For practices in the US

HIPAA-Compliant Intake Forms: What Therapy Practices Need to Get Right

No form is HIPAA compliant just because a vendor calls it that. Whether your intake forms are HIPAA compliant depends on what you ask, how the answers travel, where they're stored, who can see them, and what the patient signs. If you're moving a therapy practice from clipboards to HIPAA-compliant online intake forms, this is the checklist to work through, with links to the HHS guidance behind each point.

This is a practical guide, not legal advice. HIPAA guidance changes, and state law often adds to it, so check anything you're unsure about with HHS or a healthcare attorney.

The checklist for HIPAA-compliant intake forms

1. Every question has a clear reason to be on the form.
2. Routine consents are separate from any HIPAA authorization.
3. Your Notice of Privacy Practices is linked, with an acknowledgment of receipt.
4. E-signatures record who signed, when, and which version of the form they signed.
5. Forms are sent and submitted over encrypted connections and stored encrypted.
6. You have a signed business associate agreement (BAA) with every vendor that handles the responses.
7. Responses go straight into the patient's record, not into inboxes or shared drives.
8. Staff access is limited by role, and access is logged.
9. No analytics or advertising pixels on form pages.
10. The form itself says what it's for and how the information is protected.

The rest of this post explains each one.

Ask only for what you need

HIPAA's minimum necessary standard requires you to take reasonable steps to limit the protected health information (PHI) you use, disclose and request to what the purpose needs. It's aimed mainly at sharing and requesting information rather than at what you ask patients directly, but it's the right test for an intake form too. Every field you collect is a field you have to protect, and a field that could be exposed in a breach.

Go through your current paper packet and ask, for each question, who uses the answer and when:

• Social Security number: most practices don't need it. Leave it off unless a payer you bill genuinely requires it.
• Insurance card images: only for patients you'll bill insurance for. Self-pay patients shouldn't be asked to upload them.
• Full medical history: ask what's relevant to the care you provide. A speech-language pathology practice rarely needs a full surgical history, and a counseling intake rarely needs medication dosages.
• Sensitive history (trauma, substance use, sexual health): consider whether it's better asked in session, where you can give context, than on a form completed at home.
• Emergency contact: collect it, but listing someone isn't permission to discuss the patient's care with them. If you want that, ask on the form whether the patient agrees to you sharing information with this person.

Shorter forms also get completed. Patients abandon long online intake packets, and the questions they skip are often the ones you most needed.

Consent versus authorization

These two words get used interchangeably on intake packets, and HHS treats them very differently. Its FAQ on the difference between consent and authorization is worth reading in full.

What an intake packet usually needs

• Consent to treatment. This comes from state law and professional standards, not HIPAA. Use the wording your licensing board, insurer or attorney expects.
• HIPAA consent for treatment, payment and operations. HIPAA permits you to ask for this but doesn't require it. You can already use PHI to treat the patient, bill for it and run your practice without it. Some practices include a short acknowledgment anyway; if you do, don't present it as something that authorizes disclosures it doesn't cover.
• Acknowledgment of your Notice of Privacy Practices. Providers must give the notice no later than the first service and make a good-faith effort to get a written acknowledgment of receipt (45 CFR 164.520). If the patient won't sign, document your attempt and the reason. HHS confirms you can obtain this acknowledgment electronically. If your practice website describes your services, you must post the notice there too.
• Communication preferences. Patients have the right to ask you to contact them by other means or at other locations, and you must accommodate reasonable requests. Ask on the form: may you leave voicemails, send texts, send email? HHS allows email with patients with reasonable safeguards, and says patients can choose to accept the risks of unencrypted email. Text reminders may also need separate consent under other laws.

When you need an authorization instead

An authorization is required for uses and disclosures HIPAA doesn't otherwise allow, such as sending records to a school, an employer or the patient's attorney, or using a patient's story in marketing. Psychotherapy notes generally need one too.

Keep authorizations out of the general intake packet. Make each one its own form, created when you actually need it. Under 45 CFR 164.508 a valid authorization must be in plain language and include:

• What information will be disclosed, described specifically
• Who is disclosing it and who will receive it
• The purpose ("at the request of the individual" is enough when the patient asks)
• An expiration date or event
• The patient's signature and date, or a personal representative's signature with a description of their authority
• Statements that the patient can revoke it in writing (and how), whether treatment depends on signing it, and that information disclosed may be redisclosed and no longer protected

You generally can't make treatment conditional on signing an authorization, and you must give the patient a copy of what they signed.

Minors and personal representatives

For child and adolescent clients, the form should record who is completing it and their relationship to the patient. Who counts as a minor's personal representative, and what a minor can consent to alone, depends on state law, which varies a lot for mental health care. Check your state's rules before you design one intake form for every age.

