HIPAA compliant online forms and e-signatures

An online form is HIPAA compliant when the vendor storing answers signs a BAA with the practice, the tool has safeguards the Security Rule asks for, and the practice uses the form under its own policies. All three parts concern the same patient-data workflow.

This page gives general information. Confirm your practice's legal and compliance obligations with its own counsel or compliance lead.

Intake Pro handles patient forms with a BAA, staff identity controls, scoped access and retained signature evidence. The controls below describe product behavior; your practice remains responsible for its own HIPAA policies and use.

• Intake Pro signs a business associate agreement before your practice collects real patient data.
• Staff sign in with multi-factor authentication.
• Staff sessions end after 12 hours.
• Roles can be customized for your practice's staff assignments.
• Every read is scoped to the practice and logged.
• Files are encrypted at rest, and connections use HTTPS.
• A published form version is immutable, so later edits do not change earlier signed submissions.
• Each signed record keeps its form version, signer, signing time, signed PDF and audit trail.
• The kiosk screen clears 60 seconds after a submission, and kiosk forms work offline before sending when the tablet reconnects.

Review security and HIPAA at Intake Pro and the evidence retained in signed records and exports.

There is no official HIPAA certification for form software. HHS does not certify or endorse products, so a practice must assess the vendor's BAA, safeguards and operating terms instead of accepting a certification claim.

Google Forms and Jotform have different BAA terms that a practice must check before collecting patient data. Google requires a BAA for protected health information, while Jotform offers HIPAA features and a BAA on its Gold and Enterprise plans.

HHS allows HIPAA authorizations to be obtained electronically, provided the electronic signature is valid under applicable law. That position comes from HHS FAQ 554, which addresses electronic health information.

A form vendor should answer specific questions about its BAA, staff access, files, audit records and signed versions. Give these questions to the practice manager or compliance lead who reviews the vendor before real patient data is collected.

• Will you sign a business associate agreement with our practice before we collect real patient data?
• Do all staff accounts use multi-factor authentication and unique user identities?
• How do staff sessions end, and can our practice limit access by role?
• Is every read of a patient response scoped to our practice and recorded in an access log?
• Where are form files stored, and are stored files and network connections encrypted?
• What happens to our signed records and patient data if we cancel, and which exports can staff retrieve?
• Can anyone change a published form version after patients sign it, and what audit trail stays with each signature?
• How will your business associate notify our practice after discovering a breach of unsecured protected health information?

Your practice keeps responsibility for its privacy notice, staff access, training, necessary questions and record retention. A form vendor supplies parts of the technical workflow, while the practice decides how its workforce uses that workflow.

• Publish and provide your own notice of privacy practices, then make a good-faith effort to obtain written acknowledgment under 45 CFR 164.520(c)(2); build the privacy notice acknowledgment around your own notice.
• Assign staff roles, review who can open patient forms and train staff on your practice's procedures.
• Ask only for information the practice needs, following the minimum necessary standard in 45 CFR 164.502(b).
• Keep HIPAA-required documentation for six years under 45 CFR 164.530(j), and follow state law for medical record retention.
• Use the intake forms guide to review fields and the patient intake forms guide to assign signatures and chart transfer.
• Check unfamiliar contract and record terms in the patient intake and HIPAA glossary.