On this page
A medical referral form passes a patient from one provider to another with the reason for the referral, the relevant history, insurance details and contact details for the patient and the referring office. HIPAA counts “the referral of a patient for health care from one health care provider to another” as treatment (45 CFR 164.501), so a provider can send one without the patient's authorization in most cases, but a good form still asks only for what the receiving office needs to schedule and treat. Curve Forms from Curve Compliance starts from a referral intake template and hosts every referral under the BAA Curve signs on every plan.
Book a call. Want more referrals from other offices, and to know which campaigns bring them? Curve Compliance hosts your referral form under a BAA, attaches the ad and campaign to every submission, and sends form events to your ad platforms without the answers. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a referral form is
A referral form works in two directions. An outgoing referral is what your office sends when a patient needs a specialist, imaging or another service. An incoming referral is what other offices send you, often through a form on your website. A referral letter is the narrative version of the same thing: a short note from one clinician to another that explains the question being asked.
Some health plans also require their own approval before a specialist visit. That request is separate from the clinical referral. HIPAA defines it as a standard transaction, which includes “A request from a health care provider to a health plan to obtain authorization for referring an individual to another health care provider” (45 CFR 162.1301). Your practice management or billing system usually handles that part.
Medical referral form template: the fields by section
Use these sections as a starting point. The last column gives the federal rule where one applies. Where none does, the field is there because the receiving office needs it to act.
| Section | What to include | Rule that applies |
|---|---|---|
| Referring provider | Name, practice, phone, fax, and National Provider Identifier (NPI) | A covered provider must “Disclose its NPI, when requested, to any entity that needs the NPI to identify that covered health care provider in a standard transaction” (45 CFR 162.410). For Medicare imaging, lab and DMEPOS orders, the claim “must contain the legal name and the National Provider Identifier (NPI)” of the physician or eligible professional who ordered the item or service (42 CFR 424.507) |
| Receiving provider | Name or specialty, location, and how they prefer to receive referrals | Sending PHI to another provider for its treatment is permitted (45 CFR 164.506, paragraph (c)(2)) |
| Patient details | Name, date of birth, phone, preferred contact method, and a parent or guardian for a minor | Contact preferences matter because providers must accommodate reasonable requests to be contacted by other means or at other locations (45 CFR 164.522) |
| Reason for referral | The question or service requested, working diagnosis, and urgency | Treatment, as defined in 45 CFR 164.501 |
| Relevant history | Current medications, allergies, recent results and images that bear on the question | The minimum necessary standard does not apply to “Disclosures to or requests by a health care provider for treatment” (45 CFR 164.502), but sending only what is relevant still helps the receiving office |
| Insurance | Plan, member ID, and any referral or authorization number the plan issued | The plan approval request is a standard transaction (45 CFR 162.1301) |
| Attachments | Records, imaging reports, or radiographs | Psychotherapy notes need the patient's authorization for almost any disclosure (45 CFR 164.508, paragraph (a)(2)) |
| Scheduling notes | Whether the patient knows about the referral, and good times to reach them | No federal rule; it saves the receiving office a phone call |
Dental referral forms
A dental referral form follows the same structure and adds a few dental fields: the tooth number or area, the procedure or evaluation requested (for example endodontic, periodontal, oral surgery, orthodontic or implant), whether radiographs are attached and when they were taken, and any medical alerts the receiving dentist should know before treatment, such as allergies and current medications.
A generic dental referral form works across specialties if it uses checkboxes for the procedure and a free-text box for the question. A practice that receives referrals can publish one form for referring dentists on its website. For dental tracking without PHI, see Curve for DSOs and dental practices.
HIPAA and referrals for treatment
HIPAA's treatment definition names referral directly: treatment means “the provision, coordination, or management of health care and related services by one or more health care providers,” including “the referral of a patient for health care from one health care provider to another” (45 CFR 164.501). The Privacy Rule then says “A covered entity may disclose protected health information for treatment activities of a health care provider” (45 CFR 164.506). See HIPAA TPO and when PHI disclosure is permitted.
Three exceptions matter on a referral form:
- Psychotherapy notes. HIPAA says “a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes,” with narrow exceptions such as use by the note's originator for treatment (45 CFR 164.508). Send a summary instead.
- Substance use disorder records. Records from a federally assisted program fall under 42 CFR Part 2, which permits uses and disclosures when “a patient consents to a use or disclosure of their records consistent with § 2.31” (42 CFR 2.33). See 42 CFR Part 2.
