A lot of clinics still collect new-patient paperwork through a generic form builder that emails every submission, health history included, to the front desk inbox. Others go the opposite way and treat every field on the website as if it needs hospital-grade security, which makes simple things like a "request a callback" form harder than they need to be. HIPAA compliant intake forms sit between those extremes. This guide explains what actually has to be protected, what doesn't, and what to require from any intake tool before patients start typing their medical history into it.
This is practical technology guidance, not legal advice. Your privacy officer or healthcare counsel should confirm how the rules apply to your practice.
First: does HIPAA apply to you?
HIPAA applies to covered entities, which include health care providers who conduct certain standard transactions electronically (billing insurance is the common one), health plans and clearinghouses, and to the business associates that handle protected health information (PHI) on their behalf. Most clinics that bill insurance are covered entities.
Some cash-pay wellness businesses are not. That doesn't make health data on their website a free-for-all: state privacy laws, FTC rules and simple patient trust still apply, and many practices that aren't technically covered choose to operate to the HIPAA standard anyway. If you're not sure which side of the line you're on, settle that with counsel before designing your forms.
What has to be protected, and what usually doesn't
PHI is individually identifiable health information held or transmitted by a covered entity or its business associates. In intake terms, that includes:
- Health history, symptoms, current medications and allergies.
- Insurance member information.
- Reason for visit tied to a named person.
- Consent forms and signatures connected to care.
- Appointment details linked to an identifiable patient.
What generally doesn't need the full HIPAA treatment is a general marketing contact form that asks for a name, phone number and preferred callback time, and that doesn't ask about health. The catch: people type health details into any open text box. A "How can we help?" field on a clinic site will eventually receive a description of symptoms. Two good defaults:
- Remove open-ended message fields from public contact forms, or add a clear note asking visitors not to include medical details.
- Route anything clinical through the secure intake flow, not the marketing form.
The safest design separates the two completely: marketing pages capture a callback request, and clinical intake happens inside an authenticated, secured portal.
What HIPAA compliant intake forms require
For any form that collects PHI, these are the requirements we treat as non-negotiable:
A signed BAA with every vendor that touches the data
The form tool, the database, the hosting provider, the email or SMS service if PHI passes through it, and any storage or backup provider. If a vendor won't sign a business associate agreement, PHI can't go through that vendor. Many consumer-grade form builders don't offer one on standard plans.
Encryption in transit and at rest
HTTPS for every page in the flow, and encrypted storage for submissions and uploaded documents.
Role-based access
Front-desk staff, billing and providers often need different views. Give each role the minimum it needs, and avoid shared logins entirely.
Audit logging
Record who viewed, edited, exported or deleted each record and when. If you ever need to investigate an incident, this is what you'll rely on.
No PHI in notifications
The new-submission alert should say "New intake received — view in portal," not contain the patient's answers. Email and text messages are a common place for PHI to leak.
Retention, export and deletion
Know where submissions live, how long they're kept, and how they get into your EHR or patient record. Copy-pasting from an email into the chart is a workflow and a risk.
Tracking pixels and analytics on intake pages
This is where well-meaning marketing setups create real exposure. HHS's Office for Civil Rights published guidance on the use of online tracking technologies by HIPAA covered entities and business associates. In 2024 a federal court vacated part of that guidance dealing with certain unauthenticated public pages, but the core concern for pages behind a login, and for flows where patients submit health information, remains.
Our rule is simple: no third-party advertising pixels, session-replay tools or analytics scripts on authenticated pages or on any page where a patient enters health information, unless the vendor has signed a BAA and the use is permitted. Measure intake completion with first-party, privacy-conscious analytics that don't send PHI to outside parties. Our post on why your practice needs a HIPAA-compliant website covers the site-wide side of this.
Designing intake patients actually finish
Compliance doesn't excuse a bad experience. A secure form that patients abandon still leaves your front desk doing paperwork at check-in.
- Break it into steps, with a progress indicator and the ability to save and return.
- Make it work on a phone. Many patients complete intake from a link in a confirmation message.
- Ask once. Pre-fill what you already know for returning patients and let them confirm rather than retype.
- Use conditional questions so patients only see sections relevant to their visit type.
- Capture e-signatures and consents with timestamps and the version of the document signed.
- Send intake links tied to the appointment, so submissions land on the right record automatically.
When a new inquiry arrives from the public site, route the callback request quickly without carrying health details into notifications; our post on lead routing automation covers how to do that.
Questions to ask any intake vendor
- Will you sign a BAA, and on which plan?
- Where is data stored, and is it encrypted at rest?
- Do you support role-based permissions and per-user logins?
- Is there an audit log we can review and export?
- Can notifications be configured to exclude submission content?
- Do you load any third-party scripts on the form pages?
- How does data get into our EHR or patient record?
- Can we export all our data if we leave?
If the answers are vague, keep looking. For a deeper look at the platform side, see HIPAA-compliant web development and our guide to patient portals that actually work.
In our Clinic OS builds, intake lives inside the patient portal: tied to the appointment, visible by role, logged, and kept off third-party trackers. That's how we approached HIPAA intake for Topp Health's primary-care and telehealth platform.
FAQ
Is a regular contact form on a clinic website subject to HIPAA?
If it only collects contact details and a callback preference, it's lower risk, but for a covered entity even contact details tied to a request for care can be PHI, so route and store it carefully. Once it asks about health or a visitor types health information into it, treat it as potentially containing PHI. Design public forms to avoid collecting health details at all.
Can intake submissions be emailed to our staff?
Send a notification that a submission arrived, not the submission itself. Staff should view PHI inside a secured, logged system.
Do we need a BAA with our web host?
If PHI is stored on or passes through their infrastructure, yes. If your public site never touches PHI and intake runs on a separate secured platform, the BAA belongs with that platform's providers.
Can we use Google Analytics or Meta Pixel on intake pages?
We don't recommend any third-party tracking on authenticated or intake pages. Review HHS's tracking technologies guidance with counsel before placing any tracker near health information.
Does HIPAA compliance make the form secure by itself?
No. HIPAA sets requirements; security comes from implementation: encryption, access control, logging, vendor agreements and staff practices working together.
HIPAA compliant intake forms aren't about making everything harder. They're about putting health information in one secured place and keeping it out of everywhere else. If you want intake built into a system designed around your practice, see what a Clinic OS build includes, or contact us to talk through how your patients get from first click to first visit.