What Makes an Online Intake Form HIPAA Compliant?

An online intake form is HIPAA compliant when every vendor that stores or handles the answers has signed a business associate agreement (BAA), the systems holding the answers meet the HIPAA Security Rule's technical safeguards, and no ad pixel or tag on the form page can pass the answers to a vendor that has not signed one. Those parts come from 45 CFR 164.502(e), 45 CFR 164.312 and the HHS tracking bulletin. Curve Forms from Curve Compliance hosts intake forms under the BAA Curve signs on every plan and sends ad platforms a neutral form event, never the answers.

Book a demo. Curve's team will review your intake form with you, from where the answers are stored to what the page sends to Meta and Google, and show you Curve Forms. Book a Curve Forms demo.

First, check that HIPAA applies to your form

HIPAA's duties fall on covered entities, which include "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter," and on their business associates (45 CFR 160.103). When a covered entity's form collects health information that identifies the person, the answers are protected health information (PHI), held electronically as ePHI.

If you run a cash-pay service, start with does HIPAA apply to cash-pay telehealth and what counts as PHI on a website. There is also no official HIPAA certification for a form: HHS says "OCR does not endorse, certify, or recommend specific technology or products" (HHS cloud computing guidance).

1. A BAA with the form vendor, and its BAAs with its vendors

Under 45 CFR 164.502(e)(1), a covered entity "may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information." Those assurances "must be documented through a written contract or other written agreement or arrangement" that meets 164.504(e). The Security Rule repeats the requirement for ePHI at 164.308(b).

Among other terms, 164.504(e)(2) has the business associate agree to "Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information" (subpart C is the Security Rule), to report uses or disclosures the contract does not allow, and to make its own subcontractors agree to the same restrictions and conditions.

HHS applies this to hosted software: when a covered entity uses a cloud service provider (CSP) "to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA," and "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." A covered entity that uses one to store ePHI without a BAA "is in violation of the HIPAA Rules" (HHS cloud computing guidance).

Answers also travel in notification emails, spreadsheet downloads and CRM syncs, so confirm a BAA stands behind every place a copy lands. See form builders that sign a BAA and the best HIPAA-compliant form builders for telehealth intake.

2. The Security Rule's technical safeguards

The systems that store and display submissions must meet the technical safeguards in 45 CFR 164.312. There are five standards: access control, audit controls, integrity, person or entity authentication, and transmission security. Under 164.306(d), each implementation specification is labeled "Required" or "Addressable," and under 164.306(c) every applicable standard must be met, including the two (audit controls and person or entity authentication) that list no specifications.

Addressable does not mean optional. For each addressable item, you must "Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment," then implement it, or document why not and "Implement an equivalent alternative measure if reasonable and appropriate" (164.306(d)(3)). Encryption is addressable in both places it appears in 164.312, so that decision belongs in your risk analysis, which 164.308(a)(1)(ii)(A) marks Required: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information".

On January 6, 2025, HHS proposed to "remove the distinction between required and addressable implementation specifications and make all implementation specifications required, with specific, limited exceptions" (Federal Register). As of October 14, 2026, no final rule is listed and the eCFR still uses both labels. More: why a BAA is not enough under the Security Rule.

3. The part most teams miss: the ad pixel on the form page

A BAA with your form vendor covers what that vendor handles. It does not extend to a Meta pixel, Google tag or TikTok pixel firing on the same page. The HHS bulletin gives an example: if a person "makes an appointment through the website of a covered health clinic" that uses third-party tracking, the site might send information about the appointment to the tracking vendor, and then "the tracking technology vendor is a business associate, and a BAA is required" (HHS bulletin).

The bulletin's rule is direct: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." Nor is a promise to clean the data later enough: "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS bulletin). Curve's BAA Directory lists Meta, Google Ads and TikTok as not signing a BAA.

On June 20, 2024, a federal court vacated one part of the bulletin: HHS's notice on the page says it concerns an IP address connected with a visit to an unauthenticated public webpage about specific health conditions or healthcare providers. The appointment example and the BAA rule above are still on the page as of October 14, 2026. See the bulletin, annotated.

The practical answer keeps the ad signal and drops the answers: take browser pixels off the form and thank-you pages, and send a neutral form-completed event server-side through a BAA-covered vendor, with no answers. Check your pages with Curve's free compliance scanner, and see how to build a telehealth intake funnel for where events belong in a multi-step flow.

