HIPAA compliant intake forms online come in two shapes: forms on your own website, and dedicated patient intake software. Both can be used safely, and neither is "HIPAA compliant" on its own; what matters is the BAA, the setup and who can see the data. Website forms handle requests and simple questionnaires well. E-signatures, insurance-card photos and EHR sync are where a dedicated tool earns its fee.
Online intake forms vs patient intake software
Searches split along the same line: "patient intake software" gets 210 searches a month at a $72.69 average click, "hipaa compliant intake forms" 170 at $47.29, and "online intake forms" and "digital intake forms" 140 each (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). Those click prices tell you vendors compete hard for this buyer.
| Item | Website forms (form builder or your site platform) | Dedicated patient intake software |
|---|---|---|
| Typical use | Appointment requests, contact forms, short new-patient questionnaires | Full pre-visit packets: registration, history, consents |
| Where patients find it | Your website | A link sent after booking, or a check-in tablet |
| E-signatures | Sometimes, depending on the tool | Usually central to the product |
| Insurance-card photos | Rare | Common |
| EHR or practice-management sync | Rare | The main selling point for many tools |
| Setup effort | Low | Moderate: forms, integration, staff training |
A good setup in either category looks the same from the patient's side: a form that loads fast on a phone, asks only what the visit needs, saves progress, and confirms what happens next. From the practice's side, submissions arrive in one access-controlled place, never in an ordinary inbox, and nothing on the page sends data to ad platforms.
Templates for the content itself are in our patient intake form templates.
What HIPAA requires of digital intake
HIPAA doesn't require paper, and it doesn't approve products. It requires your practice, and any vendor handling the data, to protect electronic PHI. The relevant pieces of the Security Rule:
- Risk analysis. "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic PHI (45 CFR 164.308(a)(1)(ii)(A) (opens in a new tab)). Add the intake tool to yours.
- Access control. Technical policies so only authorized people get in, with "a unique name and/or number for identifying and tracking user identity" (45 CFR 164.312(a) (opens in a new tab)). Shared front-desk logins defeat this.
- Audit controls. "Hardware, software, and/or procedural mechanisms that record and examine activity" (164.312(b) (opens in a new tab)), plus procedures to "regularly review records of information system activity" (164.308(a)(1)(ii)(D)).
- Transmission security and encryption. Encryption is an addressable specification: under 45 CFR 164.306(d)(3) (opens in a new tab), you implement it if reasonable and appropriate or document why not and use an equivalent. For patient forms on the open internet, encrypt in transit and at rest.
- Business associate assurances. You may let a vendor "create, receive, maintain, or transmit" electronic PHI for you only with "satisfactory assurances" (164.308(b)(1)), in practice a BAA.
One more rule shapes intake design: a HIPAA authorization, such as a photo release, "may not be combined with any other document" except in limited cases (45 CFR 164.508(b)(3) (opens in a new tab)). Build it as a separate form even inside an intake packet.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Features to compare: signatures, insurance cards, EHR integration
Use this checklist in demos. Ask the vendor to show each item, not describe it.
Forms and logic
- Conditional questions (skip pregnancy questions for patients who answer no, show pediatric sections for minors)
- Save and resume, so a patient can finish later
- Separate forms for registration, history and each consent
Signatures
- E-signature with a record of who signed and when
- Signed copy delivered to the patient
- Parent or guardian signing for a minor, with relationship captured
Insurance
- Front and back card photos
- Whether card data is read automatically or keyed by staff
Integration
- Named EHR or practice-management integrations, and what lands where: discrete fields or a PDF attachment
- What happens to the data if the integration fails
- Export of all your data in a usable format if you leave
Security and access
- Individual logins, role-based permissions and an audit log you can read
- Automatic logoff on shared front-desk screens
- No third-party advertising or analytics tags on patient-facing form pages
BAAs, data storage and access control
Get the BAA for the plan you'll buy. Whether a vendor signs a BAA can depend on the plan, so the plan matters as much as the product. Before you trust a free tier or a starter plan, read the vendor's BAA page; our guides to HIPAA form builders compared and is Jotform HIPAA compliant show how to read those terms. The general requirements for any form are in HIPAA compliant forms.
