Online patient intake forms: data and rules

Online intake saves the clipboard at the front desk, gives patients time to look up their medication list at home, and lets the clinical team read the history before the visit. It also changes where patient information lives. A paper form sits in a folder in the office. An online form passes through a form service, a database, maybe an email notification and a PDF export before anyone at the practice reads it.

This guide covers what to ask on an intake form, where the answers go, which HIPAA rules apply to each step, how to handle the Notice of Privacy Practices acknowledgment and signatures online, and how to make the form usable for patients with disabilities. It ends with an outline you can adapt. For the booking step that comes before intake, see our guide to online booking widgets. If your intake packet is a PDF today, our guide to accessible PDFs and patient documents covers what WCAG asks of it and when a web form is the better route.

This is general information, not legal advice. It covers US federal rules. State laws on consent, minors and records can add requirements, so have your privacy officer or a health care attorney review your forms. We do not recommend specific form vendors here.

An intake form is not a contact form

Our guide to website contact and appointment forms under HIPAA recommends keeping health details out of general contact forms. An intake form is the opposite case: its whole purpose is to collect health information, such as symptoms, history, medications, allergies and insurance. So the question is not whether it holds protected health information. It does. The question is whether every system that touches it is set up for that.

That usually means intake should run on a tool built for it, often the patient portal or practice management system you already use, rather than a general website form plugin that emails each submission to the front desk.

Follow the data: where intake answers travel

Before choosing a tool, list every place a submission goes. A typical online intake form involves:

The form page itself and the service that hosts it
The database or cloud storage where submissions are kept
Any notification email sent when a form is submitted, and the mailbox that receives it
PDF exports, downloads to office computers and printouts
The import into your electronic health record or practice management system
Analytics or advertising tags on the form page

HHS says a vendor that creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate. HHS’s cloud computing guidance adds that this applies even when the vendor only stores encrypted data and does not have the key. Each vendor in the list above that holds intake data needs a business associate agreement with the practice before patients start submitting forms. The conduit exception HHS describes is narrow: it gives the US Postal Service, certain couriers and their electronic equivalents as examples of organizations that only transport information, not services that store it. The same test applies to an AI receptionist that collects intake details by phone; see our guide to HIPAA and AI receptionists.

Notification emails are the step most often missed. A form service with a business associate agreement that emails the full submission to a mailbox without one has moved the problem, not solved it. Set notifications to say only that a new form is waiting, and have staff log in to read it.

Advertising and analytics tags are the other common leak. A page where patients enter their health history is exactly the kind of page HHS’s online tracking guidance is concerned about. Keep ad pixels off intake pages entirely. Our guide to tracking pixels and Google Analytics on a practice website explains HHS’s guidance and the 2024 court ruling on part of it.

Security Rule safeguards that apply to online forms

Intake submissions are electronic protected health information, so the HIPAA Security Rule applies. It starts with a risk analysis: 45 CFR 164.308 requires an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of that information, and measures to reduce them. Adding online intake is a change worth covering in that analysis.

The technical safeguards in 45 CFR 164.312 map directly onto a form system. Questions to ask a vendor, and to answer for your own setup:

Access control. Can each staff member have their own login, with access limited to what their role needs? Is there an automatic logoff?
Audit controls. Does the system record who viewed, exported or changed a submission?
Integrity. Is there protection against submissions being altered or deleted improperly?
Authentication. How does the system verify that the person logging in is who they claim to be? Multi-factor login is the usual answer.
Transmission security. Is the form served over HTTPS, and are exports and integrations encrypted in transit?

The rule lists encryption as an addressable specification. Under 164.306, addressable does not mean optional: the practice must assess whether it is reasonable and appropriate, implement it if so, and document why and what it does instead if not. For an online form handling health histories, it is hard to make a case against encrypting data in transit and at rest.

The Notice of Privacy Practices and the acknowledgment

The intake process is usually where a practice gives a new patient its Notice of Privacy Practices. Three parts of 45 CFR 164.520 matter when this moves online:

Post it on your site. A covered entity that has a website with information about its services must prominently post its notice there and make it available electronically.
Ask for the acknowledgment. Except in an emergency, a provider must make a good faith effort to get a written acknowledgment that the patient received the notice, and document the effort and the reason if it is not obtained. An online intake form can include a link to the notice and a checkbox or signature acknowledging receipt.
Electronic first contact. If the first service is delivered electronically, the notice has to be provided electronically, automatically and at the same time as the patient’s first request for service. Patients who receive the notice electronically keep the right to a paper copy on request.

The acknowledgment is not consent to treatment and not an authorization. Keep it as its own clearly labeled item so patients know what they are signing. Our guide to the website privacy policy and the Notice of Privacy Practices explains how the two documents differ.

