Patient intake form: free templates and how to use them safely

What a patient intake form is for

Intake has three jobs, and a good form keeps them separate:

1. Registration: identity, contact details, insurance and who pays. The front desk uses it to create the chart and verify coverage.
2. Clinical history: reason for visit, medications, allergies, conditions and history. The clinician uses it to prepare for the visit.
3. Consents and acknowledgments: consent to treat, financial policy, receipt of the privacy notice, communication preferences.

Mixing them causes most intake problems. A registration form with 40 history questions gets abandoned on a phone. A history section written by the front desk asks the wrong questions. A photo release tucked into the consent pages is invalid under HIPAA's rule against compound authorizations.

Searchers use different names for the same document: "patient intake form template" (590 a month), "medical intake form" (320) and "new patient intake form" (210) (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).

The sections of a complete intake form

Use this as the master outline, then cut what your specialty doesn't need. The clinical history fields are placeholders: a licensed clinician at your practice must write or approve those questions.

1. Patient information

• Legal name, preferred name, date of birth
• Sex and gender fields in the format your EHR uses
• Address, mobile phone, email
• Preferred language; interpreter needed (yes/no)

2. Insurance and billing

• Primary insurance: plan name, member ID, group number, subscriber name and date of birth
• Secondary insurance, if any
• Responsible party for the bill, if not the patient

3. Emergency contact

• Name, relationship, phone

4. Reason for visit

• "What brings you in?" (free text)
• Referring provider and primary care provider

5. Health history (written or approved by your clinical lead)

• Current medications and dosages
• Allergies and reactions
• Conditions, surgeries and hospitalizations
• Specialty-specific questions

6. Communication preferences

• OK to call / text / email (check each); OK to leave a detailed voicemail (yes/no)

7. Consents and acknowledgments

• Consent to treat; financial policy; receipt of the Notice of Privacy Practices
• Signature, printed name, date; relationship to patient if signed by a parent or representative

Free patient intake form templates by practice type

Each guide below has a field-by-field template you can copy into your form builder or word processor, with notes on what to leave out. They are starting points to review with your clinical lead and your attorney, not finished legal documents.

• New patient form template: registration fields only, with insurance, responsible party, communication preferences and Canadian health card fields.
• Therapy intake form: client details, presenting concerns, informed and telehealth consent, minors and guardians, and psychotherapy-note and 42 CFR Part 2 notes.
• Dental intake form: dental history, the medical questions dentists ask, dental benefits and financial policy.
• Med spa intake form: treatment history and goals, screening set by the medical director, photo consent, and whether HIPAA applies.

Not every first contact needs full intake. For a prospective patient asking for a time, an appointment request form with name, contact details and a preferred time is enough; send intake after the appointment is booked.

Paper, PDF or online intake: the trade-offs

Fillable PDFs look modern but often create the worst of both: patients email them back, so PHI lands in an ordinary inbox. HHS has said providers may send patients unencrypted email if the patient has been warned of the risk and still prefers it (78 FR 5634 (opens in a new tab)), but that's about honoring a patient's request, not a design for routine intake.

For a feature-by-feature comparison of online options, see HIPAA compliant online intake.

HIPAA rules for collecting and storing intake data

Collect only what you'll use. HIPAA's minimum necessary standard requires "reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" when you use, disclose or request PHI (45 CFR 164.502(b) (opens in a new tab)). It doesn't apply to disclosures for treatment, but the principle is the right design rule for forms: every field you add is PHI you must protect. Our guide to the minimum necessary rule explains where it applies.

Protect electronic intake. The Security Rule's technical safeguards in 45 CFR 164.312 (opens in a new tab) include access control with unique user IDs, audit controls that "record and examine activity," integrity protections, and transmission security. Encryption is "addressable": under 45 CFR 164.306(d)(3) (opens in a new tab) you implement it if reasonable and appropriate, or document why not and use an equivalent alternative. For intake forms, encrypt.

Use vendors that sign a BAA. Any company that stores or transmits submissions for you, from the form builder to the email service that forwards them, is a business associate. See HIPAA compliant forms for what to require.

