Mental Health Telehealth Intake Forms and Privacy

A mental health telehealth intake form usually asks why the person wants care, their history, current medications, screeners such as the PHQ-9 and GAD-7, where they are, an emergency contact and consent to telehealth; the answers are for the care team, and a HIPAA covered practice may not send them to an ad platform for marketing without the person's authorization (HHS). Your clinicians decide what to ask, and for medication the prescribing clinician decides; the form only collects answers. Curve Forms from Curve Compliance hosts that intake under the BAA Curve signs on every plan and gives ad platforms a neutral form event, never the answers.

Book a call. Curve's team will review your mental health intake funnel with you and show you a Curve Forms demo: a guided intake hosted under a BAA, with ad attribution on every lead. Book a call with Curve.

What a mental health telehealth intake form includes

Most sections trace back to what a clinician needs before a first visit. Location comes first because health professionals must "be licensed or legally permitted to practice in the state where the patient is located" (telehealth.hhs.gov). Before the first telebehavioral visit, HHS says a provider should document "The patient's location," local emergency numbers and "A local emergency contact or support person" (HHS emergency plan guide).

Section	What it usually asks	Why the clinician needs it
Location and eligibility	State during visits, age, insurance or self-pay	Licensure follows the patient (HHS)
Reason for seeking care	What brings them in, in their own words or from a list	Matches the person to the right clinician
History	Past therapy or psychiatric care, diagnoses, hospital stays	Context for the first visit
Medications and allergies	Each current medicine and its dose	Needed before any prescribing decision
Screeners	PHQ-9 for depression, GAD-7 for anxiety (PHQ Screeners)	A standard starting point the clinician interprets
Safety	Thoughts of self-harm, with crisis resources next	Points the person to help now
Emergency contact and other providers	A nearby support person and other clinicians	Part of the emergency plan (HHS)
Contact and consent	Name, email, phone, date of birth; telehealth consent and privacy notice	"Most states require" informed consent for telehealth (HHS)

Related guides: what any telehealth intake form should ask and how to screen people out kindly.

Screeners and crisis questions

The PHQ-9 "scores each of the 9 DSM-IV criteria" for depression, and "The GAD-7 scores 7 common anxiety symptoms." The official site says "no permission is required to reproduce, translate, display or distribute them" (PHQ Screeners).

The PHQ-9's ninth question asks about thoughts of being better off dead or of self-harm. The PHQ manual says a final decision about the actual risk "requires a clinical interview" (PHQ instruction manual). A form is not a conversation, so the next screen should say where to get help now. People can call, text or chat the 988 Suicide & Crisis Lifeline, and "your conversation is confidential" (988 Lifeline). SAMHSA calls 911 "the primary contact for emergencies involving medical emergencies, fire, crimes in progress, or other situations requiring immediate physical intervention" (SAMHSA). Your clinical team writes the crisis wording and the follow-up.

Who may see the answers under HIPAA

For a practice HIPAA covers, intake answers are protected health information (PHI). HHS says "Generally, the Privacy Rule applies uniformly to all protected health information, without regard to the type of information," and names psychotherapy notes as one exception (HHS FAQ). Those are a mental health professional's notes "documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session," kept apart from the rest of the medical record (45 CFR 164.501), and using or disclosing them generally takes the patient's authorization (164.508(a)(2)). Typed intake answers are not session notes, so they get HIPAA's standard protections.

Who	May they see the answers?	Where the rule says so
Your clinicians and care team	Yes, for treatment, payment and health care operations	45 CFR 164.506(c)
Another provider treating the person	Yes, for that provider's treatment	164.506(c)(2)
Your form host, EHR and other vendors	Only under a signed business associate agreement (BAA)	164.502(e), 164.504(e)
The emergency contact	HHS says to get the patient's authorization to release information to them, if needed, and to notify them if you believe the patient is in crisis	HHS
Meta, Google and other ad platforms	Not for marketing without the person's HIPAA authorization	HHS bulletin
Others, for records of a federally assisted SUD program	Generally only with written consent or a court order	HHS on Part 2

The HHS tracking bulletin is direct about forms. Tracking that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" during an appointment request is a disclosure of PHI, and "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS bulletin). A June 20, 2024 court order vacated a different part, on IP addresses and public pages, as the HHS page notes. More: what makes an intake form HIPAA compliant.

Substance use disorder (SUD) care: 42 CFR Part 2

HHS says "Part 2 rules apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment," and "In general, Part 2 programs cannot share any information that would identify someone as having, or having had, a substance use disorder unless Part 2 specifically permits it" (HHS). A program "holds itself out as providing, and provides" that care (42 CFR 2.11), and federal assistance includes being a "Participating provider in the Medicare program" or holding a registration to dispense a controlled substance "used in the treatment of substance use disorders" (42 CFR 2.12). The 2024 update "has been effective since April 16, 2024, and compliance was required by February 16, 2026" (HHS). Whether your service counts is a legal question, so talk to your counsel.

