On this page
A new patient form, often called a patient registration form, collects who the patient is, how to reach them, their insurance and an emergency contact, and it is the natural place to ask the patient to acknowledge the practice's Notice of Privacy Practices. HIPAA asks covered providers to make a good faith effort to get that written acknowledgment, so the acknowledgment belongs on the form, not on a separate sheet nobody finds later. Curve Forms from Curve Compliance hosts registration forms under the BAA Curve signs on every plan, and form answers are never sent to ad platforms.
Book a call. Want new patient forms hosted under a BAA, with the ad and campaign attached to every registration? Curve Forms from Curve Compliance sends form events to your ad platforms without the answers, and Curve's team does the setup, typically live in about a week. Book a call with Curve.
Registration vs intake vs medical history
New-patient paperwork usually splits into a few forms. Keeping them distinct makes each one shorter, and lets you send the right one at the right time: registration when the appointment is booked, history and intake a few days before the visit.
| Form | What it covers | Guide |
|---|---|---|
| New patient registration | Identity, contact details, insurance, responsible party, emergency contact, privacy notice acknowledgment | This page |
| Intake | Reason for the visit, preferences and practical details | Patient intake form template |
| Medical history | Conditions, surgeries, medications, allergies, family history | Medical history form template |
| Consent | Consent to treatment, telehealth consent, other permissions | Telehealth consent form template and HIPAA consent form |
New patient form template: fields by section
Use this as a starting list. Every field below works on an online form as a text, date, phone, email, dropdown, checkbox, statement or file upload field.
| Section | Fields | Suggested field type |
|---|---|---|
| Patient | Legal name, preferred name, date of birth | Text, date |
| Contact | Mobile phone, email, preferred contact method, home address (street, city, state and ZIP as separate text fields) | Phone, email, dropdown, text |
| Insurance | Plan name, member ID, group number, subscriber name and date of birth if not the patient, front and back of the card | Text, date, file upload |
| Responsible party | Who pays, if not the patient (for example a parent or guardian), and how to reach them | Text, phone |
| Emergency contact | Name, relationship and phone number | Text, dropdown, phone |
| Other providers | Primary care provider and preferred pharmacy | Text |
| How you heard about us | Search, social, a referral, an ad or something else | Dropdown |
| Privacy notice | A statement linking the Notice of Privacy Practices, and a checkbox acknowledging receipt | Statement, checkbox |
| Communication choices | Separate checkboxes for privacy consent and for marketing messages | Checkbox |
Two notes on that list. "How you heard about us" is worth asking, but it is what the patient remembers, not what happened; pair it with the ad click that brought them so you can compare. And keep marketing consent as its own unticked checkbox, separate from the privacy notice, so one never reads as a condition of the other.
The privacy notice acknowledgment
A covered provider with a direct treatment relationship must give the notice “No later than the date of the first service delivery, including service delivered electronically,” and, except in an emergency, “make a good faith effort to obtain a written acknowledgment of receipt of the notice.” If the provider can't get it, the rule says to “document its good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained” (45 CFR 164.520).
HHS adds a rule for online care: “When first service delivery to an individual is provided over the Internet, through e-mail, or otherwise electronically, the provider must send an electronic notice automatically and contemporaneously in response to the individual’s first request for service.” The provider must also “make a good faith effort to obtain a return receipt or other transmission from the individual in response to receiving the notice” (HHS). On an online registration form, one way to record this is a statement field that links the notice, plus a checkbox the patient ticks. Whether that meets your documentation needs is a question for your practice, so talk to your counsel before you retire the paper version.
Insurance card uploads
Asking for a photo of the front and back of the card saves the front desk from typing member IDs and catches the details patients forget, such as the group number or the payer phone line. The image carries the patient's name and member ID, so treat it like any other part of the record: collect it inside the form, never by email or text, and keep it with a host that signs a BAA. Accept the formats phones produce, including HEIC from iPhones, so patients are not asked to convert a photo.
