Legal Footprints & The Colleague Referral Engine: Turning Your 'About' Page into a Networking Asset
What you'll learn
- Write an "About" page that speaks primarily to referring colleagues, rather than just prospective clients.
- Audit your website for strict compliance with FTC regulations and your specific board codes regarding client testimonials.
- Secure your digital communication pipeline with a BAA-covered Google Workspace and a HIPAA-compliant contact form.
- Satisfy federal CAN-SPAM laws with a professional mailing address in your marketing emails — and mirror it in your footer — without compromising your personal safety.
Too busy to read? View the 90-Second Version
Your website has legal obligations most therapists don't know about. Getting these wrong creates real liability.
- The testimonial trap — Your ethics codes (APA 5.05, NBCC) bar you from soliciting client testimonials. Use colleague endorsements instead — and the FTC penalizes fake or undisclosed reviews, so name the professional relationship.
- HIPAA-secure email — Gmail and Outlook are not HIPAA-compliant out of the box. You need a BAA (Business Associate Agreement) with your email provider.
- CAN-SPAM without your home address — The law requires a physical address in every marketing email. Use a UPS Store mailbox or other CMRA address (like a virtual business address) — never your home.
Once these legal foundations are in place, your About page becomes a colleague referral engine — a networking asset that works for you 24/7.
The Dual Audience of the "About" Page
There is a massive misconception in private practice marketing that your "About" page is where you finally get to talk about yourself. You list your hobbies, your dog's name, your favorite coffee order, and where you went to graduate school.
While it is absolutely necessary to humanize yourself, your "About" page actually serves a very specific, strategic dual-audience:
The Client
They are looking for a baseline "vibe check." They want to see your face, hear your tone of voice, and confirm that you are a safe human being to talk to.
The Referring Colleague
The secret engine of private practice growth. Other therapists, school counselors, psychiatrists, and PCPs are constantly looking for trusted specialists to send overflow clients to.
When a busy psychiatrist is trying to find a referral for a patient experiencing Late-Diagnosed AuDHD Burnout, they don't have time to read your life story. They scan your "About" page to answer three clinical questions:
The first half of the page is written in plain English for the client. The second half — "Clinical Background & Training" — is written specifically for your peers. You are signaling: "I am a highly trained specialist. You can trust me with your difficult cases."
The Testimonial Trap: Why "Social Proof" is a Liability
If you read any generic marketing blog on the internet, they will tell you that "social proof" (client reviews and testimonials) is the most important factor in converting website visitors into buyers.
For therapists, social proof is a severe ethical and legal liability. You cannot ask a current or former client to write a review for your website. The inherent power dynamic in the therapeutic relationship makes any request for a testimonial implicitly coercive.
“I regularly refer my neurodivergent patients to Liz. Her deep understanding of AuDHD burnout and her radically affirming approach makes her one of the most trusted specialists in our area.” — Dr. Sarah Jenkins, Psychiatrist (illustrative example)
This provides massive social proof to potential clients (“Oh, other doctors trust her!”) and signals authority to other professionals, all while remaining completely ethically compliant.
The HIPAA-Secure Communication Pipeline
Your website is the front door to your practice, which means it is also the first point of vulnerability for Protected Health Information (PHI).
Many therapists use the default contact form on their website builder and have those emails sent to a standard @gmail.com address. This is a HIPAA violation. Free Gmail is encrypted in transit, but Google will not sign a HIPAA Business Associate Agreement (BAA) for free accounts — and without a BAA, it is not HIPAA-appropriate for client communication.
Upgrade to a paid account ($7–14/mo), log into the admin console, and digitally sign the HIPAA Business Associate Agreement. This legally binds Google to protect data on their servers.
Delete any generic Squarespace/WordPress forms. Embed the secure form from your EHR system (SimplePractice, TherapyNotes, Jane) or use Hushmail/Paubox. Data is encrypted in transit and at rest, under a BAA.
An automated reply that manages expectations, establishes response windows, and disclaims emergency liability. This single email protects your time and your license.
The CAN-SPAM Act and Your Physical Address
If you plan on sending any automated emails — including a monthly newsletter, an onboarding sequence, or a lead magnet delivery — you fall under the jurisdiction of the federal CAN-SPAM Act.
The CAN-SPAM Act requires that all commercial emails include a valid physical postal address. You must never list your home address on your website or in your emails. This presents a massive safety issue for telehealth-only therapists who work from home.
| Option | Monthly Cost | Pros | Cons |
|---|---|---|---|
| Co-Working Space | $100–300/mo (varies widely; sub-$100 plans are part-time only) | Real address, professional setting, mail receiving | Price varies widely; may require add-on for mail service |
| UPS Store Box | $15–30/mo | Real street address format (Suite #), universally accepted | Must pick up physical mail |
| Virtual Business Address | $10–20/mo | Digital mail scanning, fully remote | May not be accepted by all platforms |
Important distinction: These are CAN-SPAM compliant addresses for your website footer and email signatures only. They are NOT the same as your Google Business Profile address. As we covered in Module 2, Google requires a real physical location for GBP verification — UPS Store boxes and virtual offices have been mass-suspended. Do not use these addresses for your GBP.
Put this address at the bottom of all your marketing emails — that is where CAN-SPAM actually requires it. Then put the same address in your website footer. The footer is not a legal requirement, but matching addresses everywhere keeps your practice consistent and signals legitimacy.
The Micro-Action: Secure Your Pipeline
Do not wait until you launch your site to figure out your compliance. Do this today.
You have a clean, 5-page website architecture. Your copy speaks to your client’s nervous system, not your professors. Your communication pipeline is HIPAA-compliant. Your footer has a CAN-SPAM-safe address. Your digital office is open.
No jargon left behind. You are not supposed to know these terms yet. Here is the plain-English decoder for every piece of digital vocabulary used in this lesson, along with its real impact on your practice.
- BAA (Business Associate Agreement)
-
A legally binding contract required by HIPAA where a technology provider legally agrees to secure and protect your clients' clinical data on their servers.
SEO Practice Insight:Google Workspace administration requires you to digitally sign their free BAA. Free Gmail accounts do not support BAAs and are standard HIPAA violations.
- PHI (Protected Health Information)
-
Any personal, health-related information (names, emails, diagnoses) that can link a specific individual to clinical treatment or evaluation.
SEO Practice Insight:Names and clinical descriptions submitted through a generic website contact form count as PHI, requiring an encrypted HIPAA-secure form.
- CAN-SPAM Act
-
A federal consumer protection law regulating commercial email, requiring a valid physical mailing address and an opt-out link in every newsletter.
SEO Practice Insight:telehealth-only practitioners can safely comply by renting a virtual business address or a UPS Store box rather than exposing their private home address.
Key takeaways
- Your "About" page has a dual audience. Write the top half for the client's nervous system, and the bottom half ("Clinical Background") for referring colleagues.
- Never solicit or display client testimonials. It is a violation of your ethical board codes and an FTC liability. Use endorsements from referring colleagues instead.
- Secure your email pipeline. You must use a paid email service (like Google Workspace) and sign a BAA.
- Never use a generic website contact form. Embed the secure, encrypted form provided by your EHR.
- Protect your home address. Rent a virtual business address or a UPS Store box to satisfy the federal CAN-SPAM Act.