63 breaches in February. Is your practice ready for what comes next?

Google Analytics on Your Practice Website Could Be a HIPAA Violation. Here Is How to Fix It.

According to reports from legal and compliance sources, website analytics tools can create HIPAA exposure for healthcare providers. For therapy practices, the issue is specific: tools like Google Analytics and Meta Pixel can capture information that regulators classify as protected health information when combined with identifiable browsing behavior on a health-focused site.

Sources indicate this may be one of the more common compliance gaps affecting practice owners, and one that most have never reviewed. The fix is not always to remove analytics entirely. It often involves configuring the tool correctly, signing a business associate agreement with the vendor where applicable, or switching to a HIPAA-compliant analytics alternative. If you have not reviewed your website tracking setup recently, this is worth adding to your compliance checklist.

Do this now:

• Log in to your Google Analytics account and audit which pages are being tracked on your practice website.
• Search Google's current terms of service to determine whether a business associate agreement is available for your account type.
• Ask your web developer or marketing partner to review your analytics setup for data flows that could expose client information.

Google's Gemini AI Updates Safety Features for Mental Health Users, What Therapy Practices Should Know

On April 8, 2026, Google announced updates to its Gemini AI chatbot focused on streamlining pathways to mental health support for users in distress. According to reports, the changes center on safety guardrails within the Gemini chatbot interface itself, designed to connect users already inside the chatbot with crisis resources. Sources indicate a financial commitment to crisis helplines was referenced in connection with the announcement, though the specific figure cited in some reports has not been independently verified.

While the updates appear narrowly focused on in-chatbot interactions rather than broad search interception, the broader trend of AI shaping how users find mental health information is worth monitoring for practice owners. Keeping your Google Business Profile updated with specific service and condition terms, and publishing content that directly answers the questions prospective clients are searching, gives your practice the best visibility as AI tools continue to evolve.

Do this now:

• Open your Google Business Profile and confirm that your listed services include specific condition and therapy type terms, not just your practice name.
• Publish or update at least one website page that directly answers a common question a potential client would search for.
• Search your top three service terms in Google and note whether an AI Overview appears above the organic results.

The New HIPAA Security Rule Is Almost Here. Start Preparing Now.

The updated HIPAA Security Rule is expected to finalize this spring, and therapy practices that wait for the official publication date will already be behind. Healthcare IT News published a practical preparation guide on April 16, 2026 outlining the steps covered entities should take now. The anticipated changes include stricter encryption requirements and tighter oversight of business associates, both of which take significant time to implement correctly.

Solo and group practices should start by updating their risk analyses, reviewing every vendor contract that touches client data, and stress-testing their incident response plans. Waiting until the rule publishes gives you less time and more pressure to get it right.

Do this now:

• Download your current risk analysis and note the date it was last completed.
• List every vendor who handles client data and pull up your signed business associate agreement for each one.
• Schedule a 30-minute review of your incident response plan before May 31, 2026.

A New AI Tool Wants to Review Your Marketing Before Regulators Do.

Elpida launched an AI-powered marketing compliance platform for healthcare organizations on March 23, 2026, according to a Business Wire announcement. The platform reviews advertising claims, regulatory language, and digital content for FTC and state-level compliance issues. For therapy practice owners who publish website copy, social content, or any form of online marketing without in-house legal review, this type of tool addresses a real and growing risk.

Healthcare marketing regulations have tightened considerably, and enforcement actions against providers for misleading claims or improper testimonial use have increased. An automated review layer does not replace a compliance attorney, but it can catch common errors before they become regulatory problems.

Do this now:

• Review your practice website's homepage and services pages for any outcome guarantees or superlative claims that could draw FTC scrutiny.
• Search your state's licensing board website for any published guidance on therapist advertising rules.
• Evaluate whether an AI compliance review tool fits your current marketing workflow and budget before your next content update.

63 Healthcare Data Breaches Were Reported in February 2026. Here Is What Therapy Practices Should Check Today.

The HHS Office for Civil Rights received 63 breach reports in February 2026 alone, each involving 500 or more individuals. The HIPAA Journal published this data on April 8, 2026, and the pattern is consistent with prior months. Therapy practices using cloud-based EHRs, telehealth platforms, or third-party billing services carry real exposure if their vendor agreements and breach notification procedures are not current.

OCR penalties for unreported breaches are tiered by level of negligence and can reach into the millions of dollars. The gap most practices overlook is not their own systems but their vendors. If a billing service or telehealth platform has a breach, your notification obligations begin immediately.

Do this now:

• Contact each of your software vendors and ask when they last completed a security audit.
• Locate your breach notification policy and confirm it includes a 60-day reporting timeline to HHS.
• Review your business associate agreements to confirm each vendor is contractually required to notify you of a breach within 24 hours.

Quick wins for the week

• Search your own practice name in Google Maps today and confirm your business hours, phone number, and address are accurate, because outdated information costs you client calls.
• Add the date of your last HIPAA training to your calendar as a recurring annual event so you never miss the renewal.
• Ask one current client how they found your practice, because knowing your actual referral sources helps you invest your time in the right places.
• Check that your practice website loads in under three seconds on a mobile phone, since Google ranks faster sites higher in search results.

Final thoughts

This week's stories share a common thread: the rules and platforms shaping your practice's visibility and legal standing are moving fast, and in multiple directions at once. HIPAA enforcement is tightening. Google's AI layer is reshaping how clients find care. Marketing compliance is drawing more regulatory attention. Each of these shifts requires a different type of expertise, and together they represent a significant burden for any practice owner trying to focus on client care.

While you're providing therapy, we're monitoring policy changes, protecting your Google presence, and optimizing for AI search. You shouldn't need to become an SEO expert, compliance specialist, and tech strategist on top of being a therapist.