TL;DR
Squarespace is a genuinely polished website builder for a solo or small therapy practice's public marketing presence. The hard limit arrives the moment your site touches protected health information (PHI): Squarespace does not sign a Business Associate Agreement (BAA) for its core platform, including forms, email, analytics, and member areas. Plenty of therapy practices run their public site on Squarespace and route anything clinical (intake forms, scheduling, session notes) to a separate HIPAA-aware tool. This page covers that setup honestly, where Squarespace falls short for therapists, and when Solo is the better default.
What PHI actually means on a therapy website
A contact form that asks "What brings you in?" collects PHI. A general "Name / email / message" form probably does not, but if the visitor's reply describes their symptoms or current treatment, the submission is PHI by context, even if you didn't ask for it.
Squarespace's own documentation is explicit: its contact form block, email campaigns, and analytics pipeline cannot be part of a HIPAA-compliant solution. That is not a bug in Squarespace; it is a deliberate scope decision. The platform is built for marketing, not clinical workflow. A therapy practice can absolutely use Squarespace, but it needs to build a firm boundary between the public marketing site and any clinical-data touchpoint.
Squarespace's HIPAA posture (what it will and won't sign)
Squarespace does not offer a BAA for the core website platform. This means the following are outside HIPAA compliance on Squarespace without an external workaround:
- Form blocks. Do not collect PHI through a Squarespace form block. Replace them with a HIPAA-aware form provider: Hushmail Forms, Jotform HIPAA, IntakeQ, SimplePractice, or your EHR's native intake portal.
- Email campaigns. Squarespace's email product is not BAA-eligible. Do not send clinical content through Squarespace Email.
- Scheduling embeds. Acuity Scheduling (a separate Squarespace product) can be configured to support a BAA on the Premium plan (~$49/month). The embedded Acuity block on a Squarespace marketing page can point to that BAA-eligible scheduler.
- Analytics. Squarespace analytics does not offer a BAA. If your practice uses marketing pixels that fire on a thank-you page after a clinical form submission, those pixels may inadvertently capture PHI. Audit and remove them.
In practice: therapists widely use Squarespace for homepage, bio, specialties, blog, testimonials, and outbound links to HIPAA-aware scheduling. That usage pattern is defensible. A form that routes clinical intake to your EHR (SimplePractice, TherapyNotes, TheraNest) via an iframe or external link is fine. A Squarespace form block that receives "I'm struggling with anxiety and trauma and want to schedule a session" is not.
Where Squarespace works well for therapists
- Credible-looking sites without a designer. The template library is strong. A solo therapist can launch a clean, professional-looking site on a weekend, which beats delaying the site indefinitely.
- Good for "soft" content. A bio page, a specialties page, a FAQ page, a blog about coping skills or therapeutic modalities — this is Squarespace's sweet spot. The design holds up, the blog is usable, and the editor is approachable.
- Mobile-first rendering. All templates are responsive by default. Mobile-first indexing won't punish a default Squarespace site.
- Bundles hosting, SSL, and domain in one bill. A solo practitioner doesn't want to manage servers. Squarespace handles it, which matters for a practice that should be thinking about clients, not infrastructure.
- Blog for thought leadership. Content marketing is genuinely effective for therapists — "how CBT works," "[city] EMDR therapist," "what is attachment theory" rank in local and informational search. Squarespace's built-in blog is enough for a modest content strategy.
Where Squarespace breaks down for therapists
- No BAA on core forms. Detailed above. This is the most consequential limitation and the reason most therapy-focused web designers recommend Squarespace paired with an external HIPAA-aware intake tool rather than an all-in-one Squarespace site.
- SEO ceiling is real. Marketing firms that specialize in therapist SEO consistently note that Squarespace's customization surface is shallow compared to WordPress. You can set titles, meta descriptions, and image alt text, but granular schema, redirect management, and programmatic local SEO pages are awkward.
- Limited automation. Therapy practices benefit from automated appointment reminders, follow-up sequences, and waitlist management. Squarespace has no native equivalent. You add these via Zapier, which adds cost and brittle integrations.
- Template lock-in. Picking a new visual direction mid-life means a rebuild, not a switch. Not unique to Squarespace, but real friction for a practice that wants to evolve its brand.