Honor communication requests. A provider "must accommodate reasonable requests" to receive communications "by alternative means or at alternative locations" (45 CFR 164.522(b) (opens in a new tab)). The communication-preference checkboxes on your form are how you capture that.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Consent, the privacy notice and signatures

Notice of Privacy Practices. A provider with a direct treatment relationship must give the notice "no later than the date of the first service delivery, including service delivered electronically," and, except in emergencies, "make a good faith effort to obtain a written acknowledgment of receipt." If you can't get it, you document your effort and "the reason why the acknowledgment was not obtained" (45 CFR 164.520(c)(2) (opens in a new tab)). You must also post the notice at your office and, if you have a website describing your services, "prominently post its notice on the web site." A checkbox plus signature on the intake form ("I received the Notice of Privacy Practices") is a common way to collect the acknowledgment.

Consent to treat and financial policy. These come from state law, your malpractice carrier and your own policies rather than HIPAA. Your attorney should approve the wording.

Authorizations stay separate. A HIPAA authorization, such as permission to use a photo in marketing, "may not be combined with any other document" except in limited cases (45 CFR 164.508(b)(3) (opens in a new tab)). Keep photo and testimonial releases out of the intake packet.

Electronic signatures. The federal E-SIGN Act says a signature "may not be denied legal effect, validity, or enforceability solely because it is in electronic form" (15 U.S.C. 7001 (opens in a new tab)) for transactions it covers. State law and payer rules may add conditions, so confirm with your attorney which documents you can sign electronically.

Moving intake online without creating new risks

1. Keep tracking off intake pages. No ad pixels, session recorders or analytics tags on form pages or their confirmation pages.
2. Check where submissions go. If a "secure form" emails each submission to the front desk's ordinary inbox, the weak point has just moved.
3. Sign BAAs with each vendor in the chain: form builder, hosting, any integration.
4. Limit access to the staff who process intake, each with their own login, so audit logs mean something.
5. Design for phones: large tap targets, autofill for name and address, one topic per screen, and save-and-resume for long forms.
6. Test it yourself with a fake patient before launch, including what the confirmation page and email say.

Where Medfy fits and where an intake tool fits

Medfy provides HIPAA-compliant website forms. Submissions, such as appointment requests and simple new-patient questionnaires, go to Medfy's access-controlled patient CRM and inbox. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice before any patient data flows.

Medfy does not offer e-signatures, insurance-card capture or full digital intake packets. If you need patients to sign consents, photograph insurance cards, or complete a multi-section packet that syncs to your EHR, use a dedicated intake tool that signs a BAA, alongside your website forms. Read how Medfy protects patient data, see Medfy pricing, or start with a free marketing audit, which checks your website and flags privacy risks such as pixels on patient forms.

Frequently asked questions

What should be on a patient intake form?

Patient details and contact information, insurance and the responsible party, an emergency contact, the reason for the visit, a medical history section your clinicians write (medications, allergies, conditions, surgeries), communication preferences, and the consents your practice uses, with a signature and date. Collect only what the first visit needs; anything else can wait until the patient is in the room.

Is there a free patient intake form template?

Yes. This page lists the sections every intake form needs, and the linked guides give field-by-field templates for new patient registration, therapy, dental and med spa intake that you can copy into your own form. Treat each as a starting point: your clinical lead writes or approves the health questions, and your attorney reviews the consent language before you use it.

Can patients fill out intake forms online under HIPAA?

Yes. HIPAA doesn't require paper. What matters is that the online form and wherever submissions are stored protect the data: encryption, access controls, audit logs, and a BAA with every vendor that receives or holds it. Keep advertising pixels and analytics tags off the form pages. Confirm your setup with your compliance officer or attorney before you switch.

How long should a new patient intake form be?

As short as the first visit allows. Registration, a focused history and the consents you actually use are enough for most first visits; specialty forms run longer. Cut any field nobody reads at the visit, move rarely needed sections into follow-up forms, and ask your clinical lead to justify each history question. Long forms are the ones patients abandon on their phones.

Do patients have to sign the Notice of Privacy Practices?

No. A provider must give new patients its Notice of Privacy Practices no later than the first visit and make a good-faith effort to get a written acknowledgment that they received it. If a patient won't sign, you document your effort and the reason the acknowledgment wasn't obtained. The acknowledgment confirms receipt; it isn't agreement. Confirm the details with your compliance officer.