On this page
A medical history form collects a new patient's past conditions, surgeries, medications, allergies, family history and lifestyle before the first visit, so the clinician starts with the background already in hand. Built online, it saves front-desk time, but every answer is health information, so the form host and the page around it both need care. Curve Forms from Curve Compliance hosts medical history forms under the BAA Curve signs on every plan, and form answers are never sent to ad platforms.
Book a call. Want history and intake forms hosted under a BAA, with the ad and campaign attached to every new patient? Curve Forms from Curve Compliance sends form events to your ad platforms without the answers, and Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a medical history form is for
A medical history form, also called a health history form, is the clinical background a provider reads before or during the first visit. It sits next to two other forms in a new-patient packet. The registration form records who the patient is, how to reach them and who pays; see the new patient registration form template. The intake form adds the reason for the visit and the practical details; see the patient intake form template. You can combine all three into one packet, as long as each section only asks what the visit needs.
Once a provider collects it, a medical history is individually identifiable health information. Under 45 CFR 160.103, that is information “created or received by a health care provider” that “Relates to the past, present, or future physical or mental health or condition of an individual” and identifies the person. That is the whole content of a history form, which is why where it is hosted matters as much as what it asks.
Medical history form template: sections and fields
Use the sections below as a starting point and cut what your clinicians will not read. The field type column is a suggestion for an online form.
| Section | What to ask | Suggested field type |
|---|---|---|
| Patient details | Full name, preferred name, date of birth, phone, email | Text, date, phone, email |
| Reason for visit | Main concern in the patient's own words, and how long it has been going on | Long text |
| Current conditions | A checklist of conditions your specialty sees often, plus "other" | Multi-select, long text |
| Surgeries and hospital stays | Procedure or reason, and the year | Long text |
| Medications and supplements | Name, dose and how often, including vitamins and over-the-counter products | Long text |
| Allergies | Medications, foods, latex and other allergies, with the reaction | Checkbox, long text |
| Family history | Conditions in parents, siblings, children and grandparents | Multi-select, long text |
| Lifestyle | Tobacco, alcohol, exercise, sleep and occupation | Radio, dropdown |
| Women's health | Pregnancy status and date of last period, shown only when relevant | Radio, date |
| Review of systems | Yes or no for recent symptoms by body system | Checkbox |
| Prior records | Recent lab results or records from another provider | File upload |
| Confirmation | A statement that the answers are complete and accurate, and a checkbox to confirm | Statement, checkbox |
Three habits make the template work better. Group questions by section so the patient knows where they are. Use checklists for common answers and a long text box for everything else. And show a section only when it applies, so a patient who has had no surgeries never scrolls past an empty surgery table.
Family health history: why it is asked
MedlinePlus, from the National Library of Medicine, explains it simply: “Your family history includes health information about you and your close relatives.” It adds that “Looking at these factors can help you figure out whether you have a higher risk for certain health problems, such as heart disease, stroke, and cancer,” and that “Having a family member with a disease raises your risk, but it does not mean that you will definitely get it” (MedlinePlus).
On the form, list the relatives across the top or as separate questions (mother, father, siblings, children, grandparents) and ask which conditions each has had. Leave room for "not sure", because many patients do not know, and a blank answer is more honest than a guess.
Paper vs online medical history forms
Paper forms are familiar, but someone has to read handwriting and type the answers into the record, and the patient often fills them out in the waiting room with no time to check a medication list. An online form arrives before the visit, can require the fields the clinician needs, can show follow-up questions only when they apply, and can take an upload of last year's labs instead of a retyped summary.
The trade-off is that an online form puts a vendor in the middle. Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information.” A form tool that stores your patients' histories fits that description, so it needs a signed BAA before the first real submission. To compare form tools, see HIPAA compliant forms and the builders that sign a BAA.
Collecting medical history online without leaking it
The bigger risk is often the page around the form, not the form tool. HHS says regulated entities “are not permitted to use tracking technologies in a manner that would result in impermissible disclosures” of PHI to tracking vendors, and that “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). A history form on a page that also loads ad pixels or session recording from a vendor without a BAA can hand that vendor what the patient typed or clicked.
- Keep answers out of URLs. A form that submits by query string, or a thank-you page whose address names a condition, puts health details in every log and pixel that sees the URL.
- Keep answers out of pixel events. Send one neutral event for a completed form, never a field value or a condition name.
- Watch what else the page loads. Chat widgets, heatmaps and replay tools on the same page see the same screen.
- Keep confirmation emails plain. Confirm that the form arrived without repeating the answers.
Whether a given setup meets your obligations depends on your vendors and contracts, so talk to your counsel. For the leak points, read medical intake forms and tracking leak points and what makes an intake form HIPAA compliant, and run the free website scan on the page that hosts your form. Patients can also ask for a copy of what they gave you; see the medical records request form guide.
How Curve Compliance helps
Curve Forms gives you the field types a history form needs: text, date, dropdown, radio, multi-select, checkbox, long text, statement fields and file upload for prior records (PDF, JPG, PNG, WEBP, HEIC, DOC and DOCX). Logic shows or hides fields based on earlier answers, so pregnancy or surgery questions appear only when they apply, and a guided flow can show one step per card with a progress bar, which suits a long history. Forms are hosted by Curve under the BAA Curve signs on every plan, and submissions never pass through a third-party form tool.
Every submission arrives in the Leads inbox with its answers, UTMs and ad click ID. Read-only and full-access roles control who sees answers, and every view or export of submissions is logged. Form events such as form started and form submission completed reach Meta, Google Ads and your other destinations server-side through your event mappings, while form answers, page titles and free text are never sent. You can embed the form with a script that resizes itself, an iframe, a hosted link, a QR code for the front desk or a custom domain. Curve Compliance is SOC 2 Type II, and its team does the setup, typically live in about a week. Book a call to plan your history form with Curve's team.
Sources, checked November 9, 2026: MedlinePlus, Family History; 45 CFR 160.103; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
What is a medical history form?
A medical history form collects a patient's past and current conditions, surgeries, medications, allergies, family history and lifestyle before a visit. It is also called a health history form.
What should a medical history form include?
Patient details, the reason for the visit, current conditions, surgeries and hospital stays, medications and supplements, allergies, family history, lifestyle, a review of systems and a place to upload prior records. Cut any section your clinicians do not use.
What is the difference between a health history form and an intake form?
They overlap. The history form is the clinical background, while an intake form also covers the reason for the visit, contact preferences and acknowledgments; see the patient intake form template.
Is a medical history form protected by HIPAA?
Once a HIPAA covered provider collects it, yes: it is individually identifiable health information under 45 CFR 160.103, and any vendor that stores it for you needs a BAA.
Can patients fill out a medical history form online?
Yes. Host it with a vendor that signs a BAA and keep ad pixels from reading the answers; Curve Forms hosts forms under the BAA Curve signs on every plan.
How often should patients update their medical history?
A simple rule is to ask patients to confirm or update it whenever they book a new visit, and any time a medication, diagnosis or surgery changes. Your clinicians may want it more often for some conditions.
Why does a medical history form ask about family history?
Because, as MedlinePlus puts it, family history can help show “whether you have a higher risk for certain health problems, such as heart disease, stroke, and cancer” (MedlinePlus).
Talk to Curve Compliance
Book a call. Ready to move your medical history form online without exposing the answers? Curve Forms hosts it under the BAA Curve signs on every plan, sends only neutral form events to your ad platforms, and ties each new patient to the ad that brought them. Curve's team does the setup, typically live in about a week. Book a call with Curve.