Patient intake and HIPAA glossary

The HIPAA terms used on patient forms come from 45 CFR 160.103 and the Privacy and Security Rules in 45 CFR Part 164. These definitions cover patient intake terms.

Protected health information (PHI)

Protected health information (PHI) is individually identifiable health information that is transmitted or maintained in any form or medium. PHI includes demographic information under the definition in 45 CFR 160.103.

Covered entity

A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction. Billing an insurer electronically is one such transaction under 45 CFR 160.103.

Business associate

A business associate is a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity, as defined in 45 CFR 160.103. HHS examples include a cloud provider, an IT vendor, a CPA firm, an attorney and a medical transcription service.

Business associate agreement (BAA)

A business associate agreement (BAA) is the written contract in which a business associate gives a covered entity satisfactory assurance that it will safeguard PHI before handling it. 45 CFR 164.502(e) requires it before that work, and 45 CFR 164.504(e) sets its contents. See the business associate agreement guide.

Notice of privacy practices

A notice of privacy practices is the notice a provider with a direct treatment relationship gives the patient no later than the date of first service delivery. Except in an emergency, 45 CFR 164.520 requires a good-faith effort to obtain written acknowledgment of receipt, recorded with a privacy notice acknowledgment.

Authorization

An authorization is a patient's signed, written permission for a use or disclosure of PHI. Under 45 CFR 164.508, authorization has six core elements and three required statements, while a covered entity's own treatment, payment and health care operations do not need one. See the medical records release form.

Personal representative

A personal representative is a person treated as the individual under 45 CFR 164.502(g). For an adult, the personal representative has authority under applicable law to make health care decisions; for a minor, that person is generally a parent, guardian or other person acting in loco parentis. State law decides who has authority.

Minimum necessary

Minimum necessary is the standard in 45 CFR 164.502(b) under which a covered entity makes reasonable efforts to limit PHI to the minimum necessary for the purpose. The minimum necessary standard does not apply to disclosures to a health care provider for treatment.

Technical safeguards

Technical safeguards are the five Security Rule standards in 45 CFR 164.312: access control, audit controls, integrity, person or entity authentication, and transmission security.

No official HIPAA certification

There is no official HIPAA certification for software. A vendor's BAA is a contract, and your practice still decides how it sets up and uses the tool when using HIPAA-compliant forms.

These definitions are general information. Confirm how they apply to your practice with your own counsel or compliance lead.

The e-signature and consent terms below distinguish an electronic signature from the patient's agreement to a particular kind of care. Each definition follows the cited law or guidance where one is given.

Electronic signature (e-signature)

An electronic signature (e-signature) is an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign, as 15 USC 7006(5) defines it. See electronic signatures.

E-SIGN Act

The E-SIGN Act is the federal law at 15 USC 7001 under which a signature, contract or record may not be denied legal effect solely because it is electronic. Read about electronic signatures on patient forms.

UETA

UETA is the Uniform Electronic Transactions Act, enacted in 49 states, the District of Columbia, Puerto Rico and the US Virgin Islands. New York has its own law, the Electronic Signatures and Records Act (ESRA).

Consent to treat

Consent to treat is the patient's agreement to care, collected on the practice's own counsel-approved wording for the patient to review.

Telehealth consent

Telehealth consent is consent to care by video or phone. HHS says informed consent laws for telehealth vary by state in its telehealth guidance. See this telehealth consent form.

Good faith estimate

A good faith estimate is the written, itemized estimate of expected charges that a patient without insurance, or not using insurance for a service, is entitled to under this CMS guide. See the financial policy form.

The terms below describe the parts of intake forms, from individual questions to the signed record. They distinguish what the patient sees during completion from the record staff receive after submission.

Intake form

An intake form is a form a patient fills in before or at a visit, such as registration, health history or a consent.

Packet

A packet is several forms behind one link, and the patient signs each form in turn. Intake Pro packets provide that sequence.

Conditional question

A conditional question is a question that shows or hides based on an earlier answer. Intake Pro's form builder controls that display.

Matrix

A matrix is a grid of questions that share the same answers.

Repeating group

A repeating group is a set of fields the patient can repeat, for example one row per medication.

Handout

A handout is a document the patient reads inside a form, such as a privacy notice.

Kiosk

A kiosk is a tablet paired for check-in at the front desk. In Intake Pro, the kiosk keeps working offline, sends when the tablet reconnects, and clears the screen 60 seconds after a submission.

Form version

A form version is the exact wording of a form at the time it was published. In Intake Pro, a published version never changes; editing makes a new form version, and earlier submissions stay on the version they were signed on.

Signed PDF

A signed PDF is the completed form with its signatures, saved as a PDF that staff download and file under the practice's chart process. See signed records.

Audit trail

An audit trail is a record of what happened to a document and when. Intake Pro keeps an audit trail with each submission, alongside the form version, who signed, when and the signed PDF.

Screening scale and scoring terms describe how standard questions are organized and scored. They also distinguish a calculated result from the clinician's interpretation.

Screening scale

A screening scale is a set of standard questions with a scoring method, such as the PHQ-9. A screening result is not a diagnosis; the clinician decides what it means. See form template guides.

Item

An item is one question on a scale.

Reverse-scored item

A reverse-scored item is an item whose points run in the opposite direction from the others. Staff reverse those items when they set up scoring.

Subscale

A subscale is a group of items scored together within a larger scale.

Score band

A score band is a labelled range of total scores. Intake Pro's scoring feature supports labelled score bands.

Licence

A licence is the scale owner's terms for using or reproducing its wording. Some scales need permission or payment, so your practice confirms its licence with the owner before building one.