Plenty of practices have moved intake online. Fewer have checked that their digital forms meet HIPAA. Switching from paper to a PDF or a generic form builder doesn't make you compliant; it just moves where violations can happen.
The Technical Requirements
A platform handling protected health information needs all of these:
Encryption at rest and in transit. AES-256 for stored data, TLS 1.3 between the patient's browser and the server. If a vendor can't tell you exactly what they use, that's a red flag.
US-hosted infrastructure in facilities with physical security controls.
A Business Associate Agreement. Your form provider is a business associate. If they won't sign a BAA, stop there.
Audit logs. Every view, edit, and export recorded, so you can show who accessed what and when.
Access controls. Role-based permissions so staff only see what their job requires.
What Good Looks Like
Consent inside the form
Privacy notices, consent language, and e-signatures belong in the form itself, not in a separate step patients skip and staff forget.
Data minimization
The "minimum necessary" standard means collecting only the PHI you need. Conditional logic does this: no insurance, no insurance fields; a sore throat, no orthopedic history. It's better for patients and better for compliance.
Secure delivery
Emailing a PDF intake form leaves copies in inboxes. Magic links, unique and expiring URLs sent to the patient, get the right form to the right person without loose copies.
Paper Is a Liability
Paper forms get left on clipboards, misfiled, lost, or thrown in the regular trash. There's no audit trail, no backup, and no access control once they leave the front desk. Encrypted digital forms with logging and access controls are simply more secure than a folder in a cabinet.
Common Mistakes
Generic form builders. Google Forms, Typeform, and free tiers of form tools aren't HIPAA compliant by default. Some can be configured for it, many can't, and "we didn't know" isn't a defense.
No BAA on file. Strong security without a signed BAA still leaves you non-compliant.
Everyone sees everything. Giving every staff member access to every submission breaks the minimum necessary standard.
Ignoring mobile. If forms don't work on a phone, patients call in details or fill out paper at the office, both riskier.
No breach plan. Know who to notify and by when before anything happens.
Platform Checklist
- AES-256 at rest, TLS 1.3 in transit
- US-hosted storage
- Signed BAA
- Role-based access
- Audit logs
- E-signatures for consent
- Conditional logic for data minimization
- Mobile-friendly forms
- Secure delivery (magic links, not attachments)
Formisoft covers all of these, with every compliance feature included and a BAA for every practice.
Related: patient intake software | intake form templates | HIPAA compliance
Collect patient information on HIPAA-ready forms.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included