What the FTC's BetterHelp and Cerebral cases say about intake answers

Neither was a HIPAA case. The FTC charged BetterHelp under the FTC Act (complaint), and the Department of Justice, on the FTC's referral, sued Cerebral under the FTC Act and two other federal laws (complaint).

BetterHelp, alleged. The complaint said its intake questionnaire asked whether a visitor was "experiencing overwhelming sadness, grief, or depression" (paragraph 21), and that from November 2018 to March 2020 it disclosed to Facebook the previous therapy of over 1.5 million visitors and users, taken from answers to "Have you been in counseling or therapy before?", to re-target them and optimize its ads (paragraph 53) (complaint).

BetterHelp, ordered. The final order, issued July 7, 2023, bars disclosing "Treatment Information" to a third party for advertising, a term that covers a consumer's "response to a question or questionnaire" (order). The FTC said BetterHelp would pay $7.8 million for partial refunds and must "obtain affirmative express consent before disclosing personal information to certain third parties for any purpose" (FTC).

Cerebral, alleged. The April 2024 complaint said tracking tools sent third parties "detailed responses provided by consumers who completed Cerebral's intake assessment" (paragraph 69), and that Cerebral's breach notice to HHS covered "nearly 3.2 million consumers between October 2019 and March 2023" (paragraph 70) (complaint).

Cerebral, ordered. Under the stipulated order, Cerebral is "permanently restrained and enjoined from using or disclosing to any third party Covered Information for Defined Advertising Purposes or for any third party's purposes," with exceptions for limited visitor data used for purposes such as reporting and analytics (order). The court entered a consent judgment on June 17, 2024 (docket, entry 33).

The lesson: intake answers are health information, and a pixel on the form or a list uploaded to an ad platform can carry them out. For measuring therapy ads without that risk, see conversion tracking for mental health practices.

How Curve Forms helps with mental health intake

Curve Forms are hosted by Curve under the BAA Curve Compliance signs on every plan, so submissions never pass through a third-party form tool.

• Guided intake. A guided flow, one step per card with a progress bar, with radio, multi-select, long text, date, file upload and statement fields, and logic that shows or hides follow-ups.
• Crisis and screening outcomes. A crisis outcome has its own end screen; statement fields can show 988 on any step. Screening by age, state or insurance gets custom end screens. Crisis and screened-out submissions send no conversion to ad platforms.
• Consent and access. Separate privacy and marketing consent checkboxes. Read-only and full-access roles, a log of every view or export, and detail-free notification emails on request.
• Ads without answers. Neutral form events reach Meta and Google Ads server-side through your event mappings. Answers, page titles and free text are never sent, and Curve strips PHI before data reaches an ad platform. Contact identifiers are off by default on Meta, Google Ads and TikTok.

Redirect to your booking page after submit, and see step-by-step drop-off. Read the intake funnel guide and Curve for mental health.

Sources, checked October 14, 2026: HHS tracking bulletin, mental health FAQ and Part 2 page; telehealth.hhs.gov on licensure, consent and emergency plans; 45 CFR 164.501, 164.502, 164.504, 164.506, 164.508; 42 CFR 2.11, 2.12; PHQ Screeners and manual; 988 Lifeline; SAMHSA; FTC BetterHelp complaint, order, release; FTC Cerebral complaint, order; Cerebral docket.

Frequently Asked Questions

What should a mental health telehealth intake form include, and who may see the answers?

The reason for care, history, medications, screeners such as the PHQ-9 and GAD-7, location, an emergency contact and telehealth consent. The care team may see the answers, vendors only under a BAA, and ad platforms not for marketing without HIPAA authorization (HHS).

Are mental health intake answers psychotherapy notes?

No. Psychotherapy notes are a mental health professional's session notes kept apart from the record (45 CFR 164.501). Intake answers get HIPAA's standard protections (HHS FAQ).

Can I put the PHQ-9 and GAD-7 on my intake form?

Yes. The official site says "no permission is required to reproduce, translate, display or distribute them" (PHQ Screeners). The clinician interprets the results.

What should an intake form do if someone reports thoughts of self-harm?

Show where to get help now: call, text or chat 988 (988 Lifeline), and 911 for emergencies needing immediate physical help (SAMHSA). Your clinical team sets the wording and the follow-up. In Curve Forms, a crisis outcome has its own end screen and sends no conversion to ad platforms.

Does 42 CFR Part 2 apply to my telehealth practice?

It applies to federally assisted programs that hold themselves out as providing, and provide, SUD diagnosis, treatment or referral (42 CFR 2.11), and some rules reach those who receive Part 2 records (HHS).

What did the FTC order BetterHelp to do about intake answers?

Its July 7, 2023 order bars disclosing "Treatment Information," which includes questionnaire responses, to third parties for advertising (FTC order).

Do Curve Forms send intake answers to Meta or Google?

No. Curve Forms sends a neutral form event server-side through your event mappings. Answers, page titles and free text are never sent.

Talk to Curve Compliance

Book a call. See how your mental health intake would run in Curve Forms, or have Curve's team review your intake funnel with you. Curve Forms are hosted under the BAA Curve signs on every plan, and most customers are live in about a week. Book a call with Curve.