Intake Form Examples to Streamline Your Workflow

HIPAA coverage depends on who runs the form, not on how medical the questions sound.

It applies only to covered entities and their business associates. Covered entities means health plans and clearinghouses, plus any provider that conducts standard electronic transactions such as insurance claims (45 CFR 160.103). A cash-only massage practice can run a health-history form outside HIPAA, while a dental office that files electronic claims cannot.

Law firms fall under attorney ethics rules instead. GDPR is a separate matter and follows the client’s residency, so any form collecting data on EU residents answers to it.

Intake form examples by industry

Intake forms collect personal details and consent up front, along with whatever the provider needs to know about the situation, before work starts with a new client or patient (or a project requester, on the business side). Patient, therapy, legal, wellness and fitness, and project or service request forms cover most of what gets built in practice.

As of October 2026, the IvyForms library has no template category named intake. It has nine categories, and most intake forms start from a booking, consent or request template, with fields added or removed from there.

Browse them all in the IvyForms form template library. Each template page shows whether it is free or paid, and any template with a signature field needs Pro, since the Signature field is a Pro feature.

Patient and medical intake forms

See the Pen
Patient Intake Form by Bogdan Sandu (@bogdansandu)
on CodePen.

The core of a patient form is medical history and current medications, plus allergies. Insurance details come next, often with a photo of the card uploaded alongside. Then the paperwork: a signed acknowledgment of the privacy notice and consent to treatment. When the patient is a minor, a parent or guardian signs.

Dental versions often add a separate financial responsibility signature, so the patient agrees to billing terms before treatment begins.

On the IvyForms side, the General Medical Consent Form covers consent for treatment, procedures and data usage. The Vaccination Consent Form adds guardian consent, medical history and a risk acknowledgment, which makes it a closer match for minors.

Pair either one with the Doctor Appointment Booking Form for dates and the reason for the visit. The insurance card photo goes into a File upload field.

Therapy and counseling intake forms

See the Pen
Therapy and counseling intake form by Bogdan Sandu (@bogdansandu)
on CodePen.

Therapy practices rarely run a single form. A general intake form covers most solo practices, and each specialty layers its own questions on top of a presenting problem and an emergency contact.

Psychotherapy and psychologist forms go deep on mental health history and assessment questions. Psychiatric forms swap some of that for evaluation questions and medication management. Couples and family versions ask about relationship dynamics and joint goals, with family history on top, and case management forms mostly exist to coordinate care across services.

IvyForms has no therapy-specific template. A workable start is the Consultation Appointment Booking Form, with Paragraph fields added for the presenting problem and goals.

If the history section runs long, move it to its own page with multi-page forms (Pro), so the first page stays light.

Legal intake forms

See the Pen
Legal Intake Form by Bogdan Sandu (@bogdansandu)
on CodePen.

A legal intake form should ask less than most people expect.

ABA Formal Opinion 510 (March 20, 2024) tells lawyers to limit the information they seek from prospective clients, because receiving more than is reasonably necessary can disqualify the whole firm from adverse matters under Model Rule 1.18.

Collecting more isn’t an ethics violation on its own, but it raises the risk of disqualification. So the form sticks to the names of the client and adverse parties, the matter type, the referral source and a high-level description. Detailed narratives wait until the conflict check clears.

The IvyForms Consultation Appointment Booking Form lists legal consultations among its uses. Strip it down to the fields above, and set a Max Length on the description field where the option is available, so nobody pastes in a full narrative.

Wellness, fitness and beauty intake forms

See the Pen
Wellness Intake Form by Bogdan Sandu (@bogdansandu)
on CodePen.

Jotform’s template library alone lists separate intake forms for estheticians, massage therapists, Reiki practitioners, lash artists and personal trainers.

Beauty versions ask about skin type, allergies, product sensitivities and appointment preferences. Fitness and massage forms lean toward injuries and medical conditions, with a liability waiver at the end.

The waiver is the part worth sending to a lawyer. Liability rules vary by state.

IvyForms covers the pieces separately. The Spa Appointment Booking Form handles services and therapist preferences, and the hair salon and nail salon versions do the same for those businesses.

For the waiver, the waiver form templates include a gym, yoga and dance class version. Treat the wording as a draft and have counsel review it.

Project and service request intake forms

See the Pen
Modern Logo Designer Client Onboarding Form by Bogdan Sandu (@bogdansandu)
on CodePen.

Scope, budget range, deadline and a named decision maker are the fields that matter here.

monday.com sorts its templates into business consultation and small business forms, with a separate business services group that covers website design, copywriting, rebranding and ads management.