- State law. HIPAA does not preempt a state law that relates to the privacy of health information and is “more stringent” than the Privacy Rule (45 CFR 160.203), so check your state's rules for sensitive records.
Which records your referrals can include depends on your state and specialty, so talk to your counsel.
Online referral forms: hosting and BAAs
A referral form on your website collects PHI from the first field. The vendor that hosts it stores that PHI, so it needs a BAA. HHS says that using a cloud service “to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP” puts the covered entity “in violation of the HIPAA Rules” (HHS). That applies to form builders, file uploads and the inbox where referrals land.
If referrals still arrive by fax or email, the same test applies to those services. See HIPAA compliant fax services and HIPAA compliant email providers. For a new-patient form on the same site, see the patient intake form template.
Tracking referral sources without PHI
Referral marketing usually means campaigns aimed at referring offices: ads, emails and landing pages that ask a dentist or physician to send patients your way. You want to know which campaign produced each referral. The page that hosts the form is the risk. HHS says tracking technologies can disclose “information that the individual types or selects when they use regulated entities' websites or mobile apps” (HHS), and a referral form carries a patient's name and reason for referral.
The safe pattern is to keep ad pixels and session replay off the form page and to count each referral as a conversion with a neutral event name, sent server-side with a fixed list of fields that never includes answers. Curve's free website scan lists the trackers on a page before you launch. See event tracking on a healthcare website for naming events.
How Curve Compliance helps
Curve Forms starts from a referral intake template and a Soft Referral style preset. Forms are hosted by Curve under the BAA Curve signs on every plan, so submissions never pass through a third-party form tool. Add file upload fields (PDF, JPG, PNG, WEBP, HEIC, DOC and DOCX) for records and images, dropdowns and checkboxes for the procedure requested, and logic that shows the dental questions only when a dental referral is chosen.
Each referral lands in the Leads inbox with its answers, attribution and staff notes, and lead stages (qualified, converted) track it through to a booked visit. Notification emails reach your team with Reply-to set to the referring office, or Curve can send a detail-free notification on request. Every view or export of submissions is logged, and the export API lets a scheduled job on your side keep your CRM current. Form events reach Meta, Google Ads and your other destinations server-side, and form answers, page titles and free text are never sent. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 164.501; 45 CFR 164.502; 45 CFR 164.506; 45 CFR 164.508; 45 CFR 164.522; 45 CFR 160.203; 45 CFR 162.410; 45 CFR 162.1301; 42 CFR 424.507; 42 CFR 2.33; HHS, Guidance on HIPAA and Cloud Computing; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
What is a medical referral form?
A medical referral form sends a patient from one provider to another with the reason for referral, relevant history, insurance and contact details. HIPAA treats a referral as treatment, so providers can share what the receiving office needs for care (45 CFR 164.501).
What should a dental referral form include?
The referring dentist and NPI, the patient's details, the tooth number or area, the procedure or evaluation requested, attached radiographs and their date, insurance, and medical alerts such as allergies and current medications.
How do you make a medical referral letter?
State who the patient is, the question you want answered or the service you are requesting, the relevant history and results, how urgent it is, and how the receiving clinician can reach you. Keep it to what the receiving clinician needs to act.
Can you provide an example of a referral form?
The template above is one: referring provider, receiving provider, patient details, reason for referral, relevant history, insurance, attachments and scheduling notes, with the rule behind each section.
How do you make a good referral form?
Ask for the referral question first, use checkboxes for common services, let the referring office attach files, and ask for the NPI and a direct phone number. Host it with a vendor that signs a BAA and keep ad pixels off the page.
Do I need patient authorization to send a referral?
Usually not. HIPAA lets a covered entity disclose PHI “for treatment activities of a health care provider” (45 CFR 164.506), but psychotherapy notes need an authorization (45 CFR 164.508) and Part 2 substance use disorder records need the patient's consent (42 CFR 2.33).
Is an online referral form HIPAA compliant?
It can be when the vendor hosting it signs a BAA (HHS) and no tracking script on the page collects the answers. Curve Forms are hosted by Curve under the BAA Curve signs on every plan.
Talk to Curve Compliance
Book a call. Want a referral form hosted under a BAA, with each referral tied to the campaign that produced it? Curve Forms from Curve Compliance starts from a referral intake template, and Curve's team does the setup, typically live in about a week. Book a call with Curve.