Web Hosting for Therapists and Counselors

The most sensitive contact form on the internet

Look at the contact form on most counselling websites and you will find a large open box labelled something like "Tell us what brings you in" or "How can we help?". People answer it honestly. They write about a diagnosis, a marriage, a child, a relapse, a death. They write it because the site asked.

Then that text is emailed. It sits in an inbox, possibly forwarded, possibly read on a phone on a bus, possibly stored on a mail service nobody chose deliberately. Nothing on the page told the person any of that would happen.

This is the single failure worth fixing on a therapy website, and the fix is not technical. It is a writing decision. Stop asking for the clinical detail.

What to ask for instead

• A name, or a first name only if they prefer.
• How they want to be contacted back, and whether it is safe to leave a message.
• Whether they are looking for individual, couples or family work, as a short list of choices rather than a paragraph.
• Insurance or self-pay, if that shapes who you can see.
• A general availability note. Weekdays, evenings, that kind of thing.

That is enough to start a phone call, which is where the real intake belongs anyway. Under the form, say plainly what happens next and how long it usually takes. Add one line that this form is not confidential and not for emergencies. People respect that line. It also stops the disclosure before it is written, which is a great deal better than protecting it afterwards.

The "is it safe to leave a voicemail" question matters more than any of the rest. For a client living with somebody they are afraid of, a returned call to the wrong number is not a privacy issue in the abstract. Ask it, and follow the answer.

What email can and cannot promise

Therapists ask about HIPAA more than any other trade we work with, and usually about the wrong part of the stack. The website itself, if it is a set of pages describing your practice, is not where the exposure lives. The exposure is in the messages people send you and where those messages come to rest.

A few things are worth separating out, because they get muddled together.

The certificate protects the trip, not the destination

An SSL certificate encrypts the form submission between the visitor's browser and the server. That is necessary and it is table stakes, but it says nothing about what happens next. The message still becomes an email, and that email lives wherever your mail lives, for as long as you keep it.

Ordinary email is not a secure channel

Standard email between two providers is generally encrypted in transit these days, but it is stored in plain form at both ends and it can be forwarded, printed, synced to a phone and left on a laptop. Free consumer mail accounts are a poor place for any of this, and a practice address at your own domain is the minimum. Our business email page covers what that involves.

If you need a covered arrangement, ask for it in writing

Where protected health information is genuinely handled by a vendor, the arrangement is normally documented in a business associate agreement, and not every provider offers one for every product. Microsoft 365 is the usual route practices take, but which plan and which written agreement you need is a question for your own compliance adviser, not for a hosting company. Do not accept a verbal assurance from anyone, including us.

The practical version of all this: keep clinical content off the website entirely, use the site to arrange a phone call, and do the rest inside whatever platform your practice has already vetted for records and telehealth.

Setting up web hosting for therapists in the right order

For a solo or small group practice, this is a short list and it goes in this order. Doing it out of order is how people end up paying for a site they cannot get into.

1. Register the domain in your own name

   Your name, your email, your card. Not the web designer's, not the practice manager's who may leave. Turn on privacy so your home address is not published in the public record, which matters more in this profession than most.

2. Get the mailbox working before the site

   A practice address at your own domain, set up and tested, before anything points anywhere. Email is the thing that breaks during a move and the thing you cannot afford to have broken.

3. Write the four pages that do the work

   Who you are and how you work. What you treat. Fees, insurance and what a first session involves. Contact, with the short form and the crisis block. Everything else is optional and most of it is filler.

4. Put the site on a small shared plan

   This is a handful of text pages. Shared hosting at the entry tier covers it comfortably, and the certificate should be included rather than sold separately.

5. Decide who edits it, and prove it

   Before you sign off, change something yourself. A fee, a line of availability. If you cannot, you do not really have a website, you have a subscription to somebody's memory.

One more thing that belongs here rather than in a crisis: know where the backup is and who can restore it. Our website backups page covers the difference between a host's copy and one you can actually reach.

How AldoMedia helps

AldoMedia has built and looked after websites for Western New York businesses since 1999, including practices in the health field. We are an independent authorised reseller rather than the operator of the underlying platform, and we are not your compliance adviser. What we can do is set up the domain, the mailbox and the hosting so they belong to you, and rebuild a contact form that stops inviting a paragraph nobody should have written by email.

If you have inherited a site and cannot get into it, the taking over a website page describes what to collect first. Call 716-771-2536 or tell us what your practice site runs on, and if the plan you have is already right, we will say so.