No health or legal data is involved, so the compliance load shrinks to contract terms and data protection for any EU contacts.

In IvyForms, look at the request forms and the General Change Order Form, which is built to request, document and approve changes in a project, order or contract. Agencies onboarding suppliers can start from the vendor registration forms.

Which fields belong on an intake form, and how long should it be?

A working intake form needs identity and contact details, an emergency contact, the reason for the visit, relevant history, and consent with a signature. Anything beyond that earns its place only if the first session can’t start without the answer.

For anything outside that list, the question to ask about each of the form fields is whether the provider will act on the answer at or before the first session. Honestly, most of the fields people add “just in case” never get read.

Identity and contact means full name, phone and email, and a date of birth only where age matters. One emergency contact is enough, with a name and phone number. The reason for the visit works best as a single free-text line on what brings the client in. History should be scoped to the form type, whether that’s medical, case or project background. Consent ends with a dated acknowledgment.

Referral source is a sixth, optional field. Marketing wants it, but nobody’s care depends on it, so it never gets a required flag.

Require what the first session depends on. Mark sensitive history optional, or defer it to the first appointment.

All of this fits inside the free IvyForms Lite. The standard field set includes Name, Email, Phone, Address, Date, Paragraph, Checkbox and Dropdown fields, and each one can be marked required or left optional.

Hard numbers on intake form length are thin, so the figures below come from adjacent data. A booked client is already committed, which means the penalty per extra field should be smaller than on a lead form (Neil Patel’s own analysis says high-intent pages tolerate more friction).

• 5.7 minutes was the average time 17 participants needed to finish a digital intake form, with a range of 1 to 13 minutes (Cydoc study on arXiv, 2023; a participant who took 29 minutes was excluded as an outlier).
• Lead form conversion came in at 18.2% with one field versus 4.2% at nine or more, across 404 landing pages (Neil Patel).

The sources don’t agree on what each field costs. In one client test, conversion dropped 14% after fields were removed (Michael Aagaard, reported by Venture Harbour). Venture Harbour’s roundup concludes that length is one factor among several, which is why a result like that can happen at all.

Using conditional logic rules cuts the visible length without cutting coverage, because follow-up questions appear only when an earlier answer calls for them.

In IvyForms this is the Smart Logic tab on each field (conditional logic, Pro). One gotcha from the conditional logic documentation: rules compare the stored option value, not the visible label, so a renamed label won’t break a rule but a changed value will.

Treat 10 minutes as the ceiling for a first-visit form. Past that, move optional history to the first appointment.

Consent, e-signature and privacy rules for intake forms

See the Pen
Modern SaaS Intake Form (HIPAA & GDPR Compliant) by Bogdan Sandu (@bogdansandu)
on CodePen.

Which of these rules apply depends on who the provider is and where the client lives, and a single form can fall under more than one.

HIPAA and business associate agreements

HHS Office for Civil Rights cloud guidance (2016) cites a resolution agreement with a covered entity that stored ePHI of more than 3,000 people on a cloud server without a BAA.

An online form tool that receives patient submissions fits that cloud provider description. It needs a signed business associate agreement before any health information goes in.

On the Notice of Privacy Practices, a direct treatment provider gives it no later than first service delivery and makes a good faith effort to get written acknowledgment (45 CFR 164.520). If that first service is delivered electronically, HHS says the provider sends the notice automatically and tries to obtain a return receipt.

A refusal to sign gets documented. It is not a reason to turn the patient away.

Show the notice text with an HTML field that links to your full policy. Then add a required Checkbox for the acknowledgment, so the answer lands in the entry next to everything else.

GDPR for forms that collect EU resident data

GDPR classes health data as special category data, and Article 9 bars processing it unless one of 10 conditions applies.

Explicit consent for specified purposes (Article 9(2)(a)) is the condition most intake forms rely on, and a cookie-banner style tick box does not meet it. Another condition covers health or social care provision, so consent is one route, not the only one.

For the form-level setup, there’s a separate guide to building GDPR compliant forms.

IvyForms ships a GDPR field, a required consent checkbox whose agreement text accepts HTML, so it can link to your privacy policy. Write that text to name the specific purpose, and keep it separate from the health questions themselves. A generic “I agree to the terms” line is not explicit consent for health data.

Confidentiality duties on legal intake

Prospective clients get confidentiality protection even if they never hire the firm.

