Free tool · HIPAA readiness check
Is your website a HIPAA problem? Find out in about a minute.
Most therapists ask this quietly and never get a straight answer. This free self-check walks you through the handful of things that actually matter — with an optional quick look at your own site — and shows you, in plain English, where the risk is and how to fix it.
This is a quick self-check to help you ask better questions — not a compliance certification, and not legal advice. Your exact obligations depend on your setup; confirm them with a qualified HIPAA compliance professional.
Free tool · takes about a minute
Check your website’s HIPAA readiness
A few plain-English questions — optionally with a quick look at your own site — and we’ll show you where a therapy website tends to run into trouble, and how to fix it. Nothing you answer leaves your browser.
How this works
What we can see, what we can’t, and what we keep
What the optional scan looks at
If you paste your address, we read only your public homepage — the same page anyone can visit. We check for a padlock (HTTPS), forms that look like they ask for health details, and embedded scheduling or telehealth tools.
What it can’t see
We can’t see behind logins, inside your booking or records tools, or whether a vendor has signed a Business Associate Agreement. That’s what the questions are for — your knowledge always wins over what we noticed.
What we do with it
Nothing is stored. Your answers never leave your browser, and the only thing sent for the optional scan is the public address you type — never anything a visitor would submit.
Want the full background first? Read the honest version of HIPAA and your therapy website.
Rather not do it yourself?
We can build you a site that stays clear of this by default
Design for Counselors is a calm, accessible therapy website that never asks visitors for health details — so most of this worry simply doesn’t apply. Leave your details and we’ll be in touch.
Please don’t include any client or health details in your note — just tell us about your practice and your site.
Questions
Common questions about the HIPAA website check
Is this a HIPAA compliance certification?
No — and we’re careful never to imply otherwise. It’s a quick self-check that flags the common places a therapy website tends to create HIPAA risk, in plain English, with a fix for each. It’s educational, not legal advice, and it can’t certify anything. For your specific obligations, confirm with a qualified HIPAA compliance professional.
Do you store my answers or my website address?
No. The questionnaire runs entirely in your browser — your answers are never sent anywhere. If you choose the optional scan, the only thing sent is the public address you type, we read just that one public page, and we store nothing about it.
What does the score actually mean?
It’s a simple, transparent heuristic: we start at 100 and subtract points for the things that genuinely move HIPAA risk on a marketing site — chiefly a form that asks for health details. The number is there to make the result easy to read; the reasons and fixes underneath it are what actually matter.
Is a marketing website even covered by HIPAA?
Usually not — a public marketing site isn’t a records system, so as long as it never collects health information it generally sits outside HIPAA. The risk appears when a form invites a visitor to share symptoms, a diagnosis or history. Our deeper guide walks through exactly where the line sits.
What if the check flags problems on my site?
Every flag comes with a plain-English fix you can act on yourself — usually trimming a form, routing intake to a BAA-backed tool, or adding a short note. If you’d rather hand it off, ThatNerdKnows builds calm, HIPAA-mindful therapy websites; there’s a link right on your result.
Related: HIPAA & your website · therapist website templates · tour the live demo.