Digital intake solves a real problem. Clipboards in waiting rooms, forms completed in a hurry, handwriting nobody can read, and the same demographic details typed into your system by hand every time.
But intake forms are PHI from the first keystroke, often before anyone becomes a patient. That changes which tools you can use, and the rule that governs it isn’t about the signature — it’s about the contract you need with your vendor before any PHI touches their servers.
Key takeaways
Any vendor handling PHI is a business associate and must sign a BAA. No BAA, no PHI. This is a hard gate.
Free and entry tiers frequently exclude BAAs. Check before you start, not after.
Not every therapist is a HIPAA covered entity — but state law and your ethics code still apply.
Psychotherapy notes have separate rules and must be kept apart from the rest of the record.
Substance use treatment records fall under 42 CFR Part 2, which is stricter than HIPAA.
Intake consent and the Notice of Privacy Practices acknowledgment are different documents doing different jobs.
Start here: the BAA
A vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. You need a signed BAA before sending them anything.
Three things practices get wrong:
Assuming a “HIPAA compliant” badge is enough. There’s no HIPAA certification scheme. A vendor can describe its controls, but compliance is a property of your arrangement with them — and that arrangement is the BAA.
Not checking the plan. Many platforms offer BAAs only on higher tiers. A solo practitioner on an entry plan may be using a product the vendor never agreed to handle PHI on.
Forgetting the vendor’s own vendors. Your business associate’s subprocessors handle your PHI too. Ask for the list and review where data is stored and processed.
Ask every vendor directly: Will you sign a BAA, on which plan, and can I see your subprocessor list? If the answer to the first is no, the evaluation stops there regardless of how good the product is.
Are you even a covered entity?
Worth establishing, because the answer surprises people.
HIPAA applies to healthcare providers who transmit health information electronically in connection with a covered transaction — generally electronic billing, eligibility checks and similar. A clinic billing insurance electronically is squarely covered.
A therapist in private practice who takes only private payment and never submits electronic claims may not be a covered entity under HIPAA at all.
That is not permission to relax. If HIPAA doesn’t apply:
State law still does, and some states are considerably stricter than HIPAA on mental health records. State medical privacy statutes aren’t preempted where they’re more protective.
Your professional ethics code still does. The APA, ACA and NASW codes all impose confidentiality obligations independent of federal law.
Your malpractice carrier may have requirements, and your clients certainly have expectations.
Most practices in this position should operate to HIPAA standards anyway. It’s the recognised benchmark and the question of covered status can change the moment you start billing a payer. [LEGAL REVIEW]
What the Security Rule requires now
The current Security Rule divides implementation specifications into “required” and “addressable.” Addressable does not mean optional — it means you implement it, or document why it isn’t reasonable and implement an equivalent alternative. Practices that read it as optional and skipped encryption have been a persistent enforcement theme.
Change is coming, but isn’t here. HHS published a Notice of Proposed Rulemaking on January 6, 2025 — the first material overhaul of the Security Rule since 2013 — which would eliminate the “addressable” category entirely. As of October 2026 the proposal has not been finalized, with final action now projected for July 2027, and the current Security Rule remains in effect in the meantime. The Proposed HIPAA Security Rule Update: What It Would Change and How to Prepare +2
If finalized as proposed, encryption of ePHI at rest and in transit and multi-factor authentication for systems accessing ePHI would become mandatory, with roughly 240 days from publication to full compliance — 60 days to effective date, then 180 days for most provisions. medcuritycompyl
Practical reading: encryption and MFA are near-certain to become mandatory and take longer to implement than the compliance window allows. Choose a platform that does both now. You’re not getting ahead of a rule so much as avoiding a rushed migration later. [VERIFY — check current status before publishing; this is moving]
Which forms to digitize first
Intake and demographics. Highest volume, clearest win, and the data flows into your practice management system rather than being retyped.
Notice of Privacy Practices acknowledgment. Covered entities must make a good faith effort to obtain written acknowledgment that the patient received the NPP. This is an acknowledgment of receipt — not consent to treatment, and not an authorization to disclose. Three different documents.
Informed consent for treatment. Content requirements vary by state and discipline. Have yours reviewed rather than adapting a generic template.
Telehealth consent. Many states require specific telehealth consent with particular disclosures, and requirements differ from in-person consent. Check your state board. [LEGAL REVIEW]
Financial responsibility and no-show policy. Not PHI-heavy, straightforward to digitize.
Release of information authorizations. These have specific HIPAA content requirements — description of information, recipient, purpose, expiration, revocation rights and signature. A generic form won’t meet them.
A service agreement template can structure a practice-policy document, but clinical consent forms should come from your professional body or counsel, not a general library. Forms and fields that get signed covers construction, and signature field placement matters because most patients complete intake on a phone.