E-signatures

HIPAA has no electronic signature standard of its own. HHS says authorizations can be obtained electronically as long as the e-signature is valid under applicable law, which in practice means the federal E-SIGN Act and your state's electronic transactions law.

To make an e-signature hold up, record:

• The signer's typed or drawn signature and their name
• The date and time
• Which version of the form they signed, so you can show exactly what they agreed to
• How the form reached them (for example, a unique link sent to the phone number or email on file)

Then give the patient a copy, by download or from a patient portal.

Encryption and where form data goes

The Security Rule's technical safeguards currently treat encryption as "addressable," which means you either use it or document why an equivalent measure is reasonable. For online intake forms there's no realistic alternative: encrypt the form page and submission in transit (HTTPS), and the stored responses at rest. HHS proposed in early 2025 to make encryption required outright; as of October 2026 that rule hasn't been finalized, but encrypting now is the safer choice either way.

Encryption on the form doesn't help if the data leaks out afterward. The common leaks are:

• Email notifications with the answers in them. A "new form submitted" alert is fine. A copy of the responses, or a PDF attached to that alert, sends PHI through email systems you may not control. Turn attachments off.
• Downloads. Staff downloading PDFs to a desktop or a shared drive creates copies outside your access controls and logs.
• Tracking pixels. Submitted intake answers are PHI, and analytics or ad pixels that capture what happens on a form page can pass information to the tracking vendor. HHS's guidance on online tracking technologies covers this (a federal court narrowed it in 2024 for public pages). The simple rule: no marketing pixels on any page where patients enter health information.

Business associate agreements

Any vendor that creates, receives, stores or transmits PHI for you is a business associate, and you need a signed BAA with them before patients start submitting forms. For online intake that usually means your form builder, your practice management or EHR software, and any cloud storage or email service the responses pass through.

HHS's cloud computing guidance is clear that a provider storing your PHI is a business associate even if it only holds encrypted data and can't read it. The required contents of a BAA include limits on how the vendor uses the data, Security Rule safeguards, breach reporting, the same terms for its subcontractors, and return or destruction of data when you leave.

Watch for general-purpose form tools that only sign a BAA on a specific paid plan, or not at all. If a vendor won't sign one, don't use it for intake.

Storage, access and audit logs

Once a form is submitted, the goal is for it to live in one place: the patient's record, under the same controls as your clinical notes.

• Role-based access. Front-desk staff may need demographics and insurance, but not a trauma history. Set permissions so people see what their role requires.
• Audit controls. The Security Rule requires mechanisms that record and examine activity in systems containing ePHI. Choose software that logs who viewed or changed a record, and look at those logs periodically, not just after an incident.
• Retention. HIPAA requires you to keep signed authorizations, Notice of Privacy Practices acknowledgments (or your documented attempts) and your policies for six years. How long you keep the clinical record itself is set by state law and payer contracts.
• Risk analysis. Moving intake online changes where PHI lives, so update your security risk analysis to include the new workflow.

Caspen's security features include encryption in transit and at rest, user roles and permissions, and a client access history showing which staff viewed or changed a client's information.

What to put on the form itself

Patients trust a form more when it explains itself. Include:

• Your practice name and contact details, and a sentence on what the form is for
• Which questions are optional
• A link to your Notice of Privacy Practices, with the acknowledgment checkbox and signature
• The patient's communication preferences
• Who is completing the form and their relationship to the patient
• A short statement that by typing or drawing their signature they agree it has the same effect as a handwritten one
• The form's version or date, recorded with the submission

Some wording you can adapt:

We ask for this information to provide your care, bill for it and keep you informed. Questions marked optional can be skipped, or discussed at your first appointment instead. Your answers are sent securely and stored in your confidential record at [Practice name]. Read how we use and protect your health information in our [Notice of Privacy Practices].

By signing below, I acknowledge that I have received [Practice name]'s Notice of Privacy Practices. I agree that my electronic signature has the same effect as my handwritten signature.

Have your attorney review final wording, especially consent-to-treatment language, which depends on your state and profession.

Putting it into practice

Most of this checklist comes down to choosing a system where forms, signatures and records sit together instead of in a form tool, an inbox and a shared drive. With Caspen's online forms, you build intake forms with signature fields and pre-filled details, have them sent automatically by SMS or email when a patient books, and save each response to the client's record. Caspen also signs a business associate agreement (BAA) with US practices.

Whatever software you use, check every vendor against this checklist before your first patient fills out a form online: ask for the BAA, test where submissions go, and confirm who on your team can see them.

Start your free Caspen trial to set up online intake forms for your practice.