- Forms can't carry conditional logic. A mental-health screening intake often needs branching (if the client answers "yes" to this question, show this follow-up). Squarespace forms are flat. You need an external form tool for anything more complex.
Solo's position for a solo therapy practice
Solo is designed for the one-to-three practitioner service business that needs a credible marketing site without becoming a part-time web developer. Here's how that maps to a solo therapist:
- Free tier with a connected custom domain. A solo therapist launching a practice can point their domain at Solo before committing to a paid plan. Squarespace requires a paid subscription once the trial ends.
- Blog with SEO sidebar and AI drafting. Solo's blog is built around content velocity: title and meta audits, internal link suggestions, FAQPage JSON-LD on pages that have Q&A sections. A therapist who wants to write six posts per year on common client concerns benefits from a content platform, not just a blog box.
- Structured data by default. LocalBusiness schema, Article schema on posts, FAQPage schema on FAQ blocks, BreadcrumbList on nested pages — these ship without a plugin or a custom code block. A solo practice competing in a mid-size city needs every structured-data signal it can get.
- Honest about PHI boundaries. Solo does not collect PHI and does not offer a BAA. The correct architecture is identical to Squarespace: public marketing site on Solo, clinical workflow (intake, scheduling, messaging) on a HIPAA-aware platform (SimplePractice, TherapyNotes, Headway, your EHR). Keeping the marketing site out of the PHI picture means a smaller, more predictable attack surface.
- Mozilla-built posture. For therapists whose clients are privacy-sensitive (which is most of them), the Mozilla brand association signals "this is not a growth-hack tool" in a way that some therapy-forward clients notice.
Side-by-side: Squarespace vs Solo for a therapy practice
| Feature | Squarespace (Basic / Core / Plus) | Solo |
|---|---|---|
| Starting price (annual billing) | $16/mo (Basic) -- $39/mo (Plus) | Free tier with custom domain |
| HIPAA BAA on core contact forms | No -- Squarespace documents this explicitly | Not applicable -- Solo does not handle PHI; use HIPAA-aware intake tools |
| HIPAA BAA on scheduling | Yes, via Acuity Scheduling Premium (~$49/mo separate) | Link to HIPAA-aware scheduler (SimplePractice, Acuity Premium, TherapyNotes) |
| Blog and SEO tooling | Built-in blog; titles, meta, sitemap; shallow customization | Blog with SEO sidebar, AI drafting, FAQPage + LocalBusiness schema by default |
| Structured data | Basic schema; no automated LocalBusiness or FAQPage JSON-LD | LocalBusiness, Article, FAQPage schema ship without plugins |
| Best fit | Design-led solo practices that want visual polish and will wire up an EHR intake stack | 1-3 clinician practices that prioritize content, local SEO, and low overhead |
The correct architecture for a HIPAA-safe therapy website
Regardless of whether you use Squarespace or Solo, the architecture is the same:
- Public marketing site (Squarespace or Solo): homepage, bio, specialties, blog, FAQ, testimonials, contact page with a link (not a form) to your intake tool.
- HIPAA-aware intake tool (SimplePractice, TherapyNotes, TheraNest, Headway, IntakeQ, Jotform HIPAA): the intake form, session scheduling, secure client messaging, and session notes live here. This vendor signs your BAA.
- Scheduling embed or link: either embed your HIPAA-compliant scheduler via an iframe (provided the embed itself doesn't pass PHI through the parent URL), or link out with clear copy like "Book a free consult →".
- Audit your pixels: if you run Google Analytics or Meta Pixel on your marketing site, make sure those pixels don't fire after a clinical form submission. Configure exclusions at the trigger level.
This setup keeps PHI entirely outside the marketing CMS and concentrates clinical-data responsibility in a purpose-built tool that has already done the HIPAA engineering.
HIPAA-aware tools that pair well with Squarespace or Solo
- SimplePractice -- most popular EHR for solo/small group private-practice therapists; handles scheduling, telehealth, intake, notes, billing, and offers a client portal. Signs a BAA.
- TherapyNotes -- popular with larger practices; strong notes and billing; client portal signs a BAA.
- TheraNest -- strong for practice management; BAA available.