Checklist: what a HIPAA compliant intake form needs

Requirement	What it means for an intake form	Where the rule says so
A BAA with the form vendor	The company hosting the form and storing submissions signs before real answers arrive	45 CFR 164.502(e), 164.504(e) and 164.308(b); HHS cloud guidance
A BAA for every copy	Email, storage and CRM vendors that keep answers for you sign too	164.502(e); HHS cloud guidance, question 5
Risk analysis (Required)	Your risk analysis covers the form, its vendors and the tags on its pages	164.308(a)(1)(ii)(A); HHS tracking bulletin
Access control: unique user identification and emergency access procedure (Required); automatic logoff and encryption and decryption (Addressable)	Each staff member signs in as themselves and sees only what their role allows; idle logoff and encryption are assessed	164.312(a)
Audit controls (standard)	Activity, such as who opened or exported submissions, is recorded and reviewed	164.312(b)
Integrity: mechanism to authenticate ePHI (Addressable)	Answers are protected from improper change or deletion	164.312(c)
Person or entity authentication (standard)	Staff prove who they are before they see submissions	164.312(d)
Transmission security: integrity controls and encryption (Addressable)	Decide and document how answers are protected in transit; for a web form, usually HTTPS	164.312(e)
No PHI to tracking vendors without a BAA and a permission, or a HIPAA authorization	No ad pixel or tag on the form or thank-you page can read or send the answers	HHS tracking bulletin

This checklist is a practical summary, not legal advice. Talk to your counsel about your own setup.

How Curve Forms helps

Here is how Curve Forms maps to the three parts above. Forms are hosted by Curve under the BAA Curve signs on every plan, so a submission never passes through a third-party form tool (BAA Directory entry). Your team works leads in the Leads inbox with read-only and full-access roles, every view or export of submissions is logged, and a lead can have a retention window or a legal hold. Notification emails can be detail-free on request.

On the ad side, form events such as form started, step progress and form submission completed reach Meta, Google Ads and your other destinations server-side through your event mappings. Form answers, page titles and free text are never sent, step labels are stripped, and Curve strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup.

Sources, checked October 14, 2026: 45 CFR 160.103, 164.306, 164.308, 164.312, 164.502 and 164.504 (eCFR); HHS Guidance on HIPAA and Cloud Computing; HHS bulletin on online tracking technologies; HHS proposed Security Rule changes, Federal Register, January 6, 2025; and Curve's BAA Directory entries for Meta, Google Ads and TikTok.

Frequently Asked Questions

What makes an online intake form HIPAA compliant?

A BAA with every vendor that stores or handles the answers, the Security Rule's technical safeguards on the systems that hold them (45 CFR 164.312), and no ad pixel on the form page that can send answers to a vendor without a BAA (HHS bulletin). Curve Forms hosts intake forms under the BAA Curve Compliance signs on every plan.

Does my form builder need to sign a BAA?

Yes, if it stores submissions for a covered entity. HHS says a cloud provider that stores ePHI for a covered entity is a business associate, "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS cloud guidance). The contract must meet 45 CFR 164.504(e).

Is encryption required for a HIPAA compliant intake form?

Under the current rule, encryption is "Addressable" (45 CFR 164.312): you must assess it, then implement it or document why not and use an equivalent measure where reasonable (164.306(d)). A January 6, 2025 HHS proposal would make all implementation specifications required, with limited exceptions; no final rule is listed as of October 14, 2026.

Can I put a Meta pixel on a HIPAA intake form page?

Not one that can send PHI, unless each person has signed a HIPAA authorization. Otherwise, HHS says tracking technology vendors must have signed a BAA, with an applicable permission, before they receive PHI (HHS bulletin), and Curve's BAA Directory lists Meta as not signing one. Send a neutral form event server-side instead, with no answers.

Does a cookie banner make my intake form page HIPAA compliant?

No. HHS says website banners that ask users to accept or reject tracking "do not constitute a valid HIPAA authorization" (HHS bulletin). More in is a cookie banner enough for HIPAA.

Do emailed form notifications need a BAA?

If the email carries the answers, check that your email provider has signed one: HHS treats a cloud provider storing ePHI for a covered entity as a business associate (HHS cloud guidance). Curve Forms can send a detail-free notification that links to the Leads inbox instead.

What should a telehealth intake form ask?

That depends on the service, and the clinician decides. Curve's guide to telehealth intake form questions walks through the usual sections in order and which answers are PHI.

Talk to Curve Compliance

Book a demo. See Curve Forms in a demo, or have Curve's team review your intake funnel: where the answers are stored, who has signed a BAA, and what your form pages send to Meta, Google and TikTok. Curve signs a BAA on every plan, and most customers are live in about a week. Book a Curve Forms demo.