Estimated reading time: 10 minutes
If you're a therapist with a physical office, you've likely set up a Google Business Profile to help local clients find you. It's a smart move because showing up in "therapist near me" searches can help grow your practice quickly.
However, a security consideration is hiding in plain sight: the appointment link feature might not be as secure as you think.
In this guide, you will learn:
This guide is specifically for therapists with physical offices — but don't worry, there's also a quick tip for telehealth practices.
When you set up your Google Business Profile, you'll discover a helpful feature that allows potential clients to book appointments directly from your listing. You'll find this option by navigating to your Dashboard, clicking on Bookings, and then selecting "Add appointment link."
According to Omar Ruiz, who specializes in helping therapists optimize their online presence through Private Practice Marketing, “Therapists can add any booking link they'd like to their Google Business Profile, which will show up as 'Appointments' within their profile.”
This flexibility sounds wonderful at first. Unlike some platforms that restrict you to specific booking partners, Google lets you add any URL you want. You might think, "Great! I'll link to my scheduling software (though depending on which one, it may not be HIPAA-compliant) or my website's contact page." But this is precisely where the security concern arises.
Many well-meaning therapists unknowingly create vulnerabilities by linking to:
Here's a scenario on why this matters: Imagine a potential client named Sarah finds your profile while searching for help with postpartum depression. She clicks your appointment link at 2 AM when she's feeling particularly vulnerable. The link takes her to a standard contact form where she pours out her heart, sharing intimate details about her struggles, her family situation, and her mental health history.
If that form isn't properly secured, Sarah's deeply personal information could be:
Unlike your Psychology Today profile, which provides a disclaimer about email security on their contact forms, Google's appointment link feature comes without security guidance, because they're simply providing the linking capability, not the actual booking service. This creates a gap where well-intentioned therapists may not realize the security implications of their appointment link choices.
💡 Quick note: The "Book Online" button in Google Maps, as shown below, requires Google-approved partners.
Example: "Book Online" button in Google Maps
This guide focuses on the "Appointment Link" in your Business Profile, which you can customize. It's more flexible but requires more careful consideration from a security standpoint.
Example: "Appointment Link" option in Google Business Profile
Let's clear up a common misconception that could put your practice at risk: many therapists believe HIPAA regulations only kick in once someone officially becomes a client.
According to HIPAA regulations, Protected Health Information (PHI) includes any information about past, present, or future healthcare services. The word "future" is crucial.
The moment someone reaches out to inquire about your services, shares why they're seeking therapy, or provides any health-related information along with identifying details, you become responsible for protecting that information.
“There's a great deal of confusion surrounding what constitutes PHI,” explains Liath Dalton, director of Person Centered Tech, a company that helps therapists navigate technology and HIPAA compliance.
"Even if a person isn't a client yet, the fact that they're contacting you about future healthcare services makes you responsible for protecting their PHI. Those initial contact forms must be secure."
Liath Dalton
Director, Person Centered Tech
If you think about it, the appointment link on your Google Business Profile is often the first point of contact between you and a potential client. It's their introduction to your practice, their first step toward getting help. When they click through and begin sharing personal information — their struggles with anxiety, their relationship difficulties, their trauma history — that information immediately falls under HIPAA protection requirements.
The people reaching out to you are often in vulnerable states, taking a brave step to seek help. They deserve to have their privacy protected from that very first interaction.
We've established that your HIPAA obligations begin at the first point of contact. But securing that initial form is only the beginning.
When messages arrive through unsecured channels and land in a regular email account, they create ongoing vulnerabilities such as:
Consider these scenarios:
This is why HIPAA's "reasonable technical safeguards" requirement matters so much. The Security Rule mentions encryption as an "addressable implementation specification,” which means if it's reasonable to use encryption, you should do so or carefully document why you haven't.
When you use your Google Business Profile to invite client contact, you're actively encouraging communication. If that communication happens through an insecure method and something goes wrong — a data breach, a stolen device, a hacked account — you need to demonstrate that you took reasonable measures to protect it.
One such measure? Providing a secure form link instead of an unsecured contact method. It's not just about being careful after receiving information — it's about creating secure pathways from the very beginning.
So, how do you protect client information from that first click through every backup and device?
Let's walk through exactly how to secure your appointment process without making it complicated for clients. Here's how to create a secure appointment process for your Google Business Profile with Hush™ Secure Forms.
Log in to your Hushmail account and navigate to Secure Forms. The intuitive builder lets you add fields for name, contact information, reason for seeking therapy, and preferred appointment times.
For a step-by-step guide, visit How do I build my secure form in Hushmail?
Hush™ Secure Forms will generate a unique, secure URL for your form. This replaces any unsecured links you're currently using.
Go to Dashboard → Bookings and paste your secure form URL into the appointment link field. Save changes.
Search for your practice on Google and click the appointment link. Ensure everything works smoothly from a client's perspective.
With Hush™ Secure Forms, you get:
Since you're already updating your profile for security, here are Omar's essential tips to make it work harder for your practice:
Keep in mind that different licenses have varying ethical guidelines regarding soliciting reviews. Check your professional code of ethics and consider asking colleagues or referral partners for reviews if client reviews are restricted.
Learn more: How to Respond to Online Reviews in a HIPAA-Compliant Way
💡 Telehealth practice tip: Even without a physical office, you can create location-specific pages on your website for surrounding areas. For example, if your business is registered in Boston, create pages for "Teletherapy for Brookline residents" or "Online therapy in Cambridge." These pages can rank well for location-based searches even when people search with "near me" modifiers.
Making these changes doesn't have to be overwhelming. Here's a practical timeline for securing and optimizing your Google Business Profile:
Today (30 minutes):
This week (2–3 hours total):
Ongoing (15 minutes weekly):
Your Google Business Profile is a powerful tool for attracting local clients. There's no need to sacrifice security for visibility!
By implementing a secure appointment process with Hush™ Secure Forms, you demonstrate professional standards from the first interaction. When potential clients see that you take their privacy seriously from the start, it builds the trust that's essential for your practice.
Ready to create a more secure intake process?
Hushmail for Healthcare comes with secure forms included, as well as encrypted email and other features designed specifically for healthcare providers.
Special thanks to Omar Ruiz of Private Practice Marketing for sharing his Google Business Profile expertise.