What HIPAA and APA Actually Require for Your Psychology Practice Website (And What They Don't)

The HIPAA Privacy, Security, and Breach Notification Rules apply to covered entities and business associates. For a psychology practice subject to HIPAA, a website feature enters the HIPAA compliance program when it creates, receives, maintains, or transmits PHI. Public educational pages do not become PHI merely because they discuss health, but identifiable information submitted in a care-seeking context can be PHI.

Website features that can handle PHI include:

• Contact forms asking about symptoms, diagnoses, treatment history, or reasons for seeking care
• Online scheduling systems that connect identifiable people with appointment reasons or care
• Patient portals with records or secure messaging
• Intake forms collecting identifiable health or insurance information

Features that usually do not create PHI by themselves include:

• Public blog posts and educational resources
• Public descriptions of services and credentials
• A Business Profile listing that does not disclose patient information

Name, email, phone number, IP address, page context, appointment details, and health information must be assessed together. Do not assume a “general” form is outside HIPAA merely because it omits a diagnosis field.

Controls when a website handles ePHI can include:

• Appropriate transport protection and secure downstream storage
• A BAA with each vendor that creates, receives, maintains, or transmits PHI on the practice's behalf
• Access controls, workforce procedures, risk analysis, and activity review appropriate to the system
• Documented incident and breach-response procedures

This is educational content, not legal advice. Consult qualified privacy counsel for your specific practice and data flows.

For Psychologists subject to the APA Ethics Code, Standards 5.01-5.06 govern public statements about professional services across websites, directories, social media, and SEO content. State law and licensing-board rules apply independently.

Standard 5.01 - Avoidance of False or Deceptive Statements:

Public statements must not be false, deceptive, or misleading because of what they state, imply, or omit. This includes:

• Claiming expertise without the relevant training or experience
• Using “best,” “top,” “leading,” or similar superlatives when the conveyed claim cannot be substantiated
• Implying guaranteed treatment outcomes
• Misrepresenting credentials, degree, licensure, services, fees, or evidence

Standard 5.02 - Statements by Others:

Psychologists remain responsible for public statements made by others they engage to promote their professional practice, products, or activities. Marketers therefore need accurate source material and review controls.

Standard 5.04 - Media Presentations:

Professional advice or comment presented through media should be based on appropriate psychological literature and practice, remain consistent with the Ethics Code, and avoid implying that a professional relationship was established with the audience.

Accurate public content can include:

• Training, credentials, and experience the psychologist actually holds
• Factual descriptions of the approaches and services actually offered
• Educational content within the psychologist's competence
• Claims whose meaning and evidence can be documented

Verify the current APA Ethics Code and every applicable state-board rule.

Testimonials sit at the intersection of HIPAA, professional ethics, advertising law, and state-board rules.

HIPAA marketing use:

When a HIPAA-regulated practice uses or discloses an identifiable patient's testimonial for marketing, it generally needs a valid HIPAA authorization that specifically covers that use. A patient's independent public post is not itself a disclosure by the practice, but the practice can create a disclosure by confirming the relationship, adding treatment details, or republishing the testimonial.

APA Standard 5.05 - Testimonials:

Psychologists do not solicit testimonials from current therapy clients or patients, or from other people who are vulnerable to undue influence because of their circumstances. The standard does not impose a categorical waiting period on every former client; former-client solicitation still requires analysis of vulnerability, other Ethics Code duties, state rules, and the continuing power relationship.

Unsolicited public reviews:

• Do not confirm or deny that the reviewer was a patient
• Do not disclose treatment, appointment, or billing details
• Evaluate state-board restrictions before republishing or featuring a review
• Use a neutral response, if any, that does not imply a professional relationship

Practical approach:

Do not solicit testimonials where APA Standard 5.05 or another applicable professional rule prohibits it. Establish a written review-response policy and obtain qualified advice before using patient-authored material in the practice's own marketing.

Online scheduling can reduce booking friction, but its compliance obligations depend on the information collected and every system that receives it.

Scheduling data can be PHI when it connects an identifiable person with care, including:

• Reason-for-visit or presenting-concern fields
• Intake questionnaires
• New-client or existing-client status
• Insurance and appointment information

When a scheduling vendor handles PHI on the practice's behalf:

• The vendor is a business associate and an appropriate BAA is required
• The practice must include the platform in its risk analysis and access controls
• Data needs appropriate safeguards in transit, at rest, and through downstream integrations
• Incident and breach procedures must account for the scheduling data

Platforms may market healthcare features or offer BAAs, but neither a label nor a signed agreement makes every configuration compliant. Minimize fields, separate intake when appropriate, and test what reaches email, calendars, analytics, and advertising tools.

SEO and conversion:

Convenient scheduling can improve user experience and measured conversion, but Google does not publish appointment-widget engagement as a local-ranking signal. Evaluate it through completed bookings and privacy-safe attribution.

For the broader search strategy, see our SEO for Psychologists done within HIPAA and APA guidelines resource.

State psychology-board and professional-advertising rules apply independently of HIPAA and the APA Ethics Code. Requirements vary by jurisdiction and can change through statutes, regulations, board decisions, and guidance.

Items to verify directly for every jurisdiction in which the psychologist practices or advertises include:

• License-number and license-type disclosures
• Permitted credential, specialty, certification, and “Dr.” representations
• Rules for supervised or associate practitioners
• Telehealth and cross-border advertising requirements
• Testimonials, endorsements, outcome claims, fees, and required disclaimers

Do not rely on a generic national summary for California, Texas, New York, or any other state. Check the current board source and governing law, document the effective date, and obtain qualified advice where the rule is ambiguous.

If the practice serves multiple states, comply with the rules that actually apply in each jurisdiction; do not assume that adopting one state's rule automatically satisfies the others.

Review applicable board materials whenever services, licensure, advertising claims, or jurisdictions change, and perform a scheduled review at least annually.

Compliance constraints don't prevent effective SEO for psychology practices-they shape how you implement it. Understanding what's permitted helps you optimize confidently rather than avoiding digital marketing entirely.

Content marketing within APA ethics:

• Educational blog posts on mental health topics within your competence
• Accurate descriptions of therapeutic approaches you use
• Information about what patients can expect in treatment (without outcome guarantees)
• Resources about when to seek professional help

Local SEO within compliance:

Google Business Profile optimization is permissible and effective. You can:

• Accurately list your credentials, specialties, and services
• Post educational content and practice updates
• Respond to reviews carefully (see testimonial section)
• Maintain accurate location and contact information

Technical SEO without compliance concerns:

Most technical SEO-site speed, mobile optimization, proper heading structure, schema markup-has no compliance implications. These improvements help patients find you without creating HIPAA or ethics issues.

Directory listings:

Psychology Today, GoodTherapy, and similar directories are valuable for visibility. Ensure your profile information:

• Matches credentials exactly as licensed
• Doesn't make prohibited claims about outcomes or superiority
• Reflects your actual areas of practice

What requires careful handling:

• Forms collecting health information
• Chat widgets that might receive PHI
• Analytics and advertising tags: map page context, events, URLs, identifiers, and disclosures; Google Analytics offers no HIPAA BAA and must not receive PHI
• Any feature where patients might disclose health information

For a comprehensive approach to growing your practice online while maintaining ethical standards, explore our guide to compliant SEO approach for therapy practices.