HIPAA-Friendly Form Options for Health and Wellness Businesses

A form that asks for a diagnosis and a name can hold health information the law protects. A polished intake page does not decide that question. HIPAA form options start with whether your business is a covered entity and whether the vendor will sign a written agreement before it stores that information.

This guide is general education. It is not legal advice. HHS says its Security Rule summary is not a full compliance guide. If the summary and the rule conflict, the rule governs.

Decide whether HIPAA applies to you

HHS says covered entities are health plans and health care clearinghouses and health care providers that transmit health information in electronic form in connection with a transaction HHS has standardized. Those transactions include claims and benefit eligibility inquiries and referral authorization requests. Email by itself does not make a provider a covered entity. The transmission has to be tied to a standard transaction. A provider that uses a billing service for that transmission is a covered entity. HHS points to a CMS decision tool for the covered-entity test.

A business associate is a person or organization outside the covered entity’s workforce that performs certain functions or services involving health information that identifies a person. HHS lists claims processing and billing and legal and accounting and consulting and management services when those services use or disclose that information. A vendor whose work does not use or disclose that information is not a business associate. HHS says incidental access does not by itself create that role. Business associates are liable on their own for some HIPAA duties. HHS says if you are not a covered entity and not a business associate, the HIPAA Rules do not apply to you.

A group health plan with fewer than 50 participants that the employer administers on its own is not a covered entity. That exception is narrow. It is not a pass for a clinic.

SimplePractice’s intake guide for therapists says all therapists must follow HIPAA. HHS does not use that test. Use the covered-entity test and the CMS tool. State board rules and payer contracts can add duties this article does not list.

Know what the form is holding

HHS calls protected health information the identifiable health information a covered entity or a business associate holds or transmits in any form. Electronic or paper or spoken. It relates to past or present or future physical or mental health. It relates to care. It relates to payment for care. It identifies the person or there is a basis to believe it can identify the person. HHS gives name and address and birth date and Social Security number as common identifiers.

A protected health information form is that combination. A symptom with no name is a different record from a symptom tied to an email. Employment records a covered entity keeps in its role as an employer are outside this definition. So are certain education records.

The Security Rule covers a subset. HHS calls it electronic protected health information. That is PHI maintained in or transmitted by electronic media. The Security Rule does not cover PHI that stays on paper or is spoken. The Privacy Rule and the Breach Notification Rule do cover those forms. A paper clipboard and a web form are not the same rule. Both can hold PHI.

HHS says there is no limit on the use of de-identified health information. One path is a formal finding by a qualified statistician. The other removes specified identifiers of the person and of relatives and of household members and of employers. That second path counts when the covered entity does not know the leftover information could identify the person.

A covered entity may not use or disclose PHI except as the Privacy Rule permits or requires, or as the person authorizes in writing. HHS names two situations where disclosure is required. The person asks for access or for an accounting of disclosures. HHS asks for the information in a compliance review. Other uses are permitted and not required. Treatment and payment and health care operations are on that permitted list. Most uses of psychotherapy notes for those purposes need an authorization. A written consent for treatment and payment and operations is optional. The covered entity that wants consent chooses the wording.

Minimum necessary is a Privacy Rule limit. HHS says the covered entity must limit the use and the disclosure and the request to the amount needed for the purpose. It may not pull an entire medical record for a narrow purpose unless it can justify the whole record.

Choose what the form asks

Healthcare form best practices from HHS start with that limit. Ask for what the visit needs. Leave the rest off the form.

SimplePractice’s intake guide is written for therapists. It lists a name and date of birth and contact information and an emergency contact. It lists the reason for seeking therapy. A longer version can cover treatment history and medications and substance use and living situation and other providers. It lists insurance card images and an informed-consent document and a privacy notice and a Good Faith Estimate of fees and a financial agreement and a telehealth consent when telehealth is used. It lists mandated disclosures about harm or abuse or neglect. It lists a risk screen for recent suicidal ideation so the clinician can judge level of care and scope. That screen belongs in a practice that can respond to it. It does not belong on a gym waiver because the blog included it.

SimplePractice’s default Notice of Privacy Practices says the practice must keep PHI private and must give the notice and must follow the notice then in effect. The notice can change. The new notice is available on request and in the office and on the website. Use a notice your lawyer matches to your practice. Do not treat a software template as your finished legal notice.

Practice Better’s 2026 nutrition guide is written for nutritionists and dietitians and health coaches. It suggests diagnoses and medications and supplements and a history of disordered eating and digestive conditions and food allergies. It suggests meals and food access and budget and goals in the client’s words. It suggests sleep and stress and activity and hydration. It suggests a place to upload lab results. It suggests consent for telehealth and a cancellation policy and a scope-of-practice disclosure. It says to skip a medication block when the client reports no medications. It says a 40-question form before the first session is one many clients do not finish. It says a reminder 24 to 48 hours before the visit is tied to higher completion. It does not publish the rate.

