On this page
Both SimplePractice and TherapyNotes include a business associate agreement (BAA) without a separate signature: SimplePractice users agree to it when they create a trial account, and TherapyNotes now builds its BAA into its Terms of Service. The marketing side is separate, because an EHR's BAA covers the EHR, not the ad pixels on your practice website or booking pages. Curve Compliance handles that side, sending consultation requests to ad platforms server-side and stripping PHI before data reaches an ad platform.
| SimplePractice (its own pages) | TherapyNotes (its own pages) | |
|---|---|---|
| How the BAA is provided | “When you create your trial account, you agree to the Business Associate Agreement, the Terms of Service, and the Privacy Policy” (SimplePractice) | “The BAA is now built directly into the Terms of Service for customers who need one” (TherapyNotes) |
| Separate BAA signature | Not needed when upgrading from a trial to a paid account (SimplePractice) | Removes “the need for a separate signed agreement” (TherapyNotes) |
| Client portal and booking | A Client Portal where clients can “request, reschedule, and cancel appointments based on your real-time availability” (SimplePractice) | A client portal with “Online appointment requests, electronic paperwork, messaging & payments” (TherapyNotes) |
| Telehealth | Listed as a feature (SimplePractice) | “secure video sessions, built right into TherapyNotes® & our client portal” (TherapyNotes) |
| Practice visibility | A professional website feature (SimplePractice) | TherapySearch, a directory listing (TherapyNotes) |
| BAA Directory | SimplePractice entry | TherapyNotes entry |
Book a call. Marketing a therapy practice on Google or Meta? Curve Compliance sends consultation requests and bookings to ad platforms from its own servers, with neutral event names, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
How each one provides its BAA
SimplePractice. Its support center says: “When you create your trial account, you agree to the Business Associate Agreement, the Terms of Service, and the Privacy Policy.” It adds: “You don’t need to re-agree to or electronically sign the BAA when you upgrade from a trial to a paid account.” SimplePractice also publishes an addendum for its AI products, which it says “explains how data is used and protected when AI tools are involved” (SimplePractice). If you turn on an AI note tool, read that addendum too.
TherapyNotes. TherapyNotes updated its terms and lists the change plainly: “The BAA is now built directly into the Terms of Service for customers who need one. This simplifies HIPAA compliance by removing the need for a separate signed agreement.” In the same update it “created a separate privacy policy for TherapyPortal to better explain how patient information is handled within the client portal experience” (TherapyNotes).
With either one, keep a dated copy of the terms you accepted in your compliance file. A BAA you agreed to by checkbox is still a contract you should be able to produce.
Client portals, booking and telehealth
On features, the two look alike from the outside. SimplePractice describes a Client Portal that “lets clients send messages, manage documents, and schedule and pay for appointments, all in one place” (SimplePractice), and lists telehealth, group appointments, team management and a professional website among its features (SimplePractice). TherapyNotes lists scheduling, messaging, outcome measures, telehealth and a custom client portal with online appointment requests and electronic paperwork (TherapyNotes).
The differences that decide it are in daily use: how notes and billing fit your clinicians, how group calendars work, and how clients find the portal. Book a demo of each with your real workflow, and ask both the same questions about multi-clinician scheduling, supervision and reporting.
Marketing a therapy practice without exposing clients
Mental health marketing calls for extra care. HHS says regulated entities “are not permitted to use tracking technologies in a manner that would result in impermissible disclosures” of PHI, and that disclosures to tracking vendors “for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). A Meta or Google pixel on a page where someone requests a first therapy session can report that request, with the visitor's browser details, to the ad platform. Your EHR's BAA does not reach that pixel, and how these rules apply to your site depends on your setup, so talk to your counsel if you are unsure.
Ad copy has its own rule. Meta says “we don't allow advertisers to run ads that assert or imply the personal attributes of their audience,” including “physical or mental health (including medical conditions)” (Meta). "Struggling with anxiety?" speaks to the viewer's condition; "Online therapy in Colorado, evening sessions available" describes the practice. For more, read therapist practice marketing and client privacy and mental health reviews and HIPAA.
Tracking consultations
The action that matters is a consultation request or a booked first session. When that action finishes inside an EHR portal, on a different site from your own, a pixel on your site cannot see it, and the platforms optimize toward clicks instead of clients. The fix is to make the conversion happen on a page you control, and to send it server-side as a neutral event with no detail about the client or their concern.
One clean pattern: a short consultation request form on your site, hosted under a BAA, that redirects to your SimplePractice or TherapyNotes booking page after submit. Curve Forms supports exactly that, with a redirect after submit and a starting template for consultation requests. Clients who later ask for copies of their records have a right of access, though HHS notes that psychotherapy notes, “the personal notes of a mental health care provider documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the patient's medical record,” are excluded (HHS); see the medical records request form guide.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names such as a consultation request, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.
Curve Forms hosts consultation request and new-client forms under the BAA Curve signs on every plan; form answers are never sent to ad platforms, and crisis outcomes can show their own end screen and send no conversion. Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked consultations per campaign. Your EHR keeps its own BAA for the clinical record, and Curve signs its own BAA for the marketing side. Curve is SOC 2 Type II, and its team does the setup, typically live in about a week. Book a call to walk through your practice's website and booking flow. See how this works for mental health practices, what to ask on a new client registration form, or run the free website scan on your site.
Sources, checked November 9, 2026: SimplePractice, BAA, Terms of Service and Trust & Security; SimplePractice features and Client Portal; TherapyNotes, Terms of Service, Privacy Policies and BAA FAQ; TherapyNotes features; HHS, Use of Online Tracking Technologies; HHS, right of access; Meta, personal attributes.
Frequently Asked Questions
SimplePractice vs TherapyNotes: which is better?
It depends on your workflow: both include a BAA through their terms and both offer a client portal with online appointment requests and telehealth. Compare notes, billing and group scheduling in a demo of each.
Does SimplePractice sign a BAA?
Yes, through its terms: “When you create your trial account, you agree to the Business Associate Agreement” (SimplePractice).
Does TherapyNotes have a BAA?
Yes. “The BAA is now built directly into the Terms of Service for customers who need one” (TherapyNotes).
Which is better for a group practice?
Both list features for groups: SimplePractice lists group appointments and team management (SimplePractice), and TherapyNotes lists practice management, scheduling and messaging for clients and staff (TherapyNotes). Test both with your own clinicians' calendars.
Can I put a Meta pixel on my booking page?
Not in a way that sends PHI. HHS says regulated entities may not use tracking technologies that result in impermissible disclosures (HHS); send a neutral conversion server-side instead.
Does my EHR's BAA cover my practice website?
Only for the services the EHR itself provides. Tags, forms and ad pixels from other vendors on your site need their own arrangements, and Curve Compliance signs a BAA on every plan for the marketing side.
Can clients get a copy of their therapy notes?
Clients have a right of access to their records, but HHS says psychotherapy notes kept separate from the rest of the record are excluded from it (HHS).
Talk to Curve Compliance
Book a call. Whichever EHR you choose, Curve Compliance keeps your marketing measurable and private: consultation requests go to Google and Meta server-side, PHI is stripped before data reaches an ad platform, and Curve signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.