Four areas with special rules
Psychotherapy notes. HIPAA treats these differently from the rest of the record. They’re the practitioner’s private process notes, must be kept separate from the medical record, and disclosure generally requires a specific authorization that cannot be combined with other authorizations. A general release of information does not cover them. If your digital system stores them alongside intake forms, you’ve merged two things HIPAA requires you to keep apart.
Substance use treatment. Programs covered by 42 CFR Part 2 operate under rules stricter than HIPAA, with tighter consent requirements for disclosure. Alignment with HIPAA has increased, but differences remain. If this applies to you, it drives your whole design. [LEGAL REVIEW]
Minors. Genuinely complicated. Parents are usually the personal representative, but many states let minors consent independently to mental health, reproductive or substance use care — and where a minor consents alone, parental access to those records may be restricted. A single parent-signed intake form may be wrong for some of what follows. Map this for your state and your service lines before building the workflow. [LEGAL REVIEW]
Interpreters and accessibility. Digital forms must remain accessible to patients with disabilities and available in languages your population needs. An English-only mobile form can create an access problem a paper process didn’t have.
Delivery and access
Don’t email PHI as an ordinary attachment. Transport encryption between major providers is common now but isn’t guaranteed, and email isn’t encrypted at rest in either mailbox. Where you must send something, use encrypted attachments with the password through a separate channel.
One nuance worth knowing: HHS guidance permits sending PHI to a patient by unencrypted email where they have requested it and been warned of the risks. That’s a patient-right-of-access provision, not a general licence. Document the warning and the request. [LEGAL REVIEW]
A signing link is the better pattern, because the document stays on the platform with access controls and an audit trail rather than sitting in two mailboxes indefinitely.
MFA on every staff account, without exception. Healthcare is a priority target, and a compromised clinical account exposes everything.
Minimum necessary. Front desk staff rarely need clinical intake content. Role-based access isn’t a nice-to-have.
Train on phishing. Fake signature requests are a standing attack pattern, and clinics are targeted specifically — see how to spot fake signature requests and phishing protection basics. Tell patients what a genuine request from you looks like, so an impersonation stands out.
Review any platform’s stated controls: security, trust and the subprocessor list.
Evaluating a platform
In priority order:
BAA, on your plan. Gate. Nothing else matters without it.
Encryption at rest and in transit, with MFA available.
Audit trails recording who accessed what and when — needed for both HIPAA and your own incident response. How audit trails work.
Role-based access supporting minimum necessary.
Practice management or EHR integration. If intake data doesn’t flow in automatically, you’ve moved the typing rather than removed it. Check integrations against what you actually run.
Mobile completion quality. Patients abandon difficult forms.
Export and retention controls matching your state’s record retention period.
Breach notification commitments in the BAA — how fast you’re told, and what you’re told.
How to choose an e-signature tool covers general evaluation. Note that free tiers usually exclude BAAs, which rules them out for PHI however well they’d otherwise fit a solo practice.
Retention
Record retention periods for clinical records are set by state law and professional requirements, and typically run longer than general business records — often several years beyond the last date of service, and for minors frequently extending past the age of majority.
Set retention at the point of signing rather than reconstructing it later, and confirm your platform exports in a portable format before you commit. How long to keep signed documents covers the framework, though clinical periods are governed separately. [LEGAL REVIEW]
Common mistakes
Using a platform without a BAA, or on a plan that excludes one.
Treating “HIPAA compliant” marketing as sufficient. No such certification exists.
Reading “addressable” as optional.
Storing psychotherapy notes with general intake.
One parental consent form across service lines where minors may consent independently.
Emailing intake PDFs rather than using a controlled link.
Over-long mobile forms. Patients abandon them and you’re back to paper.
No subprocessor review.
FAQ
Are e-signatures HIPAA compliant?
Electronic signatures are valid under ESIGN and state law. HIPAA compliance depends on the surrounding arrangement — a signed BAA, encryption, access controls and audit trails — not on the signature itself.
Do I need a BAA with my e-signature vendor?
Yes, if they handle PHI. Confirm it’s available on your plan before sending anything.
Is a therapist always a covered entity?
No. HIPAA applies to providers transmitting health information electronically for covered transactions. A private-pay practice that never bills electronically may fall outside it — but state law and ethics codes still apply.
Can patients sign intake forms on a phone?
Yes, and most will. Keep forms short and test the mobile experience, since abandonment is the main failure mode.
Do psychotherapy notes work differently?
Yes. They must be kept separate from the medical record, and disclosure generally requires a specific authorization that can’t be combined with others. A general release doesn’t cover them.
Can I email a patient their forms?
HHS guidance permits unencrypted email to a patient who has requested it after being warned of the risks. Document both. A signing link is usually the better route.
What about substance use treatment records?
42 CFR Part 2 applies to covered programs and is stricter than HIPAA on disclosure consent. It drives the design if it applies to you.
Is encryption mandatory?
Under the current Security Rule it’s addressable — implement it or document an equivalent alternative. The proposed update would make it required, but as of late 2026 that rule isn’t final.