ABA Model Rule 1.18(b) bars a lawyer from using or revealing what a prospective client shared, except as Rule 1.9 permits for former clients. Intake submissions therefore need the same access limits as former-client files, which rules out forwarding every submission to a shared inbox.

IvyForms permissions help here. Rules can be set by WordPress role or by individual user, and limited to specific forms, so only the people running conflict checks can view entries from the intake form. Administrators always keep full access, so keep that account list short.

Informed consent wording

Consent text works if the client comes away knowing what information is collected and why, who receives it, how long the consent lasts, how it can be revoked, and where to sign and date.

Sample wording for the EU side sits in these GDPR consent form examples. A medical practice should still have counsel review any version before it goes live.

IvyForms makes the same point on its consent form templates page, where digital consent validity depends on location, industry and use case.

E-signature validity

Under ESIGN and UETA, an electronic signature carries the same legal weight as a handwritten one as long as there is intent to sign, consent to do business electronically, a link between the signature and the record, and retention of that record (Ironclad’s summary of both laws).

FindLaw notes that every state recognizes electronic signatures, either through UETA or its own legislation.

An “I agree to sign electronically” checkbox above the signature field covers the consent condition. Keep the timestamp and signer record the tool generates, since the association requirement has nothing to point to without them.

The IvyForms Signature field (Pro) lets people draw a signature with a mouse, touchpad or finger, with undo, redo and clear controls. Mark it required, and place a required checkbox for electronic consent right above it. Each entry also records a submission date and an ID.

Paper, fillable PDF or online form: which format fits?

Online is the default unless clients can’t get to one. Paper still makes sense in walk-in settings. A fillable PDF works for practices that want a printable copy without paying for a subscription, though anything that needs routing or signatures is better served by an online form.

Paper and fillable PDF

Paper and fillable PDFs need no software and work offline, so there’s nothing for a client to log into. Against that, every answer gets re-keyed by hand, pages get lost, and there are no conditional questions. With a fillable PDF specifically, unencrypted email attachments are the weak point.

Online and embedded forms

Online forms give you conditional questions, signature fields, automatic routing and phone-friendly layouts. The downsides are that BAA access is gated by plan and the subscription recurs. Jotform’s BAA, as summarized by Paubox, also stops covering PHI once it is exported.

Online tools can split a long questionnaire into steps too, and the trade-offs are laid out in this look at multi-step versus single-step forms.

Which form builders sign a BAA

As of October 2026, vendor documentation shows the following gates.

• Google Forms is covered under a Workspace account where an administrator has accepted Google’s BAA. Forms sits inside Drive on Google’s HIPAA Included Functionality list (version dated August 31, 2026), and add-ons fall outside it.
• Microsoft Forms gets its BAA through Microsoft’s Data Protection Addendum and Product Terms for in-scope services. Confirm Forms is listed for your plan.
• Jotform only signs on Gold or Enterprise plans (Jotform HIPAA FAQ).
• Typeform limits it to Enterprise or Growth Custom plans (Typeform Help Center).
• Cognito Forms wants the Enterprise plan, not a trial (Cognito Forms support).
• IvyForms runs as a WordPress plugin, so entries are stored in your own site’s database. Its pricing page and documentation do not mention a BAA, which puts your hosting provider at the center of the question. Ask IvyForms support and your host before collecting health data.

Third-party guides, including a LuxSci post, still say Google’s BAA excludes Google Forms. Google’s own list says otherwise, so trust the list and recheck it before relying on it, since Google updates it.

Google Forms has no built-in signature field. Consent forms often end up on an add-on, which sits outside the BAA, and at that point Google Forms alternatives built for intake work make more sense.

If the form collects health information, check BAA availability on your actual plan before comparing anything else.

How to build an intake form step by step

The order matters more than it looks, since consent and conditional logic both depend on the fields you’ve already cut.

1. Pick the form type (patient, therapy, legal, wellness, project) and start from a template that matches it.
2. Cut the fields to what the first session depends on, and mark sensitive history optional.
3. Add the consent block and signature. A HIPAA covered direct treatment provider also adds the Notice of Privacy Practices acknowledgment.
4. Add conditional logic so follow-up questions appear only when an earlier answer calls for them.
5. Open the form on a phone and fix the layout and field checks.
6. Submit a test record end to end and confirm the notification, the storage entry, the signature record and the confirmation message.

Clients often open the link from an email or text on their phone, so single-column fields and large tap targets matter more than decoration. Layout details for small screens are covered in these mobile form best practices.

A mistyped email or phone number sends the first appointment reminder nowhere. Format checks on those two fields, set up with standard form validation practices, catch the typo before submission.