- Headway -- insurance-credentialing + EHR platform aimed at modern private-practice therapists; signs a BAA.
- IntakeQ / Acuity Scheduling (Premium) -- HIPAA-aware intake forms and scheduling if you prefer a lighter tool.
- Hushmail for Healthcare -- HIPAA-compliant email and forms for smaller practices that don't need a full EHR.
Five steps for a therapist launching or migrating a website
- Pick your EHR first. The EHR choice determines which intake and scheduling tools you get. Map your website design to the EHR, not the other way around.
- Build the public marketing site. Homepage, about page, specialties, FAQ, blog, a contact page that directs visitors to your EHR intake link. Do not put a form on this page that could collect PHI.
- Audit your forms. Every field that could prompt a PHI response ("What brings you in?", "Current medications?", "Previous therapist?") belongs in the EHR intake flow, not on the marketing site.
- Add structured data. LocalBusiness schema with your practice name, address, phone, and specialty signals trust to search engines and populates the Google Knowledge Panel for local search.
- Start a content rhythm. Four to six blog posts per year on specific concerns (anxiety management for healthcare workers in [city], preparing for EMDR therapy, etc.) compounds over 12-18 months into meaningful local search presence. Solo's SEO sidebar makes this less tedious.
Why use Solo for this page?
An honest look at using Squarespace for a solo or small therapy practice -- including the HIPAA/BAA boundaries and where Solo is the better default for content and local SEO.
Is Squarespace HIPAA compliant for a therapy practice?
Not for its core platform. Squarespace does not sign a Business Associate Agreement (BAA) for its contact form blocks, email campaigns, analytics, or member areas. A therapy practice can use Squarespace for its public marketing site, but must route any contact form that could collect PHI to a HIPAA-aware tool (SimplePractice portal, IntakeQ, Jotform HIPAA, or Hushmail) rather than a native Squarespace form. Acuity Scheduling (a separate Squarespace product) can be configured to support a BAA on the Premium plan.
What booking tools are HIPAA compliant for therapists?
Widely used options that sign BAAs include SimplePractice (full EHR with scheduling and client portal), TherapyNotes, TheraNest, Headway, IntakeQ, and Acuity Scheduling on the Premium plan. The correct pattern is to keep the public marketing site on Squarespace or Solo and link out to one of these tools for anything that touches PHI -- do not attempt to make a Squarespace or Solo contact form the intake channel.
Should I use Squarespace or Solo for my therapy practice website?
Choose Squarespace if visual polish and template choice are the deciding factors and you are comfortable maintaining a separate HIPAA-aware intake and scheduling stack. Choose Solo if you want a free tier with a connected custom domain, a blog with an SEO sidebar and AI drafting, built-in LocalBusiness and FAQPage structured data, and a platform that leans into content velocity for local SEO. Both tools have the same HIPAA boundary -- neither handles PHI natively -- so the choice comes down to design priority vs. content-and-SEO priority.
Can a Squarespace contact form collect mental health intake data?
No. Squarespace's own help documentation states that its contact form blocks cannot be part of a HIPAA-compliant solution. Do not collect mental health history, diagnoses, medication lists, symptom descriptions, or other PHI through a Squarespace form. Use your EHR's client portal or a HIPAA-certified form provider (IntakeQ, Jotform HIPAA, Hushmail Forms, FormDr) and link to it from your Squarespace site.
What SEO strategies work for private practice therapists?
Local SEO is the highest-leverage channel for most solo practices. Key tactics: claim and optimize your Google Business Profile; add LocalBusiness and Person schema to your site; write specialty-and-city-specific content (e.g., 'EMDR therapist for first responders in [city]'); build FAQ pages around common client questions that match informational queries. Solo's blog ships with FAQPage JSON-LD on pages with Q&A content, which can help FAQ answers appear in rich results. Squarespace requires you to add schema manually via a code block or a third-party SEO tool.
What does a therapy practice website need to include?
Homepage with clear specialty and location, a detailed about/bio page, a specialties or services page (one page per focus area improves topical authority for local search), a FAQ page addressing common client concerns, a contact page that links to your HIPAA-aware scheduling tool (not a native form collecting PHI), and optionally a blog for content marketing. Avoid collecting clinical information through the CMS; that belongs in the EHR workflow.