Those two lists are wellness business forms and medical intake form examples from clinical businesses. A yoga studio that is not a covered entity can collect an emergency contact and a class preference. It should not collect a diagnosis unless it has a reason and a place to protect it. If you are a covered entity, the minimum-necessary rule is the edit.

Put PHI in a system that will sign

HIPAA compliant forms is a phrase vendors use about their own products. It is not a finding from HHS about your setup. HHS says a covered entity may let a business associate create or receive or maintain or transmit electronic PHI when the covered entity gets satisfactory assurances in writing. That writing is a business associate agreement. It must say the associate will follow the Security Rule. It must require subcontractors who handle electronic PHI to sign their own agreement. It must require the associate to report security incidents it learns about, including breaches of unsecured PHI under the Breach Notification Rule.

The Privacy Rule side of the agreement must describe permitted uses. The associate may not use or further disclose PHI except as the agreement or the law permits. The agreement may not authorize a use that would violate the Privacy Rule if the covered entity did it, aside from narrow exceptions HHS describes for the associate’s own management and for data aggregation tied to health care operations. If you know of a pattern that is a material breach of the agreement, HHS says you take reasonable steps to cure it or end it. If that fails, you terminate the agreement when that is feasible. A business associate must have an agreement with its subcontractor before it discloses PHI for work done for the covered entity.

Practice Better’s nutrition article says intake that ties a health condition to an identifiable person is PHI and falls under HIPAA. That claim is broader than the covered-entity test on the HHS page. Use HHS to decide whether the Rules apply. If they do, use Practice Better’s warning about the tool. It says generic form tools such as Google Forms and Typeform and most survey builders are not HIPAA compliant. It says they do not sign business associate agreements and do not provide the encryption and access controls it says HIPAA requires. That is Practice Better’s claim about those named tools. HHS’s Security Rule summary does not publish a banned-product list. It says the rule does not dictate the specific security measure. Confirm the agreement with the vendor you use.

SimplePractice says it is HIPAA compliant and HITRUST certified. It says it encrypts account information in transit and encrypts passwords and houses servers in a facility with proximity readers and biometric scanners and round-the-clock staff. It says it tests for vulnerabilities and that HITRUST includes controls from HIPAA and PCI and NIST CSF and ISO 27001 and ISO 27002. Those are SimplePractice’s statements about SimplePractice. If you cancel, it says it will no longer keep identifiable data from that account and that PHI is de-identified under the Safe Harbor method. Its terms state a retention of no more than 64 days after termination, and it says that policy is being updated. Export the record before you cancel. SimplePractice says the covered entity remains responsible for retention and for the security of any export.

Practice Better says it signs business associate agreements on request. It says its platform is HIPAA compliant. That claim covers forms and the portal and messaging and billing. Its security article says data is encrypted in transit and at rest and that backups and logs are encrypted. It says access defaults to no access unless someone changes that. It says servers sit with an SSAE 18 provider and that data is stored on encrypted drives in the United States. It names AES-256 and TLS 1.2. It says customer data is backed up every 24 hours. Snapshots from each day are purged within 30 days. Monthly snapshots are purged within 12 months. It says a session that sits idle asks for the password again and that the password is not kept in the browser cache. Treat those as Practice Better’s description of its own controls.

A health form builder inside the system where the chart lives avoids a second copy in a tool with no agreement. Compliant health forms for a covered entity sit behind that agreement. Practice Better says completed forms should land in the client record with notes and labs and billing. SimplePractice sends intake and consent documents through the client portal after you add an email.

Set the safeguards HHS names

HIPAA form security is the Security Rule’s job once the data is electronic PHI. HHS says regulated entities must keep electronic PHI confidential and intact and available. Confidential means it is not disclosed to an unauthorized person or process. Intact means it is not altered or destroyed without authority. Available means an authorized person can use it on demand.

The rule is built to scale. HHS says it covers a very small provider and a large multi-state health plan. You weigh your size and complexity and capabilities. You weigh your hardware and software. You weigh the cost of the measure. You weigh the chance of a risk and how serious it is. You review the measures and update the written record when the risk changes.

HHS sorts safeguards into three groups.

• Administrative. Do a risk analysis. Name a security official. Limit workforce access to people who need it. Train the workforce. Sanction people who break the policy. Have a way to spot and respond to an incident and to write down the outcome. Back up electronic PHI. Plan how you restore it and how you protect it in an emergency. Evaluate the program when you add technology.
• Physical. Limit who can walk up to the systems. Set rules for workstations that can open electronic PHI. Control devices and media that hold it, including how you wipe media before reuse.
• Technical. Let authorized people in. Record and examine activity in systems that use electronic PHI. Confirm the data has not been altered or destroyed without authority. Verify that the person is who they claim to be. Guard electronic PHI while it moves across a network.

Some implementation specs are required. Some are addressable. HHS says addressable does not mean optional. If the addressable spec fits, you implement it. If it does not, you adopt another measure that meets the standard and you document why the addressable spec did not fit.