Test with dummy records, never a real client’s data. A test that stops at the success screen proves nothing.

Check the notification address too. It should be a monitored practice account, not a personal inbox.

Building the form in IvyForms

Install IvyForms Lite or Pro, open IvyForms and choose Add New. You can pick a template, start blank, or describe the form to the AI form builder. Never put real client details in that prompt.

Edit the fields in the drag and drop builder and watch the live preview as you go. The creating forms guide walks through the builder panels.

To publish, embed the form with a shortcode, the Gutenberg block or Elementor. Keep the Store entries in database option switched on in the general settings, because with it off, submissions only travel by email.

For the test, submit a dummy record and open the entry from IvyForms, then Entries. If you use the signature field, update to Pro 1.1 or later first, since signature images missing from notification emails were fixed in that release (September 2026).

Style it to match the practice through form customization, so clients don’t wonder whether they landed on the right site.

Intake form features in IvyForms and which plan has them

Most of what an intake form needs sits in the free Lite version. Signatures, conditional logic and multi-step layouts need Pro. The table reflects the documentation and pricing page as of October 2026.

Pro comes in Essentials (1 domain), Growth (3 domains) and Agency (unlimited domains), plus a lifetime Elite plan. There is a 15-day money-back guarantee, and the free Lite version is a fair way to test the builder first. Current prices are on the pricing page.

Where intake form data goes after submission

Submitted intake data should land in one controlled system, usually a practice management or case tool, with role-limited access and a defined retention period. Email inboxes and shared spreadsheets are the weak points.

Sending the form before the first appointment

Send the link at booking, not at check-in.

SimplePractice shows the pattern: intake forms go out as an email containing a link to the Client Portal, the client completes them there, and automated reminders chase unfinished forms (SimplePractice Help Center).

• The email carries a link, never the form itself or any health details
• Reminders for unfinished forms run on a set schedule

WordPress practices using the Amelia booking plugin get a built-in version of this. The Amelia integration shows an IvyForms form as a pre-booking intake step, and the booking form then opens with name, email and phone already filled in.

Intake answers also show up in the appointment under Pre-booking form details. It works with both free and premium versions of the two plugins, and Amelia’s own page covers the IvyForms integration in Amelia.

The page a client sees after submitting should work as a clear form submission confirmation message. It states what happens next and does not echo what they typed.

In IvyForms, that means using a plain success message with no answer placeholders. On a shared waiting-room tablet, set the form to reset after submission, so the next person never sees the last entry.

Storing submissions

Under the HIPAA Security Rule (45 CFR 164.312), encryption of ePHI is an addressable specification. Addressable does not mean optional. The practice implements it or documents why an equivalent measure is reasonable.

Access follows the same logic. HHS minimum necessary guidance expects covered entities to limit workforce access to protected health information by role, so a front desk view of a submission should differ from a clinician’s.

The six years applies to security paperwork, not the client’s chart. State law decides how long the chart stays. HIPAA sets a floor on the paperwork, and GDPR ties any ceiling to purpose.

A form that collects EU resident data also states the retention period, or the criteria behind it, at the point of collection (GDPR Article 13(2)(a)).

Two IvyForms details matter for storage. First, the file upload field lets you save files to the IvyForms default location or the WordPress Media Library. The Media Library is built for reuse across your site, so keep insurance cards and records in the default location.

Second, the entries documentation lists manual delete actions and no automatic expiry setting. Schedule the purge yourself, and give the delete-entries permission to as few people as possible.

Routing submissions into practice tools

• SimplePractice populates the client’s chart automatically from completed intake forms, and the practitioner countersigns.
• Clio Grow captures contact and matter information from public intake form submissions, and a conflict check can be run during contact intake or when the matter is created (Clio Help Center).
• Jira Service Management shows a form attached to a request type inside the portal request form, with conditional sections supported. Team-managed service projects cap request types at 30 (Atlassian documentation).
• Zapier connects forms to other apps, with a catch described below.

As of October 2026, Zapier’s published position, as reported by HIPAA Journal, is that it does not support HIPAA data and will not sign a BAA. Recheck its current policy before relying on that, since vendor stances change.

Use Zapier for non-PHI routing such as project or service requests. Keep health intake inside tools that sign a BAA.

IvyForms offers several outbound routes, listed on its integrations page. Apply the same PHI rule to each of them.

