General information, not legal advice — have your attorney or clinical lead review the final form.
An appointment request form lets a patient ask for a visit from your website, and your team confirms the time by phone, text or email. This page gives you a field-by-field template built on one idea: collect enough to call the patient back, not their medical history. It also covers the wording, routing and HIPAA setup that turn requests into booked visits.
About 140 people a month search "appointment request form" (average CPC $7.96; Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026), most of them looking for something they can use today.
Appointment request form vs online booking
| Item | Appointment request form | Online booking |
|---|---|---|
| Patient picks | Preferred days and times | An exact open slot |
| Staff work | Call or message to confirm | Little, unless rules are complex |
| Best for | New patients, visits that need screening, insurance checks | Established patients, simple visit types |
| Setup | A form on your website | Scheduling software linked to your calendar or EHR |
You can use both: booking for routine visits, a request form for everything that needs a human first. If you're weighing a booking tool, see online appointment booking.
The fields to include (and the ones to leave out)
The minimum necessary rule asks practices to limit protected health information (PHI) to what a purpose needs (HHS guidance (opens in a new tab)). For a request, the purpose is a callback.
Include: who the patient is, how to reach them, whether they're new, when they're free, and, optionally, a few words on why they're coming in and their insurance plan. The template below turns that into nine fields.
Leave out:
- Date of birth and Social Security number. Collect them at registration, in your EHR or intake system.
- Detailed symptoms or a free-text "tell us about your condition" box.
- Medication lists, history and uploads of medical records.
- Insurance card photos. A plan name is enough to check network status.
Full intake belongs in a separate, secured step; see the new patient form template.
Free appointment request form template
Copy-paste field list:
| Field | Type | Required? | Notes |
|---|---|---|---|
| Full name | Text | Yes | One field is enough |
| Phone | Phone | Yes | |
| Yes | |||
| Preferred contact method | Choice: phone call, text, email | Yes | Honor it when you reply |
| New or existing patient | Choice | Yes | Routes the request |
| Reason for visit | Short text, 100 characters max | No | Hint: "A few words, such as 'annual physical' or 'knee pain'" |
| Preferred days and times | Checkboxes: weekday mornings, afternoons, evenings, Saturday | Yes | |
| Insurance plan | Text or dropdown | No | Plan name only |
| Consent | Checkbox | Yes | Wording below |
Sections, top to bottom: a one-line intro, the emergency line, the fields, the consent checkbox, the privacy link and the response-time promise, then the submit button.
Copy it: the field table above and the wording below are ready to paste into your form builder or a document and edit.
Consent, privacy notice and response-time wording
Illustrative example for a fictional practice; adapt it and have it reviewed:
Illustrative example: Harbor Family Medicine
Above the form: "Use this form to request an appointment. If this is a medical emergency, call 911. This form isn't for medical questions."
Consent checkbox: "I agree that Harbor Family Medicine may contact me about this request by the method I chose above."
Below the checkbox: "Read our Notice of Privacy Practices." (link)
Response time: "We reply to requests by the end of the next business day."
If you'll reply by email or text, two HHS points apply. The Security Rule doesn't prohibit sending PHI by email, but it must be "adequately protected" (HHS FAQ (opens in a new tab)). And a provider must accommodate reasonable requests to receive communications "by alternative means or at alternative locations" (45 CFR 164.522(b) (opens in a new tab)), which is why the preferred-contact field matters. Ask your attorney about consent for text messages.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Routing requests to the right person fast
- One queue. All requests land in one place, not in five personal inboxes.
- One owner per day. Name the person responsible for clearing the queue.
- Route by the "new or existing" answer. New patients often need an insurance check first.
- After-hours requests first. They're the oldest when the office opens.
- Close the loop. Mark each request booked, waitlisted or unable to reach, so nothing sits.
- Measure response time weekly against the promise on your form; see how fast to respond to requests.
Making the form HIPAA-safe on your website
- Use a form tool that signs a BAA, and a host that signs one if entries are stored on your site. The HIPAA compliant forms guide walks through each step.
- Keep notification emails thin: "New appointment request," with the details read inside the secure system.
- Remove ad pixels and analytics tags from the form page. HHS's tracking guidance (opens in a new tab) says a tracking technology that collects someone's email address or "reason for seeking health care" while they request an appointment is receiving PHI.
- Limit access to the staff who work the queue.
Medfy's websites include HIPAA-compliant forms. Requests land in the patient CRM and inbox, and Medfy's first-party analytics counts form submissions by channel, so you can see which sources bring requests. A free marketing audit checks your current site and flags privacy risks such as pixels on patient forms.
Frequently asked questions
What should an appointment request form include?
Enough to call the patient back, and no more: full name, phone, email, preferred contact method, new or existing patient, preferred days and times, an optional short reason for the visit, optional insurance, and a consent checkbox. Add an emergency line and the time by which you'll reply. Leave out dates of birth, Social Security numbers, symptoms in detail and medical history.
Is an appointment request form covered by HIPAA?
For a practice covered by HIPAA, a submitted request with a name, contact details and a reason for the visit is generally protected health information. The form tool, the website host if it stores entries, and the inbox that receives requests all need safeguards and usually BAAs, and ad tracking scripts shouldn't run on the page. Confirm your setup with your compliance officer or attorney.
How fast should a practice respond to an appointment request?
Set a target your front desk can meet every working day, publish it on the form, and measure it. A clear promise such as a reply by the end of the next business day sets expectations and stops duplicate calls. Requests that arrive after hours should be first in the queue next morning, and one named person should own the queue each day.