Signatures, consents and policies

The federal E-SIGN Act says a signature, contract or record relating to a transaction may not be denied legal effect solely because it is in electronic form. That is why practices can collect financial policy agreements and similar forms online. State law can set additional rules for specific consents, such as treatment consent for minors or certain sensitive services, so check which of your forms need a particular format.

Practical points that make e-signed forms easier to rely on:

Show the full text of each policy before the signature, not only a link.
Record the date and time of signing and which version of the form was signed.
Give the patient a copy, by download or through the portal.
Keep each consent separate. One signature that covers treatment consent, financial policy, the privacy notice acknowledgment and a photo release at once is harder to defend and harder for patients to understand.

If your intake includes a missed appointment or late cancellation policy, our guide to patient no-show policies covers fees, Medicare rules and wording.

What to ask, and what to leave out

A long form that asks the same thing three times frustrates patients and produces worse answers. Before moving paper forms online, have the clinicians go through them and mark which questions they actually use. Common results:

Remove duplicate questions. Name, date of birth and address should be asked once.
Prefill what you already know for returning patients and ask them to confirm it.
Split the form into short sections with a progress indicator, and let patients save and return.
Use plain language and avoid abbreviations patients will not know.
For sensitive history, such as mental health or substance use, consider an option to discuss it in person rather than forcing an answer online.
Do not ask for information you will not use. Every extra field is data you have to protect.

Accessibility

An online form that a screen reader user cannot complete sends that patient back to the phone or the clipboard. For practices that receive federal financial assistance HHS’s 2024 Section 504 rule at 45 CFR 84.84 requires web content and mobile apps to conform to WCAG 2.1 Level AA. After HHS’s interim final rule of May 2026, the compliance dates are May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for those with fewer. Our guide to website accessibility for medical practices covers who is covered and the ADA side.

Forms are where accessibility problems hit hardest. The basics:

Every field has a visible label that is tied to the field in the code, not placeholder text that disappears.
Error messages say what is wrong and how to fix it, next to the field.
The whole form works with a keyboard alone.
Time limits can be turned off or extended, so a session does not expire while someone looks up a medication.
WCAG 2.2 adds criteria that fit intake well: do not make people re-enter information they already gave in the same process (Redundant Entry), do not require a memory test such as a puzzle to log in (Accessible Authentication), and make tap targets large enough (Target Size).

Keep a paper or in-office option for patients who prefer it or cannot use the online form. Online intake should be an option that saves time, not a barrier to booking.

An intake form outline

Illustration only. Your clinicians and privacy officer should decide the final content, and some specialties need specific history sections.

Patient details: name, date of birth, contact details, preferred name and pronouns if you collect them, emergency contact.
Communication preferences: how and where the patient wants to be contacted, including any request for confidential communications.
Insurance: carrier, member ID and a photo upload of the card, or self-pay.
Reason for visit: a short free text field.
Health history: current medications, allergies, conditions and past procedures, with sections relevant to your specialty.
Notice of Privacy Practices: a link to the notice and a separate acknowledgment of receipt.
Policies: financial policy and missed appointment policy, each shown in full with its own signature or checkbox.
Consents your state or specialty requires: each one separate.
Review and submit: a summary screen, then a confirmation that tells the patient what happens next and how to get a copy.

We build the website side of this, the pages that explain your intake process and link patients to it, as part of our practice website work. Our AI front desk can answer questions about paperwork and booking by phone. The intake system that stores health information should be one your practice has a business associate agreement with.

Frequently asked questions

Can we use a general form builder for patient intake?

Only if the vendor signs a business associate agreement and the setup meets the Security Rule, including access control, audit logs and encrypted transmission. Many general form builders offer this only on specific plans, and many do not offer it. Check the vendor’s current terms.

Can intake submissions be emailed to the office?

Avoid it. A full submission in an email puts health information in the email system and every mailbox and device that receives it, each of which then needs safeguards and possibly a business associate agreement. Send a notice that a form is waiting instead.

Do patients have to sign the Notice of Privacy Practices acknowledgment?

No. The practice must make a good faith effort to get a written acknowledgment and document why if it does not, but a patient who declines can still be treated.

Are electronic signatures valid on intake forms?

Under the federal E-SIGN Act, a signature or record is not denied legal effect solely because it is electronic. State laws can add rules for specific consents, so confirm which of your forms need a particular format.

Should the intake form be on our website?

The page that explains intake and links to it belongs on your website. The form itself usually works best inside your patient portal or practice management system, where the data is already protected and goes straight into the record.

Do intake forms need to be accessible?

For practices that receive federal financial assistance, HHS’s Section 504 rule requires web content to conform to WCAG 2.1 AA by its compliance dates, and an inaccessible form can also raise ADA issues. Keep a paper option as well.

Sources

More in Practice websites, privacy and tracking

Online patient intake forms: what to ask, where the data goes and the rules that apply