• Google Sheets syncs entries to a spreadsheet. That suits project requests, but a shared sheet is exactly the weak point described above for health intake.
• Zapier and webhooks are Pro features, and the Zapier warning applies here too.
• The REST API lets a developer push entries into a practice system the client already trusts.

Notifications deserve one more look. The default message in IvyForms includes the all_data placeholder, which puts every answer in the email.

For health or legal intake, replace it with a short “new submission received” message and read the details inside the entry. Use a fixed internal address in the Send to field, not a placeholder pulled from the form, because a typo there sends the notification to a stranger.

When an intake form does not work

Most of the trouble here comes from asking the form to do a job it wasn’t built for.

Lead capture is not intake

A lead form qualifies an inquiry, while the intake form comes later, once someone has actually been accepted as a client.

Noteforms draws the same line in its 2025 guide to intake examples. Mixing the two means collecting sensitive details from people you may never serve.

A lead form sticks to name, contact details, what the person needs and how they found you. Everything the first session depends on, including history, consent and signature, belongs on the intake form. The IvyForms contact form template is a clean base for the lead side.

A signed form is not informed consent

Typeform’s own medical intake template states that a signed form documents what the patient disclosed and agreed to. It does not excuse negligent care, and it does not replace HIPAA or state informed-consent obligations.

The form saves time at check-in, but the conversation about risks still has to happen in the room.

Misrouted submissions become breaches

The HIPAA Breach Notification Rule (45 CFR 164.404 and 164.408) starts a 60 calendar day clock at discovery.

Individuals get notice without unreasonable delay and no later than 60 days. For breaches affecting 500 or more individuals, HHS gets a report within the same 60 days. Smaller breaches, under 500, are logged and reported to HHS within 60 days after the year ends.

A submission sent to the wrong inbox or left in an open spreadsheet can trigger the rule when it exposes unsecured PHI. A risk assessment showing a low probability of compromise is the exception.

Long forms and public links

A form people abandon yields nothing, and a public link invites junk.

Field-level drop-off data in the form builder shows where clients quit. Move or defer that question, then work through proven ways of improving form abandonment.

Public links also draw spam submissions, which clutter the intake queue and create records that still need a retention decision. Basic form spam prevention tactics belong in the build, not in a cleanup later. In IvyForms that means adding reCAPTCHA, Turnstile or hCaptcha before the form goes live.

Intake Form FAQ

How is an intake form different from a registration form?

Registration is the administrative side, meaning name, address and insurance. Intake adds the situational part, with history and the reason for the visit, plus consent.

Plenty of practices merge both into a single new patient form.

Can an intake form and a consent form be combined?

Yes, and many organizations do it to shorten the client’s paperwork (AidaForm).

Give the privacy notice acknowledgment and the treatment consent, plus any financial responsibility signature, their own signed and dated blocks rather than one blanket signature.

Who signs an intake form for a minor?

A parent or legal guardian signs for the patient, and Typeform’s medical intake template carries a dedicated field for it.

Who qualifies as a guardian, and when a minor may consent alone to certain services, depends on state law. In IvyForms, a conditional rule can reveal the guardian fields only when the patient is marked as a minor.

How do you make an intake form accessible and multilingual?

Offer the form in each language your clients use. Label every field, and test that the whole thing works with a keyboard alone.

The form accessibility best practices cover these checks in more detail. IvyForms has a WCAG option for its admin area, so test the public form separately.

Does IvyForms have intake form templates?

Not under that name, as of October 2026. The closest matches are the consent, booking, waiver and request templates, which you can edit freely in the builder.

Can I build an intake form in WordPress without code?

Yes. A drag and drop builder handles the fields, logic and layout, and an embed block or shortcode handles publishing. The IvyForms documentation has step-by-step guides for each part.

Keeping an intake form compliant after launch

An intake form stays compliant through a scheduled review, not a one-time build. Google’s HIPAA Included Functionality list differed between its December 6, 2024 and August 31, 2026 versions, so vendor coverage does shift over time.

Start the review with vendor plan and BAA coverage, since a lapsed BAA exposes every new submission at once. Consent and notice wording come next, then the retention and deletion schedule, both of which drift slowly.

If the form runs on IvyForms Pro, add one more check: the license. Per the multi-page forms guide, disabling Pro collapses a multi-step form into a single page. Saving the form while Pro is off makes that change permanent.

A Security Rule update proposed on January 6, 2025 would make encryption required instead of addressable. As of the July 2026 sources reviewed, no final rule has published, and HHS’s regulatory agenda now lists final action for July 2027, so the current rule governs.

Completion data from each review also feeds the wider work of optimizing forms.