The Hard Truth
Most web designers don't understand HIPAA. They don't know what PHI is or what a BAA is. They build therapy websites the same way they build coffee shop websites.
The platforms they use, the design philosophy they follow, and their lack of strong security practices — like CSP headers to prevent XSS and clickjacking attacks — make it worse.
Your patients trust you with their most sensitive information. Your website should reflect that trust — not undermine it.
This guide will help you:
- ✓ Understand what to look for in a therapist website designer
- ✓ Spot red flags before you sign a contract
- ✓ Ask the right questions
- ✓ Avoid designers who put your practice at risk
What to Look For
The right designer makes all the difference.
HIPAA-Conscious
They understand PHI, BAAs, and the difference between a marketing site and a patient portal. No contact forms, no PHI storage.
Hand-Crafted Code
No Wix, Squarespace, WordPress, or page builders. Just clean, fast code written from scratch.
Design Psychology
Color, typography, and layout shape how a visitor feels about your practice long before they read a single word about your services.
Speed & Performance
Sub-3s LCP, 90+ PageSpeed scores. Fast sites build trust and rank higher.
Privacy-First Analytics
Fathom or similar — no IP tracking, no cookies, no personal data. Just the numbers you need.
The Checklist
No page builders.
No bad design.
No PHI.
No bloat.
No excuses.
If they can't check all five, keep looking.
Design Psychology Matters
Your website's colors and fonts shape how a visitor feels before they read a single word. The wrong choices can create stress and anxiety — not trust.
Ask Your Designer
Do they understand how color and font choices affect patient anxiety and trust? If not, keep looking.
Red Flag
Designers who treat therapy websites like restaurants or home services often miss the subtle cues that make patients feel safe.
Red Flags to Avoid
If a designer does any of these, run.
- Building on page builders— They all store form data somewhere they shouldn't: dashboards, databases, or emails. Most form plugins offer zero HIPAA compliance. The ones that do often require expensive third-party add-ons or premium subscriptions. And that's before we get to the bloat, slow speeds, and security risks.
- They are plugin-happy — Many designers install SEO or performance plugins that promise results but barely move the needle. Each plugin adds another potential attack surface, slows your site down, and requires constant updates. One outdated plugin can compromise an entire site — and your patients' data.
- They don't know what HIPAA is — If they can't explain PHI, BAA, or the difference between a marketing site and a patient portal, they're not qualified.
- They dismiss speed — If they ignore Google's PageSpeed Insights scores or Core Web Vitals, they don't understand that slow sites often rank lower, can increase ad costs, and cause many visitors to leave before your site even loads. Studies show over 50% of mobile users abandon sites that take longer than 3 seconds — and new visitors suffer the most since they don't have your site cached (saved).
→ Your site should score 90+ on PageSpeed Insights. - They try to sell you a "patient portal" — Unless they're a HIPAA-compliant software company with a BAA and permanent legal team, they shouldn't be building patient portals.
- They guarantee #1 rankings — Nobody can guarantee rankings. Not even me. Run.
Some Questions to Ask Before Hiring
"Do you use liability waivers or disclaimers on forms?"
I've seen therapists rely on legal disclaimers on contact forms to "protect" themselves from HIPAA. That's not how it works. A waiver doesn't override federal law. You need secure communication channels. If they say "just add a disclaimer," run.
"Where are you located?"
If something goes wrong and they aren't located in the USA, pursuing legal action across international borders is exponentially more difficult and expensive. In some cases you could be left holding 100% of the legal and financial liability.
"What platform do you use?"
If they say Wix or Squarespace, ask about form storage and BAAs. If they say WordPress, ask which plugins they use and where data is stored.
"Do you guarantee rankings?"
If yes, they're lying. Nobody can guarantee rankings. Google doesn't sell them. There is no secret.
"What analytics do you use?"
Google Analytics collects IP addresses. Fathom Analytics —what I use— doesn't. The right answer is Fathom Analytics or similar.
"Have you heard about ADA lawsuits?"
If they say no or downplay this, run. ADA lawsuits are increasingly common — demand letters alone can cost thousands. All because of something as simple as font size. Make sure they understand how to minimize these risks.
Why This Matters
Your patients share their deepest struggles with you. They trust you to keep that information private. Your website is part of that trust — and a bad web designer can break it without you ever knowing.
The stakes are high:
- HIPAA fines — I'm sure you already know, but HIPAA fines are nothing to mess with.
- Reputation damage can kill a private practice.
- Patient trust is hard to earn and easy to lose.
- Slow sites rank lower than faster competitors and can increase your ad costs. On Google, the first page is the only page that matters.
What I Do Differently
No Page Builders. Ever.
I don't use Wix, Squarespace, WordPress, or any page builder. Every site is hand-crafted from scratch — fast, secure, and built to rank. No plugins. No bloat. No PHI sitting in a database.
Zero Contact Forms
Patients overshare in forms. It's human nature. A simple "name and phone" form can often end up with medical histories, insurance IDs, credit card information, and Social Security numbers. No forms means no PHI sitting in a database. Patients reach you through phone calls, secure emails, or your EHR's booking portal instead. Patients and visitors across numerous industries actually prefer these methods — and they convert better. Read why.
Design That Welcomes
The wrong colors create anxiety. The wrong fonts feel chaotic. Crowded pages overwhelm. I use intentional design — inclusive copy included — to make visitors feel safe, calm, and ready to reach out. Your website should work as hard as you do.
Security by Default
I implement security measures tailored to your website. These can include CSP headers, X-Frame-Options, HSTS, and other protections to defend against XSS, clickjacking, and data breaches. Your patients' data shouldn't be an afterthought — and I don't treat it like one.
Privacy-First Analytics
Fathom Analytics is my go-to as it collects no IP addresses, no personal data, and uses no cookies. Your patients' privacy stays protected — and you still get the numbers you need.
Bottom line:I build websites that prioritize patient privacy, clarity, and inclusivity — and your ROI. The right web designer makes all the difference.
Let's Talk About Your Practice.
If you're thinking about a new site—or not sure where to start—I'd love to hear from you.
Reach out
Call or email. Whatever works for you.
Talk it through
No pressure. Just a conversation about your practice.
Decide
Clear next steps. No obligation.
I build websites for mental health providers nationwide—remotely. But if you're based in or near Knoxville, TN, I'm happy to meet at your office.