Written policies and the records of required activities stay on file until six years after the date of creation or the date the document was last in effect, whichever falls farther out. The people who carry out the procedures need access to that documentation.

Patient intake form security on your own devices is the part the vendor does not do for you. CISA tells small businesses to require multi-factor authentication through a technical control, not a reminder. Turn it on for every administrator account. CISA cites a Microsoft report that around half of Azure Active Directory global administrators use multi-factor authentication. Give each person a unique account. Do not share passwords. End access when someone leaves. If the role changes, end the old access before you issue the new credentials. Give an administrator a second account for ordinary email and browsing. Encrypt laptops that hold sensitive data. CISA says to encrypt hard drives and removable media and backups. Keep an offline encrypted backup and test the restore. Patch systems. HHS’s contingency standard is the backup and the restore and the emergency mode. CISA’s test is how you learn the restore works.

HHS describes the Breach Notification Rule in the Security Rule summary. Covered entities notify the person and HHS when information is acquired or accessed or used or disclosed in a way the Privacy Rule does not permit. In some cases they notify the media.

A setup you can check this week

1. Run the CMS covered-entity tool HHS links from the Security Rule summary. Write down the result.
2. List every field on the intake. Mark which fields identify a person and which describe health or payment or care.
3. If you are a covered entity and the form holds PHI, keep it in a system that will sign a business associate agreement. Read the agreement. Confirm subcontractors are covered and that incidents get reported to you.
4. Cut fields that the visit does not need. If you are covered, that cut is the minimum-necessary rule.
5. If you are a therapist, use a privacy notice and a consent your licensing board and your lawyer accept. Add a risk screen when you can act on the answer.
6. Turn on multi-factor authentication for the accounts that open the chart. Remove access for anyone who has left.
7. Export a test record and confirm you can read it. HHS wants availability. SimplePractice says you should export before you close an account.
8. File the risk analysis and the agreement and the training notes. Keep them for the six-year documentation period HHS describes.

A class schedule or a newsletter signup that does not tie a health condition to a named person can be collected with Jotform. A diagnosis or a medication list is a different form. Get the business associate agreement before that data sits with a vendor.

Pitfalls

You assume a wellness brand makes you a covered entity. HHS uses the transaction test. A coach who does not send a standard transaction may be outside the Rules. A clinic that sends electronic bills is inside them.

You assume a wellness brand keeps you outside the Rules. The same test can put a small practice inside. Use the CMS tool.

You trust a HIPAA badge and skip the agreement. HHS requires the written assurances before the vendor handles electronic PHI.

You paste a therapist’s suicide screen onto a workshop form. SimplePractice wrote that screen for clinicians who must judge scope and level of care.

You collect the whole history because the software allows it. HHS limits covered entities to the amount needed for the purpose.

You leave PHI in a tool Practice Better names as noncompliant. Practice Better says Google Forms and Typeform and most survey builders do not sign these agreements. Confirm the vendor in front of you. Do not guess from a slogan.

You cancel the EHR and lose the chart. SimplePractice says identifiable data does not stay after cancellation and points to a 64-day term it is updating. Export first. You keep the retention duty.

You share one login. CISA says each person gets a unique account. HHS wants you to know who touched electronic PHI.

You skip the addressable spec and write nothing down. HHS says you either implement it or document the alternative.

You encrypt the vendor and leave the laptop open. CISA says to encrypt the laptop and the backup. HHS’s availability rule fails if you cannot restore.

Trade-offs

A short wellness form versus a clinical intake. Practice Better says a 40-question form is one many people do not finish. SimplePractice’s therapist list is long because treatment and payment and risk need a record. Cut to the visit. Add a screen when you are the clinician who will use it.

A portal versus a link in email. Practice Better lets a client finish in the portal or from an email link, and it says the answer saves to the client record either way. A link is easier for a person with no password. A portal lets you limit what that person can see. Practice Better says you set those permissions.

One clinical system versus a separate form tool. Practice Better says health data should stay in the practice system. A second tool means a second agreement and a second copy. The separate tool is a fit for a form that is not PHI.

Vendor controls versus your own accounts. SimplePractice and Practice Better describe encryption and access limits on their side. CISA and HHS put unique accounts and backups and workforce training on you. A strong vendor does not replace the security official HHS tells you to name.

Paper versus electronic. Paper PHI stays under the Privacy Rule. Electronic PHI adds the Security Rule. A scan of a signed consent becomes electronic. The handling risk Practice Better describes for printed forms is the stack that gets lost. The electronic risk is the account that gets shared.

What you do next

Write one sentence that says whether you are a covered entity and why. Then open the intake and delete every health field you cannot tie to that visit. If any field remains that identifies a person and describes health, confirm the business associate agreement before the next client submits.

If the form is a schedule or a general inquiry and it does not hold PHI, Jotform can hold it. The covered-entity test and the agreement are the steps that protect the health details.