Online Booking for Therapists: Intake Forms, Scheduling Software and What Has to Be HIPAA-Compliant

Most prospective therapy clients contact a practice outside business hours, often late at night, often after deciding for the third time that they are finally going to do this. If the only option on the site is "call us" or a form that says "we will get back to you," a meaningful share of them do not follow through. Online booking closes that gap. It is also the point where a therapy practice website starts handling protected health information, so it has to be done carefully.

This is a practical guide to the choices: what kind of booking to offer, which tools are appropriate, what the intake form may ask, and what changes once it is live.

Three levels of "online booking"

Consult request. A form that asks for name, contact information and a preferred time, and a promise to respond within a business day. It is the minimum and it is better than "call us," but it still depends on the practice replying fast.

Free-consultation scheduling. A calendar where the client picks a 15-minute phone or video consult slot directly. This is what most private practices should offer. It gives the client a concrete next step, filters fit before a full session is booked, and does not require exposing clinician availability.

True self-scheduling. The client picks a clinician and a session slot from live availability, usually through the practice's EHR. This is standard in group practices and increasingly expected everywhere. It converts best and requires the most care, because the client is now entering details into a system that holds their record.

Offer at least the second. Offer the third if your EHR supports it well.

The HIPAA question, answered plainly

Any tool that collects a prospective client's name alongside anything that suggests they are seeking mental health treatment is handling protected health information, and the vendor is a business associate. That means the vendor needs to sign a business associate agreement (BAA) with you. If they will not sign one, do not use them for booking or intake, regardless of how "secure" the marketing page says they are.

This rules out several popular general-purpose tools. Calendly, as of this writing, does not sign BAAs on any plan. Google Forms on a consumer Google account does not either (Google Workspace with a signed BAA is a different matter). Standard website contact forms that email submissions to a Gmail inbox are the most common violation in the profession.

Tools that do sign BAAs include the scheduling and intake features built into practice-management EHRs designed for therapists (SimplePractice, TherapyNotes, TheraNest and similar), a number of dedicated healthcare scheduling tools, and some general scheduling tools on their healthcare tiers (Cal.com and Acuity, for example, offer a BAA on certain plans; check the current terms). Whatever you choose, get the signed BAA in a folder before the form goes live. Our post on HIPAA-compliant contact forms for therapists covers the contact-form side in detail.

What the booking and intake form should ask

Less than you think, at the booking stage. The goal is to get the appointment booked with the minimum information needed to hold it:

• Name, phone, email
• Preferred contact method and whether it is okay to leave a voicemail or text
• What they are looking for, in a short dropdown (individual, couples, child/teen, medication management) rather than a free-text "tell us about your concerns" box
• Insurance carrier, if you take insurance
• Preferred days and times

Save the clinical intake (history, current symptoms, consent forms, credit card on file) for after the appointment is booked, delivered through the EHR's client portal. Asking a prospective client to complete a 40-question intake before they have a confirmed slot is where practices lose the most bookings. Two steps: book first, intake second.

Say what happens next

The single most effective sentence on a booking page is the one that explains what happens after the client submits: "You will get a confirmation text right away, and we will call within one business day to confirm your first appointment." Anxiety about the unknown is the reason many clients never contact a practice, and it does not stop at the form.

Add the practical answers next to the form: session length, fee and insurance, whether you offer telehealth, how soon a new client can usually be seen. The therapist website cost post covers where these pages fit in the overall site.

Availability, honestly

If a clinician is full, say so on the booking page and offer a waitlist or another clinician. A client who books and is then told there is a three-week wait leaves a worse impression than one who saw the wait upfront. If you show live availability, keep it accurate; nothing undermines a practice faster than a calendar that shows slots that do not exist.

What changes once booking is live

Three things, based on what we see across practice sites.

First, more inquiries, and more of them after hours. Practices adding real scheduling typically see the inquiry count rise and the share of inquiries arriving between 8 p.m. and midnight rise with it.

Second, fewer phone calls, which some practices experience as a loss until they notice the calls were mostly scheduling.

Third, better data. Every booking has a source page and a time, which means you can finally see which pages produce clients. The setup in how to track where new patients come from assumes online booking is in place.

A checklist before you turn it on

1. The scheduling and intake tool has signed a BAA, and the signed copy is on file.
2. The booking form asks for the minimum, and the clinical intake comes after, through a portal.
3. The page states what happens next, session length, fees and insurance, and telehealth availability.
4. Availability shown is real, and full clinicians say so.
5. Confirmations and reminders go by text and email, from a tool covered by the BAA.
6. Someone owns the inbox and replies within the stated window.
7. Each booking records the page it came from.

Get those right and online booking is the highest-return change most therapy practice sites can make. Get the BAA wrong and it is the highest-risk one.

Run a free scan to see how your site handles booking and forms, or see what a managed website for a therapy practice includes.