Running registration online
HHS uses registration as its example of a page that looks public but is not harmless. If someone “enters registration information (e.g., name, email address) on that registration page, such information meets the definition of IIHI,” and “if tracking technologies on a regulated entity’s patient portal login page or registration page collect an individual’s login information or registration information, that information is a disclosure of PHI and is subject to the HIPAA Rules” (HHS). HHS's example is a patient portal page, and a new patient form collects the same kind of details, so treat its page the same way. The bulletin also carries HHS's note that a June 20, 2024 court order vacated the part of the guidance about connecting an IP address with a visit to a public page about health conditions or providers; the registration example is about what the person types.
- Keep pixels off the form page, or make sure they cannot read the fields. Send one neutral "registration completed" event instead.
- Keep details out of the URL. No names, emails or plan names in the thank-you page address.
- Send patients on to the next step. After registration, redirect to booking or to the history form, so the paperwork feels like one flow.
Run the free website scan on your registration page to see which pixels and trackers it loads today. Once a patient is registered, they can also ask for copies of their records; the medical records request form guide covers that side.
How Curve Compliance helps
Curve Forms covers a registration form with text, email, phone, date, dropdown and checkbox fields, statement fields for the privacy notice text, separate checkboxes for privacy consent and marketing consent, and file upload for insurance cards (PDF, JPG, PNG, WEBP and HEIC, plus DOC and DOCX). After submit, the form can redirect to your booking or checkout page or show a custom thank-you page. Forms are hosted by Curve under the BAA Curve signs on every plan, and submissions never pass through a third-party form tool.
Each registration arrives in the Leads inbox with its answers, UTMs and ad click ID, so the self-reported "how you heard about us" sits next to the real source. Notification emails reach your team with Reply-to set to the patient, a detail-free notification is available on request, and the Export API lets a scheduled job on your side keep your CRM current. Form events reach Meta, Google Ads and your other destinations server-side through your event mappings, while form answers are never sent. Curve Compliance is SOC 2 Type II, and its team does the setup, typically live in about a week. Book a call to plan your registration form with Curve's team. After the visit, a short patient satisfaction survey closes the loop.
Sources, checked November 9, 2026: 45 CFR 164.520; HHS, Notice of Privacy Practices for Protected Health Information; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; 45 CFR 160.103.
Frequently Asked Questions
What is a new patient form?
A new patient form collects a first-time patient's identity, contact details, insurance and emergency contact before the first visit. It is also the natural place to record the patient's acknowledgment of the Notice of Privacy Practices.
What is a patient registration form?
It is another name for the new patient form: the form that registers a patient with the practice, separate from the intake and medical history forms.
Is the privacy notice acknowledgment required?
A covered provider with a direct treatment relationship must “make a good faith effort to obtain a written acknowledgment of receipt of the notice,” and document why if it can't (45 CFR 164.520).
Can patients upload insurance cards?
Yes. Ask for the front and back as images inside the form, with a host that signs a BAA; Curve Forms accepts PDF, JPG, PNG, WEBP and HEIC uploads.
What is the difference between registration and intake?
Registration covers who the patient is and who pays. Intake covers why they are coming in; see the patient intake form template.
Do registration forms fall under HIPAA?
Yes, once a covered provider collects them. HHS says registration details such as a name and email address entered on a registration page meet the definition of individually identifiable health information (HHS; 45 CFR 160.103).
What if a patient does not acknowledge the privacy notice?
Give the notice anyway, then document your good faith efforts and the reason the acknowledgment was not obtained (45 CFR 164.520).
Talk to Curve Compliance
Book a call. Ready to take new patient registration online? Curve Forms hosts it under the BAA Curve signs on every plan, keeps answers away from your ad platforms, and ties each new patient to the ad that brought them. Curve's team does the setup, typically live in about a week. Book a call with Curve.