What HIPAA, State Boards & the FTC Actually Require from Your Massage Therapy Website

Every state regulating massage therapy has rules about how practitioners must identify themselves in advertising — and your website counts as advertising. While specific requirements vary, most state massage boards require some combination of the following:

• License number display — Many states mandate your license number appear on all advertising, including websites, business cards, and online directories
• Credential accuracy — Using titles like 'LMT,' 'CMT,' or 'Licensed Massage Therapist' when not properly licensed in that state violates most board rules
• Practice location disclosure — Some states require listing the physical address where services are rendered
• Continuing education claims — Advertising specializations or advanced training may require specific documentation on file

The penalty for violations ranges from warnings to license suspension, depending on severity and your state's enforcement approach. In our experience working with massage therapists across multiple states, the most common violation is failing to update website credentials after license renewal or when adding new certifications.

Disclaimer: This is educational content, not legal advice. State requirements change, and some states have minimal website-specific rules while others are highly prescriptive. Verify current rules with your state massage therapy licensing board before making compliance decisions.

A practical approach: download your state's current advertising regulations (usually available as a PDF on the licensing board website), then audit your website against each requirement. Document your compliance review annually.

HIPAA applies to massage therapists when you collect, store, or transmit protected health information (PHI) electronically — and online intake forms are the most common trigger. Here's where massage practices frequently misunderstand the rules:

What triggers HIPAA obligations:

• Online forms collecting health history, medications, conditions, or treatment goals
• Client portals storing session notes or health information
• Email communications containing PHI (appointment reminders mentioning treatment details)
• Integration with electronic health record systems

What typically does NOT trigger HIPAA:

• Simple contact forms collecting name, email, and phone number
• Online scheduling that doesn't capture health information
• Payment processing for gift certificates or retail products

When HIPAA applies, your obligations include using HIPAA-compliant form software (not standard WordPress contact forms), executing Business Associate Agreements with any vendors handling PHI, implementing encryption for data transmission and storage, and maintaining access logs.

Many massage therapists unknowingly use non-compliant form tools. Standard form plugins, Google Forms, and basic website builders rarely meet HIPAA technical requirements. HIPAA-compliant intake services exist specifically for healthcare practitioners — they cost more than free form tools but provide required safeguards.

Disclaimer: HIPAA compliance is complex and penalties are significant. This overview is educational — consult a healthcare compliance professional for your specific situation.

The Federal Trade Commission regulates advertising claims, including testimonials displayed on your website and in your marketing. For massage therapists, FTC guidelines intersect with state scope-of-practice rules to create specific boundaries.

What testimonials can include:

• Descriptions of the client experience (relaxing, professional, thorough)
• Service quality observations (punctual, clean environment, skilled technique)
• General wellness statements (felt better, reduced tension, improved mobility)

What testimonials cannot claim:

• Medical treatment outcomes (cured my sciatica, fixed my herniated disc)
• Diagnostic statements (she identified the source of my chronic pain)
• Therapeutic claims beyond massage therapy's legal scope in your state

The FTC also requires disclosure when testimonials come from anyone with a material connection to your business — employees, family members, or clients who received free services in exchange for reviews. Undisclosed incentivized reviews violate FTC endorsement guidelines.

Review solicitation compliance: You can ask satisfied clients for reviews, but you cannot selectively publish only positive reviews while hiding negative ones (this constitutes deceptive advertising), offer incentives contingent on review content or rating, or write reviews for clients to post under their names.

Google's review policies add another layer — offering discounts for reviews violates Google Business Profile terms and can result in review removal or listing penalties. Focus on making the review process easy for genuinely satisfied clients rather than manufacturing testimonials.

Your state's massage therapy practice act defines what services you can legally provide — and by extension, what you can advertise. Advertising services outside your scope of practice is both a board violation and potentially deceptive advertising under consumer protection laws.

Common advertising claim problems:

Medical treatment claims: Advertising that massage 'treats' conditions like fibromyalgia, arthritis, or chronic pain may exceed scope in many states. Safer language focuses on what massage provides (relaxation, improved circulation, reduced muscle tension) rather than medical outcomes.

Diagnostic language: Claims that you 'assess,' 'diagnose,' or 'evaluate' conditions typically require credentials beyond massage therapy licensure. Describing what you observe during intake is different from diagnosing underlying conditions.

Specialty claims: Advertising specific modalities (lymphatic drainage, myofascial release, craniosacral therapy) may require additional certification depending on your state. Some states regulate these as separate practices.

Title usage: Terms like 'therapist,' 'bodyworker,' or specific technique names may be regulated or protected in your jurisdiction. Using regulated titles without proper credentials violates most practice acts.

A practical approach: write website copy describing what you actually do in sessions, using your state practice act's language where possible. When in doubt, describe techniques and client experiences rather than therapeutic claims. Have a compliance-aware colleague or attorney review service descriptions before publishing.

Disclaimer: Scope of practice varies significantly by state. This is general guidance — verify allowable claims with your state licensing board.

The Americans with Disabilities Act applies to places of public accommodation — and courts have increasingly interpreted this to include websites of businesses serving the public. Massage therapy practices fall under this umbrella.

What ADA web accessibility means in practice:

• Screen reader compatibility — Proper heading structure, alt text for images, labeled form fields
• Keyboard navigation — All functionality accessible without a mouse
• Color contrast — Text readable for visitors with visual impairments
• Video captions — If you use video content, captions or transcripts for deaf/hard-of-hearing visitors
• Clear language — Content understandable at reasonable reading levels

WCAG (Web Content Accessibility Guidelines) 2.1 Level AA is the most commonly referenced standard in ADA website litigation. While no federal law explicitly mandates WCAG compliance, courts have used these guidelines as the benchmark.

Practical compliance steps: Run your website through free accessibility checkers (WAVE, axe DevTools) to identify obvious issues. Common problems include images without alt text, poor color contrast, missing form labels, and non-descriptive link text ('click here' instead of 'view our services').

For massage therapy websites specifically: ensure your online booking system is accessible, appointment confirmation emails are screen-reader friendly, and any client intake forms work with assistive technology. Many website builders now include accessibility features — enable them during setup rather than retrofitting later.

ADA website lawsuits against small businesses have increased. Basic accessibility improvements reduce legal exposure while serving clients with disabilities — good practice on both fronts.

Use this framework to review your website for common compliance gaps. This is educational guidance, not a comprehensive legal audit — consult appropriate professionals for your specific situation.

State licensing compliance:

• License number displayed per state requirements
• Credentials match current license status
• Practice location accurately listed
• Specialization claims supported by documented training
• Title usage consistent with state regulations

HIPAA compliance (if collecting health information):

• Intake forms use HIPAA-compliant software
• Business Associate Agreements in place with all vendors handling PHI
• Privacy policy accurately describes data handling
• SSL encryption active site-wide
• Client data storage meets security requirements

Advertising claim compliance:

• No medical treatment claims outside scope of practice
• No diagnostic language unless credentials support it
• Testimonials free of prohibited therapeutic claims
• Review solicitation follows FTC and Google guidelines
• Incentives/discounts for reviews properly disclosed or avoided

ADA accessibility:

• Images have descriptive alt text
• Forms have labeled fields
• Color contrast meets minimum standards
• Site navigable by keyboard
• Booking system accessible

Document your compliance review and any remediation steps taken. Annual reviews help catch issues as regulations evolve and your website content changes. For a complete assessment of compliance within your SEO strategy, explore compliant SEO for massage therapy practices.