On this page
A patient intake form collects what a practice needs before a first visit: who the patient is, how to reach them, their insurance, the reason for the visit, their health history and an acknowledgment that they received the practice's Notice of Privacy Practices. Ask only what the visit needs, host the form with a vendor that signs a business associate agreement (BAA), and keep the answers away from the ad and analytics tools on the page. Curve Forms from Curve Compliance hosts intake forms under the BAA Curve signs on every plan, and form answers are never sent to an ad platform.
Book a call. Running ads to the page your intake form sits on? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads and your other ad platforms, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a patient intake form is
A patient registration form records who the patient is, how to reach them and who pays. A medical intake form adds the reason for the visit and the history the clinician needs. Consent and acknowledgment pages hold the permissions. Many practices combine all three into one new-patient packet.
HIPAA does not list the fields an intake form must have. For a covered health care provider, it governs what happens to the answers. Once a provider collects them, they are individually identifiable health information, which HIPAA defines as health information, “including demographic information collected from an individual,” that is “created or received by a health care provider” and identifies the person (45 CFR 160.103). A few HIPAA rules also shape specific sections, and the template below names each one.
Patient intake form template: the fields by section
Use this as a starting list and cut anything your visit type does not need. The last column gives the federal rule where one applies. Where none does, the wording is your practice's decision.
| Section | What to ask | Rule that applies |
|---|---|---|
| Patient details | Legal name, preferred name, date of birth, phone and email | HIPAA's definition of individually identifiable health information includes “demographic information collected from an individual” (45 CFR 160.103) |
| How we may contact you | Preferred phone, email or mail, whether a voicemail or text is fine, and any other address to use | A provider “must permit individuals to request and must accommodate reasonable requests” to receive communications “by alternative means or at alternative locations” (45 CFR 164.522) |
| Parent, guardian or representative | Name and relationship of anyone with authority to make health care decisions for the patient, such as the parent of a minor | A covered entity must “treat a personal representative as the individual” for HIPAA purposes (45 CFR 164.502, paragraph (g)) |
| People involved in your care | Family members or friends the patient is happy for staff to talk with | A provider may share “the protected health information directly relevant to such person's involvement” in the patient's care or payment (45 CFR 164.510, paragraph (b)) |
| Insurance and billing | Plan name, member ID, policyholder, and a photo or scan of the insurance card | Payment is a permitted purpose: a covered entity “may use or disclose protected health information for its own treatment, payment, or health care operations” (45 CFR 164.506) |
| Reason for visit and history | Reason for the visit, current medications, allergies, conditions, past procedures and relevant family history | Treatment (45 CFR 164.506). Every answer becomes information the practice must protect |
| Notice of Privacy Practices acknowledgment | A line confirming the patient received the notice | A provider with a direct treatment relationship must “make a good faith effort to obtain a written acknowledgment of receipt of the notice” (45 CFR 164.520, paragraph (c)(2)(ii)) |
| Optional HIPAA consent | A general consent for treatment, payment and operations, if your practice uses one | Allowed, not required: a covered entity “may obtain consent of the individual” for these purposes (45 CFR 164.506, paragraph (b)) |
| Consent to treat and financial policy | Your practice's own treatment consent and payment terms | Not a HIPAA requirement; your practice sets these documents |
| Marketing permission | Leave it off the intake form, or offer it as a separate, optional authorization | Marketing needs an authorization (45 CFR 164.508, paragraph (a)(3)), which “may not be combined with any other document to create a compound authorization” outside narrow exceptions (paragraph (b)(3)) |
Registration, intake and consent forms: what goes where
Keep the permission pages separate from the questions, because HIPAA treats each one differently.
- Notice of Privacy Practices. If the first visit happens online, HIPAA says the provider “must provide electronic notice automatically and contemporaneously in response to the individual's first request for service,” and the acknowledgment rule applies to that electronic notice too. A practice with a website must also “prominently post its notice on the web site” (45 CFR 164.520). See the Notice of Privacy Practices guide.
- HIPAA consent. A consent can't stand in for an authorization. HIPAA says it “shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required” (45 CFR 164.506). See what a HIPAA consent form is.
- Authorizations. Uses such as marketing need a signed authorization with required elements, and a covered entity “may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization” outside the rule's exceptions (45 CFR 164.508). See HIPAA marketing authorization, and for records requests, the HIPAA release form.
Which documents your practice needs, and how each should read, depends on your state and your services, so talk to your counsel.
Online intake: hosting and BAAs
An online form stores every answer with the vendor that hosts it. HHS says that if a covered entity “uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules.” It adds that this holds “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data” (HHS).
The Security Rule's technical safeguards then apply to the system that holds the answers, including access control, audit controls and transmission security (45 CFR 164.312). Before you pick a form tool, ask whether the vendor signs a BAA on the plan you will buy, who can see submissions, whether views and exports are logged, and what notification emails contain.
