THE SHORT ANSWER
Public brochure → private client portal → private Zoom session
These are architecture judgments for this scenario, not audited provider rankings or promises that any setup is breach-proof.
CHOOSE SOMETHING YOU CAN MAINTAIN
Three technologies. Different responsibilities.
Here, “outdated” means unsupported or known-unpatched components. React is assumed to be built into static files; adding a live server, accounts or an API changes the assessment. Simple HTML is assumed to have no backend or remote scripts.
Outdated WordPress
UpsideStraightforward service pages, appointment plugins and content editing.
TradeoffOutdated intake and booking plugins concentrate sensitive records in a hard-to-defend environment.
For this businessA leaked appointment list may disclose a private therapeutic relationship even without session notes.
Current React, many dependencies
UpsideCan deliver a welcoming, accessible brochure and guided service information.
TradeoffA custom clinical portal is expensive to secure; analytics and widgets can disclose page context.
For this businessMany integrations create more places for appointment metadata to travel. Avoid a custom intake backend here.
Simple HTML + self-contained JS
UpsideStrong fit for a quiet brochure with a clear link to the private portal.
TradeoffBooking and client care tools must live elsewhere; updates require simple file edits.
For this businessIt reduces local records but does not secure your Zoom account, laptop, email or the chosen portal.
FROM ADVICE TO ACTION
The details that matter.
HIPAA is a status question, not a job-title test
US HIPAA rules apply to covered entities and their business associates. A hypnotherapist is not automatically covered just because the work concerns wellbeing, and paying online does not itself settle that status. If the rules apply, obtain the needed business associate agreements for services handling protected health information. Other privacy duties and professional rules may still apply when HIPAA does not.
Sources: HHS: Covered Entities and Business Associates (external) ↗
Keep Zoom, but configure the actual account
Zoom documents BAA arrangements for eligible paid accounts. Confirm the agreement for your account when required; buying an ordinary subscription or seeing an encryption badge is not a complete compliance program. Keep meeting invitations private, use waiting rooms, limit screen sharing and review recording, transcription and AI-note settings. A practice-management product’s built-in video is optional here: the business still uses Zoom.
Sources: Zoom: HIPAA Business Associate Agreement (external) ↗
Buy a workflow, not just a contact database
Use practice-management tools for private intake, appointment history and restricted client communication. The three free starting plans below are inexpensive ways to evaluate fit, not certifications that every setting or profession is supported. Confirm eligibility, access controls, data export, retention, BAA availability and the method for using your external Zoom link before inviting real clients. Do not put clinical notes in a free general sales CRM.
Sources: Sessions Health: Sessions Health pricing (external) ↗ · Practice Better: Practice Better plans (external) ↗ · Carepatron: Carepatron pricing (external) ↗
What information goes where?
A person’s identity linked to a therapy appointment can be sensitive. Intake answers, session notes, recordings and calendar titles deserve stronger controls than a mailing list, even if HIPAA does not apply to your practice.
On your public site
Descriptions, prices, public images, policies and direct provider links. No customer checkout form is required.
In private services
Necessary payment, customer or client records. Protect provider logins and any copies on your devices.
Link out before asking for payment information. Avoid hidden fields, query strings or analytics events containing customer details. A hosted checkout reduces collection on your server; it does not mean that the provider, your logs or your private business records contain no personal information.
See the data-flow and PCI explanationDo you need to pay the host for security?
You usually do not need an expensive “healthcare” public web host for a brochure that handles no patient intake. Keep sensitive administration elsewhere. If you insist on storing protected records on your own server, ordinary shared hosting plus a security add-on is not an adequate substitute for the contracts, controls and operational work required.
The baseline still includes working HTTPS, protected accounts, a clean backup and someone responsible for changes. An included scanner is useful, but a scanner is not a patch, a restore test or an incident-response service.
Use the hosting spending guideKEEP THE TOOLBOX SMALL
Start at $0. Know the limits.
Client management is advised, but choose a practice-management system rather than a marketing CRM. These are three lowest-subscription-cost entry plans in our reviewed set, all $0; they have different limits. Payment processing and a suitable Zoom subscription are separate.
Sessions Health
Freemium
Up to 3 active clients
Private practice records, portal and appointments.
Professional is $39/month for one practitioner. Native video costs extra; use your external Zoom workflow and verify agreements.
Check plan & pricingPractice Better
Sprout
3 clients · restricted features
A very small practice evaluating a private client portal.
Starter: $35/month or $25/month billed annually, up to 10 clients. Check invoices, forms and external Zoom workflow before use.
Check plan & pricingCarepatron
Free
Unlimited clients · 1 GB storage
Client management with a free entry tier.
Table lists 100 appointments; confirm how that cap resets. Verify BAA, profession eligibility and external Zoom workflow.
Check plan & pricingPrices checked September 25, 2026, USD before taxes. Free plans are not free payment processing. These are the three cheapest suitable entry subscriptions in our reviewed shortlist, tied at $0—not an exhaustive ranking of every vendor. Verify features, region, limits and upgrade costs.
What are the odds of customer data being stolen?
The consequence of disclosure is highest here because even appointment metadata can be sensitive. Static public pages with a separate portal reduce local exposure; an unmaintained booking database is a high-consequence choice. No framework makes confidentiality automatic.
Ask your designer.
Does every hypnotherapist have to comply with HIPAA?
No. It depends on covered-entity or business-associate status and the actual activity. Other applicable laws and confidentiality obligations still matter. Resolve this before selecting an intake system.
Can I ask clients what they want help with in my contact form?
That invites sensitive information onto your web host or email system. Put intake in the private portal and label ordinary inquiries “Please do not include health or confidential details.”
Can I use my existing Zoom account?
Possibly. Check the plan, privacy settings and whether a BAA is required and in place. Do not reuse a publicly posted meeting room for all clients.
Sources for this business
- HHS: Covered Entities and Business Associates ↗
- Zoom: HIPAA Business Associate Agreement ↗
- Sessions Health: Sessions Health pricing ↗
- Practice Better: Practice Better plans ↗
- Carepatron: Carepatron pricing ↗
Shared technical evidence and research limitations appear in the source library.