HIPAA Compliant
Online Forms

HIPAA compliance for a patient form is a combination of three things: (1) the form’s content — required disclosures like the Notice of Privacy Practices acknowledgment, valid HIPAA authorization elements under 45 CFR 164.508 (description of information, recipient, expiration, signature, right to revoke); (2) how PHI is transmitted and stored — encryption in transit and at rest, access controls, audit logging; and (3) the contractual relationship with your software vendor — if the vendor handles PHI on your behalf, a Business Associate Agreement (BAA) is required. A “HIPAA template” alone is necessary but not sufficient; the operational safeguards have to be in place too.

HIPAA does not specifically prohibit electronic signatures, and the HHS Office for Civil Rights treats them as acceptable when paired with appropriate safeguards. Under the ESIGN Act and UETA, e-signatures carry the same legal weight as a wet signature when the signer’s identity is reasonably authenticated, the signing intent is captured, and an audit trail (timestamp, IP address, signer-displayed terms) is preserved. Formfy e-signatures include all of these elements. For HIPAA authorizations specifically, the form must still meet the content requirements of 45 CFR 164.508.

If you are a HIPAA Covered Entity (most healthcare providers, health plans, and clearinghouses) and your form software stores, transmits, or processes Protected Health Information on your behalf, then yes — HIPAA requires you to have a signed Business Associate Agreement with that vendor before sending PHI through it. The BAA defines permitted uses of PHI, safeguard requirements, breach notification obligations, and termination conditions. Talk to our team about your specific use case and BAA requirements before sending any PHI through Formfy.

Yes — med spa and aesthetic-practice waivers are one of the most common use cases on Formfy. Describe the treatment to the AI Copilot — for example “A liability waiver and informed consent for injectables (Botox, Dysport, dermal fillers) covering risks, bruising and asymmetry disclosure, photography release, and post-care instructions” — and it generates the full form with the right risk disclosures, photography release, post-care acknowledgment, pre-treatment health screening, and a HIPAA NPP acknowledgment when PHI is collected. Same workflow supports laser hair removal, chemical peels, microneedling, body contouring, IPL, PMU, and tattoo releases. Send by SMS or email so the patient signs before they sit in the chair.

Any form that collects Protected Health Information needs HIPAA-aligned handling. The most common ones include: new-patient intake forms (demographics + medical history), Notice of Privacy Practices acknowledgments, HIPAA Authorization for Release of PHI, telemedicine informed consent, pre-procedure / surgical consent, behavioral-health intake, medical records requests, and authorization for marketing communications. Practice-management forms like financial responsibility and no-show policies don’t require an authorization, but if they collect PHI alongside, the same safeguards apply.

A valid HIPAA authorization under 45 CFR 164.508 must include six core elements: (1) a specific description of the PHI to be released, (2) the name of the person/organization authorized to disclose it, (3) the name of the recipient, (4) the purpose of the disclosure, (5) an expiration date or event, and (6) the patient’s signature and date. It must also notify the patient of the right to revoke, the inability to condition treatment on signing (with limited exceptions), and the potential for re-disclosure. Describe the use case to Formfy’s AI Copilot — for example “Authorization to release my orthopedic records to Dr. Patel for a second opinion” — and it generates the complete form with all six required elements.

They are distinct documents. Informed consent is the patient’s agreement to receive a specific treatment or procedure after being told about the risks, benefits, and alternatives — it’s a clinical and ethical obligation. HIPAA Authorization is a separate document that gives a covered entity permission to use or disclose PHI for purposes not covered by the standard treatment, payment, and operations exceptions (TPO). For example: sending records to a personal-injury attorney, releasing records to a school, or using PHI in a marketing campaign. Many practices combine them in an intake packet, but they should be separately worded and separately signed.

Sending PHI directly inside an SMS body is not generally HIPAA-aligned because standard SMS is not encrypted in transit and is stored on the carrier. The HHS-recommended pattern is to send a secure link by SMS that, when opened, takes the patient through an authenticated browser session where the PHI is rendered over TLS. Formfy uses this exact pattern: the SMS contains a one-time link to your patient form, the patient opens it in HTTPS, and PHI never travels in the SMS body itself. You can additionally require an identity check (date of birth or last four of SSN) on the landing page.

HIPAA itself requires covered entities to retain documentation related to the Privacy Rule (including signed Notice of Privacy Practices acknowledgments and HIPAA authorizations) for a minimum of six years from the date of creation or the date the document was last in effect, whichever is later. State medical-records retention laws are often longer (e.g., 7–10 years for adults; until age 21 plus several years for pediatrics) — the controlling rule is whichever is more stringent. Formfy stores every signed submission digitally with a tamper-evident audit trail so you can produce the record on demand.

Yes. Upload your existing PDF intake packet, scanned forms, or Word docs to Formfy. The AI reads every page, extracts the questions and signature blocks, and rebuilds them as a fillable digital workflow with e-signature support. The original structure and clinical fields are preserved — you don’t have to re-type a single question. From there, you can plug in the HIPAA acknowledgments and authorization elements you want to add, and reuse the converted form for every new patient.

Describe the form you need in a sentence or two. For example: “Create a new-patient intake form for a pediatric dental practice with medical history, allergies, parent/guardian consent, and a Notice of Privacy Practices acknowledgment.” The AI Copilot generates a complete form — structured fields, the right HIPAA acknowledgment language, multi-signer flow for the parent/guardian, and an e-signature block — in under 30 seconds. Edit any section before publishing or sending to your patient.