To compare tools, see form builders that sign a BAA and the BAA Directory forms list. For the full compliance checklist, see what makes an online intake form HIPAA compliant. For telehealth questions, see telehealth intake form questions, and for referrals from other providers, the medical referral form template.
Keeping intake answers out of pixels
HHS says “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts,” and that what they disclose can include “information that the individual types or selects when they use regulated entities' websites or mobile apps” (HHS). On an intake page, a pixel or session replay script can pick up field values, page addresses that name the visit type, or button labels.
HHS gives an appointment example: the clinic's website “might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor. In this case, the tracking technology vendor is a business associate, and a BAA is required.” It also says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). The same page notes that a federal court vacated part of the bulletin on June 20, 2024: the part about an IP address connected with a visit to an unauthenticated public page addressing specific health conditions or healthcare providers.
Keep ad pixels and session replay off intake pages, keep page addresses neutral, and check what loads before launch. Curve's free website scan lists the pixels and trackers on a page. For which lead details are safe to share with ad platforms at all, see which lead fields can reach your ad platforms.
Tracking intake submissions as conversions without PHI
Your ads still need to learn that a form was completed. The safe pattern counts the submission as a conversion with a neutral event name, sent server-side and carrying a fixed list of fields that never includes answers. Meta and Google Ads don't sign a BAA (Meta; Google Ads), so nothing that reaches them should carry PHI. See which ad platforms sign a BAA and event tracking on a healthcare website.
With Curve Forms, form events such as a completed submission reach Meta, Google Ads and your other destinations server-side through your event mappings. Form answers, page titles and free text are never sent, and step labels are stripped from step events. Screened-out and crisis submissions send no conversion, so the platforms learn from eligible leads.
How Curve Compliance helps
Curve Forms is Curve Compliance's HIPAA-hosted form builder. Forms are hosted by Curve under the BAA Curve signs on every plan, so submissions never pass through a third-party form tool. Build a stacked form or a guided flow with one step per card, using text, date, dropdown, checkbox, file upload and other field types, for example for an insurance card photo. Logic shows or hides questions based on earlier answers, and separate checkboxes cover privacy consent and marketing consent.
Every submission lands in the Leads inbox with its answers, UTMs, ad click ID, attribution and staff notes. Curve can send a detail-free notification on request, read-only and full-access roles control who sees what, every view or export of submissions is logged, and the export API lets a scheduled job on your side keep your CRM current. Around the form, Curve replaces browser ad pixels with one script and checks every event for PHI-like patterns. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 160.103; 45 CFR 164.312; 45 CFR 164.502; 45 CFR 164.506; 45 CFR 164.508; 45 CFR 164.510; 45 CFR 164.520; 45 CFR 164.522; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; HHS, Guidance on HIPAA and Cloud Computing.
Frequently Asked Questions
What is a patient intake form?
A patient intake form, also called a medical intake form, collects a new patient's details, contact preferences, insurance, reason for visit, health history and the acknowledgments a practice needs before the first visit. Once a provider collects those answers, HIPAA treats them as individually identifiable health information (45 CFR 160.103).
What should a patient registration form include?
Legal name, date of birth, phone and email, how the patient prefers to be contacted, any parent, guardian or representative, the people they allow you to talk to, and insurance details. HIPAA requires providers to accommodate reasonable requests to be contacted by other means or at other locations (45 CFR 164.522), so a contact-preference question helps.
What is an example of an intake form?
The template above is one, from patient details to the Notice of Privacy Practices acknowledgment. A therapy, dental or telehealth practice adjusts the history section to its visits; see telehealth intake form questions.
Can you get HIPAA forms online?
Yes. Online intake works when the vendor that hosts the form signs a BAA, because HHS treats a service that stores ePHI as a business associate even if it can't read the data (HHS), and when no ad pixel on the page collects the answers. Curve Forms are hosted by Curve under the BAA Curve signs on every plan.
Does an online intake form need a BAA?
Yes, with the vendor that stores or processes the answers. HHS says using a cloud service to process or store ePHI without a BAA puts the covered entity “in violation of the HIPAA Rules” (HHS). Check the BAA covers the plan you use.
Can the Meta Pixel run on an intake form page?
HHS says a tracking vendor that receives appointment details and an IP address from a clinic's site is a business associate and needs a BAA (HHS), and Meta doesn't sign one (Directory entry). Keep the pixel off intake pages and send a neutral, server-side conversion instead.
Talk to Curve Compliance
Book a call. Want intake forms hosted under a BAA, with the ad and campaign attached to every lead? Curve Forms from Curve Compliance sends form events to your ad platforms without the answers, and Curve's team does the setup, typically live in about a week. Book a call with Curve.