Ask where the data lives. Which country and cloud region, how long submissions are kept, and whether you can set a retention period.
Follow the notification trail. Form tools can often email a copy of each submission to the practice. If that email contains the answers, PHI has left the protected system. Turn on "notification only" emails that link back to the secure inbox.
Control access by role. The front desk needs registration; clinicians need history; the marketing contractor needs nothing. Review who has access each quarter and remove departed staff the day they leave.
Red flags in a demo or contract:
- The BAA is "available on request" but no one can send it before you pay
- Only a shared login on the plan you're quoting
- Submissions delivered as full-text email
- No data export, or export only as PDFs
- Marketing or analytics scripts loading on the patient-facing form
Patient experience: phones, accessibility and languages
Expect many patients to open your link on a phone, so test on one. Large tap targets, a numeric keypad for phone and date fields, address autofill, and one topic per screen make the difference between a finished form and an abandoned one.
Accessibility matters for patients using screen readers, magnification or keyboard navigation. Labels tied to each field, error messages that say what to fix, and enough color contrast are the basics; our guide to accessible online forms covers the checks.
Offer the languages your patients speak. A translated form with an untranslated consent section, or the reverse, causes more confusion than a single-language form. Keep a paper or tablet option at the front desk for patients who can't or won't complete forms online.
Costs and what drives them
Pricing in this category varies widely and changes often, so compare quotes on the same assumptions. The main cost drivers:
- Per-provider or per-location pricing. Pricing by provider or location scales with practice size.
- Integrations. EHR connections may be priced as add-ons or require a higher plan.
- E-signature and submission volume. Some plans cap signed documents or submissions per month.
- HIPAA tier. The BAA may only come with a premium plan.
- Setup and form building. Some vendors charge to build your forms; others leave it to you.
- Staff time. The hidden cost of any tool that doesn't integrate is re-keying data into your EHR.
Ask every vendor for the total annual cost for your provider count, with the integration and BAA included, in writing.
When website forms are enough and when they aren't
Website forms are enough when you need appointment requests, contact forms, and a short new-patient questionnaire, and your team schedules and completes registration by phone or at check-in.
Add a dedicated intake tool when you need patients to sign consents before arrival, you bill insurance and want card images up front, or re-keying intake into your EHR is costing front-desk hours.
Many practices end up with both: website forms to capture new-patient requests, and an intake tool for the packet sent after booking.
Where Medfy fits. Medfy provides HIPAA-compliant website forms. Submissions go to Medfy's access-controlled patient CRM and inbox, patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice. Medfy does not offer e-signatures, insurance-card capture or full digital intake packets. For those, use a dedicated intake tool that signs a BAA. See Medfy pricing for what the website plan includes, read how Medfy handles patient data, or run a free marketing audit to check how your current site's forms and tags handle patient data.
Frequently asked questions
Are online intake forms HIPAA compliant?
They can be. HIPAA doesn't certify forms; it sets rules for how your practice and its vendors handle the data. An online intake setup is on solid ground when every vendor that stores or transmits submissions signs a BAA, data is encrypted, each staff member has their own login, access is logged, and no advertising or analytics tags run on the form pages. Confirm your setup with your compliance officer.
What should a small practice look for in patient intake software?
A signed BAA on the plan you'll actually buy, mobile-friendly forms patients can finish without an app, e-signatures for your consents, insurance-card capture if you bill insurance, and a working connection to your EHR or practice management system. Then check access controls, audit logs, data location and export. Ask for a trial with your own forms before signing a long contract.
Can online intake forms connect to my EHR?
Some can. Dedicated intake tools often integrate with specific EHRs, either writing data into discrete fields or attaching a PDF to the chart; generic form builders and website forms usually don't. Ask each vendor for a list of supported EHRs, what data actually lands where, and whether the integration costs extra. Test it with a sample patient before you roll it out to the front desk.