Estimated reading time: 5 minutes.
Summarize with ChatGPT
Pop quiz: Someone is visiting your website and decides you might be the right therapist for them. When they go to your Contact page to get in touch, what should they find?
Answer: Start with a secure contact form. After they've submitted their first message, you can switch to secure email.
Both secure forms and secure email serve a purpose when communicating with clients, prospective clients, practitioners, and others while running your practice. HIPAA compliance isn't about choosing one communication method. It's about using the right tool at the right stage of the client journey.
Here's how the two tools can work together to keep your communication protected, compliant, and efficient.
TL;DR: Secure forms and secure email serve different purposes in a therapy practice. Use secure forms to collect structured information or complete a specific task, and use secure email for ongoing conversations and document sharing.
What to do next: Use a secure form when you need to collect structured information, and secure email when you need to continue a conversation.
You know your clients' PHI is covered by HIPAA. But information a prospective client shares in an inquiry may also be PHI and must be safeguarded to comply with HIPAA.
That's why you should consider security at every touchpoint in the client journey, starting before someone officially becomes your client.
👉 For a refresher on what counts as protected health information, read What counts as PHI?
But it's not only about safeguarding information. It's also about ensuring a good client experience and keeping your business running smoothly.
That's where secure forms and secure email can work together.
Read on to learn the difference between the two tools and when you should use each one.
An online form is a digital version of a paper form that you can complete and view online. A secure version safeguards sensitive information with encryption and protected storage.
A secure online form helps you:
👉 Read to learn more: Online Forms Explained.
Secure email is a security-enhanced alternative to regular email. It helps safeguard client communication, information, and documents in a private, password-protected online space, away from anyone who shouldn't have access. The HIPAA Privacy Rule allows covered healthcare providers to communicate with clients by email when reasonable safeguards are in place.
Secure email helps you:
👉 Read to learn more: Is Sending Email Securely Enough? What Therapists Should Consider About Client Privacy
While it might seem simpler to use just one tool for your small practice, secure forms and secure email each serve different purposes. They're both important for keeping communication secure and supporting HIPAA compliance.
Here's a quick guide to when each tool works best:
| Use a secure form for collecting structured information | Use secure email for ongoing communication |
|---|---|
| First contact | Replying to messages |
| Onboarding clients | Following up with clients |
| Getting informed consent | Sending documents |
| Collecting insurance information | Communicating with insurers and other practitioners |
| Providing self-administered questionnaires | Using templated responses |
| Receiving referrals | Sending referrals |
Because secure forms and secure email each serve different purposes, you'll often need to use both within a single workflow. Communication will naturally move from one tool to the other, depending on your needs at the moment.
For example, here's one way secure forms and secure email can work together to keep PHI safe and your practice running smoothly:
The right tool can change as the interaction moves from collecting information to having a conversation.
Yes. If someone has your email address, they can email you directly, and you can't control what information they include. If a prospective client contacts you by regular email, move the conversation to secure email when you reply and use that secure channel going forward.
You can reduce the likelihood of prospective clients sending sensitive information through regular email by making a secure contact form the primary way to get in touch through your website.
We don't recommend publishing your email address on your website. Instead, make a secure contact form the primary way for prospective clients to get in touch. That gives them a clear, secure place to send information from the start.
If someone has your email address and contacts you directly, move the conversation to a secure channel when you reply.
Website services like Squarespace often come with built-in forms. Squarespace, for example, says its Form Blocks can’t be used as part of a HIPAA-compliant solution. Even when you don't request sensitive health information, someone might include it in their message. Instead, add a HIPAA-compliant secure form to your website so sensitive information is protected from the start.
Yes! A secure file transfer form allows you to receive confidential documents and files from your clients. It's a simple way to protect sensitive information and make file sharing easy, without using email attachments. Once the client submits the form, the files they uploaded are encrypted and protected.
Yes. Forms aren't practical for ongoing conversations, and email containing PHI needs the right safeguards. For the best client experience and an efficient workflow, use a combination of secure forms and secure email.
You could, but we don't recommend it. Secure forms create a better experience for you, your clients, and other professionals you work with. Forms are designed to collect structured information and complete specific tasks.
HIPAA compliance isn't about choosing one communication method. It's about using the right tool at the right stage of the client journey.
Both should be part of one communication workflow. Together, they:
Fortunately, Hushmail offers both tools in one service.
See how Hushmail combines secure web forms and secure messaging in one workflow.
Reviewed by: Steven O. Youngman, VP of Legal and Compliance, Hushmail.