Telehealth Intake Form: What to Ask and What to Protect

A telehealth intake form should ask seven things, in this order: where the patient is located, how to reach them, their medical history, current medications and allergies, the reason for the visit, consent to telehealth and acknowledgment of the privacy notice, and how they will pay. The clinician decides the clinical questions; the form collects answers, keeps people moving and keeps answers out of ad platforms. Curve Forms builds that flow one step per card, hosted under the BAA Curve Compliance signs on every plan, and sends Meta and Google Ads only neutral form events, such as a step or the whole form being completed, never the answers.

Book a demo. See Curve Forms built around your intake questions, or have Curve's team look at your current intake funnel and what it sends to ad platforms. Book a Curve Forms demo.

The seven sections of a telehealth intake form

Order matters. Questions that decide whether someone can be seen go first, so nobody types a medical history only to learn the service is not offered where they live. Contact details come once the person is invested.

1. Eligibility and location

Ask which state the patient is in first. HHS says health professionals "must meet the licensure requirements of the state where they are located and be licensed or legally permitted to practice in the state where the patient is located" (telehealth.hhs.gov). If no clinician can see patients there, say so kindly on the first screen. The form is not the final check: HHS tells providers to "verify patient location and obtain consent" before an appointment (telehealth.hhs.gov). Other screening questions, such as age, belong here too; see eligibility screening in intake forms and multi-state telehealth licensing.

2. Contact and identity

Name, email, phone and date of birth let the care team reach the person and know who they are. Some teams add an emergency contact: HHS's telehealth emergency checklist asks "Who is your local emergency contact or support person?" (telehealth.hhs.gov). The telehealth intake funnel guide covers the order screen by screen.

3. Medical history

This is the clinician's section, and it depends on the service. Write it with your clinical team, in plain words. Service guides cover the usual questions: GLP-1 intake forms, TRT intake forms and mental health intake forms.

4. Current medications and allergies

A list of current medicines, supplements and allergies shows the clinician what the person already takes. A long-text field works, and a file upload lets someone add a photo of a pharmacy label instead.

5. The reason for the visit

One question in the person's own words: what brings you here today? HHS uses this answer as an example: tracking technologies might collect "an individual's email address, or reason for seeking health care typed or selected by an individual" when someone makes an appointment on a regulated entity's website, and "In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply" (HHS bulletin). That is why answers, typed or selected, must stay out of every ad tag.

6. Consent to telehealth and acknowledgment of the privacy notice

These are two separate things. For telehealth consent, HHS says "specific informed consent laws vary by state," that "Obtaining informed consent with your patient is typically done before the first appointment," and: "Make sure to have your medical/intake forms reviewed by your legal team." (telehealth.hhs.gov)

For the privacy notice, a covered provider with a direct treatment relationship must make "a good faith effort to obtain a written acknowledgment of receipt of the notice" (45 CFR 164.520(c)(2)(ii)). When the first service is delivered electronically, the provider "must provide electronic notice automatically and contemporaneously in response to the individual's first request for service" (164.520(c)(3)(iii)), and HHS says the acknowledgment can be obtained "either electronically or through other means" (HHS FAQ). Keep marketing consent as its own checkbox.

7. Payment or insurance

Ask whether the person will use insurance or self-pay. Under HIPAA, health information covers "the past, present, or future payment for the provision of health care to an individual" (45 CFR 160.103), so payment answers deserve the same care as medical ones. HHS notes that "Many commercial health plans have broadened coverage for telehealth services" (telehealth.hhs.gov). If payment happens at checkout, send people there after they submit.

What each section is for, and where it may go

On a covered entity's intake form, each answer is part of a submission that identifies the person and relates to their care. HIPAA defines individually identifiable health information as health information, "including demographic information collected from an individual," that relates to a person's health, care or payment for care and "identifies the individual" (45 CFR 160.103). See what counts as PHI on a website and does HIPAA apply to cash-pay telehealth.

Section	Why the clinician needs it	Is it PHI on a covered entity's form?	May it reach an ad platform?
Eligibility and location	Licensure in the patient's state (HHS)	Yes	Never. Only a neutral event that a step or the form was completed.
Contact and identity	To reach the person	Yes; HHS cites an email address (bulletin)	Never. Only a neutral event that a step or the form was completed.
Medical history	To prepare for the visit	Yes	Never. Only a neutral event that a step or the form was completed.
Medications and allergies	To see what the person takes	Yes	Never. Only a neutral event that a step or the form was completed.
Reason for the visit	To know what help is wanted	Yes; HHS cites it (bulletin)	Never. Only a neutral event that a step or the form was completed.
Consent	Telehealth consent, notice acknowledgment (164.520)	Yes	Never. Only a neutral event that a step or the form was completed.
Payment or insurance	To bill a plan or confirm self-pay	Yes (160.103)	Never. Only a neutral event that a step or the form was completed.

