once. It protects her, and it shortens the inbound message to something you can actually triage.
How to know it worked: the next five inquiries are shorter and easier to answer.
Time: fifteen minutes.
Fix the automatic reply that goes out after the form
This is the most-skipped edit on any therapy website, and the one clients notice most. A warm home page followed by a confirmation reading "Your submission has been received" is a jarring handoff at exactly the wrong moment.
Rewrite it to say three things: that a person will reply and roughly when, what to do if this is urgent, and one line repeating that email is not the place for details. Keep it to four sentences. Then send yourself a test through the form and read what arrives.
How to know it worked: you submit your own form and the reply sounds like you.
Time: half an hour, plus one test.
Give them somewhere better to send the difficult part
Telling someone not to email details is only half an instruction. The other half is where to put them instead.
The two common routes are a client portal inside your practice-management system, which most of the major ones include, and a dedicated encrypted messaging or email service used alongside your normal mail. Both can work; neither is the only option; and which is sensible depends on what you already pay for. If your practice-management software already has a portal, that is usually the cheaper answer, because it is one fewer system for a client to learn.
Whatever you choose, the vendor question to ask is whether they will sign a business associate agreement for your account, and on which plan. Some will only do it on higher tiers. Get that in writing before you route client messages through anything.
No product makes a practice HIPAA compliant on its own, whatever the marketing page says. Compliance is about your whole setup — your devices, your staff, your paperwork, your agreements — and a tool is one part of it.
How to know it worked: you can write down, in one sentence, where a client should send a sensitive message.
Time: an afternoon of comparing what you already have.
Put the same sentence in your intake paperwork
Your site and your paperwork should say the same thing about email, in the same words. When they disagree, the client believes the one she read first, which is the website.
Add a short section to your informed-consent documents describing which channels you use for what, and how quickly you check each one. Response time matters more than people expect: a client who thinks email reaches you instantly will use it in a crisis.
How to know it worked: read the website paragraph and the paperwork paragraph aloud back to back. They should not contradict each other.
Time: an hour, and a look from whoever reviews your paperwork.
Decide what to do with the messages already sitting there
You almost certainly have clinical material in your ordinary inbox from before any of this. Deleting it is not automatically the right move, because retention rules for clinical records vary by state and by your own record-keeping policy.
The practical step is to stop the flow first, using the edits above, and then take the question of what to keep and where to your own record-retention policy rather than to a cleanup session at eleven at night.
Time: a conversation, not a task.
If you only do one thing
Rewrite the automatic reply that goes out when someone submits your contact form, and add one sentence to it about keeping details out of email. It takes half an hour, it reaches every future inquiry, and it is the message a client reads at the exact moment she is deciding whether you are careful.
The rest can wait for a quiet afternoon.
If the contact form on your site is the part you are unsure about, the step-by-step guide to a HIPAA-aware contact form covers the build side of it. Or you can book a free consultation and we will look at what your site is currently inviting people to send — that review is usually part of building a website for a therapy practice rather than a separate job.