What may reach an ad platform

The answer in every row is the same: never the answers. The most an ad platform needs is a neutral event, such as form started, step completed or form submitted, credited to the ad click. HHS says "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI" (HHS bulletin), and Curve's BAA Directory lists Meta and Google Ads as not signing one.

Watch the quiet leaks too: a step label like "Thyroid history," or a page URL or title naming a condition, says what the person is being seen for without a single answer. Where tracking belongs in virtual care intake draws the line at the first clinical question, and where telehealth intake forms leak lists the leak points to check.

A note on the bulletin: its own page says a federal court in Texas, on June 20, 2024, vacated the part about connecting an IP address with a visit to a public webpage on health conditions or providers. The appointment example above is still on the page as of October 14, 2026, and HHS says it "is evaluating its next steps in light of that order" (HHS bulletin).

How Curve Forms helps

Curve Forms turns the seven sections into a guided flow that shows one step per card with a progress bar, or a stacked form if you prefer. Logic shows or hides questions based on earlier answers. Screening outcomes can screen people out by age, by service area such as a state answer, or by insurance, each with its own end screen, and screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads.

The field types fit each of the seven sections: text, email, phone, long text, number, date, dropdown, multiple choice, multi-select, checkbox, toggle, statement fields, and file upload for an insurance card or a medication list (PDF, JPG, PNG, WEBP, HEIC, DOC or DOCX). Privacy consent and marketing consent are separate checkboxes. After submit, people can go straight to your booking or checkout page, or to a custom thank-you page.

Every form is hosted by Curve under the BAA it signs on every plan, so submissions never pass through a third-party form tool. Each lead lands in the Leads inbox with its answers, UTMs, ad click ID and attribution, and your team gets an email with Reply-to set to the respondent. Form events (form started, step progress, form submission completed, lead qualified and lead converted) reach Meta, Google Ads and your other destinations server-side through your event mappings. Form answers, page titles and free text are never sent, and step labels are stripped from step events. The step-by-step funnel shows where people drop off. Curve's team does the setup, and most customers are live in about a week. For what your own form must say, talk to your counsel.

Sources, checked October 14, 2026: telehealth.hhs.gov pages Getting started with licensure, Licensing across state lines, Obtaining informed consent, Creating an emergency plan and Billing for telehealth; HHS bulletin on online tracking technologies; HHS FAQ on electronic notices of privacy practices; 45 CFR 160.103 and 164.520; FTC guidance on health information; and Curve's BAA Directory entries for Meta and Google Ads.

Frequently Asked Questions

What should a telehealth intake form ask?

The patient's location, contact details, medical history, medications and allergies, the reason for the visit, consent, and payment or insurance. The clinician decides the clinical questions.

Why do telehealth intake forms ask which state you are in?

Because the clinician has to be allowed to practice there. HHS says health professionals must "be licensed or legally permitted to practice in the state where the patient is located" (telehealth.hhs.gov).

Can intake form answers be sent to Meta or Google Ads?

Not on a covered entity's form without each person's HIPAA authorization. On that form the answers are PHI, and HHS requires a BAA plus a Privacy Rule permission, or that authorization, before PHI goes to a tracking vendor (HHS bulletin). Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. Outside HIPAA, the FTC Act still applies (FTC guidance). Send a neutral form event instead.

Does a privacy notice checkbox let us share intake answers for advertising?

No. HHS says the Privacy Rule "does not permit disclosures of PHI to a tracking technology vendor based solely on a regulated entity informing individuals in its privacy policy, notice, or terms and conditions of use that it plans to make such disclosures" (HHS bulletin).

Can patients acknowledge the privacy notice online?

Yes. HHS says a provider that delivers its notice electronically must make a good faith effort to obtain a written acknowledgment of receipt, "either electronically or through other means" (HHS FAQ). The rule itself is 45 CFR 164.520(c).

Should contact details come before or after the medical questions?

After eligibility and before the medical questions, once the person knows the service is offered where they live. Your clinical team sets the rest of the order.

What does Curve Forms send to ad platforms from an intake form?

Neutral form events: form started, step progress, form submission completed, lead qualified and lead converted, sent server-side through your event mappings. Form answers, page titles and free text are never sent, and step labels are stripped from step events.

Talk to Curve Compliance

Book a demo. See Curve Forms built around your seven intake sections, or have Curve's team look at your current intake funnel and what it sends to Meta and Google. Curve signs a BAA on every plan, and most customers are live in about a week. Book a Curve Forms demo.