Every health care provider covered by HIPAA — and that includes any provider who transmits health information electronically for a covered transaction, such as billing insurance (45 CFR 160.103) — must give patients a Notice of Privacy Practices and try to collect a signed acknowledgment that they received it. Most covered entities have had to comply since April 14, 2003. Over twenty years later, many small practices still do it on paper.
"HIPAA consent forms" is the phrase most people search for, but HIPAA itself talks about three different documents, and only some of them are required. Here's what each one is, what it must contain, and where practices get it wrong.
What HIPAA Actually Requires
There are three distinct HIPAA-related documents that most practices need, and one that people assume they need.
Notice of Privacy Practices (NPP)
This is the document itself. It explains how your practice uses and discloses protected health information (PHI), the patient's rights regarding their PHI, and your practice's legal duties regarding PHI. Under 45 CFR 164.520, a covered provider must give it to every patient.
The NPP must describe, with at least one example, the types of uses and disclosures you make for treatment, payment, and health care operations. It must describe the patient's rights: to request restrictions, to receive confidential communications, to inspect and copy their records, to request amendments, to get an accounting of disclosures, and to get a paper copy of the notice. It must explain how to file a complaint, your duty to protect PHI and to notify patients of a breach, and who to contact with privacy questions.
Acknowledgment of Receipt
This is the signed form confirming the patient received the NPP. It's typically a one-page form that says "I acknowledge that I have received and had an opportunity to review [Practice Name]'s Notice of Privacy Practices." It includes the patient name, signature, and date.
The rule is softer than most people think. A covered provider must make a good faith effort to obtain a written acknowledgment, and if it can't get one, it must document the effort and why it failed. A missing signature isn't automatically a violation; a missing signature with no record of trying is the problem. Having an acknowledgment on file for every patient is the simplest way to show you made the effort.
Authorization for Use and Disclosure
This is a separate form used when you need to use or share PHI for purposes beyond treatment, payment, and operations — such as sending records to an attorney, providing information to an employer, or using PHI for marketing. Under 45 CFR 164.508, a valid authorization must include:
- A specific description of the information to be used or disclosed
- Who is authorized to make the disclosure, and who will receive it
- The purpose of each use or disclosure
- An expiration date or expiration event
- The patient's signature and the date
It must also tell the patient they can revoke the authorization in writing, whether treatment can be conditioned on signing it, and that information disclosed under it may be redisclosed by the recipient.
"Consent" for Treatment, Payment and Operations
This is the one practices assume is mandatory. It isn't. Under 45 CFR 164.506, a covered entity may obtain a patient's consent to use or disclose PHI for treatment, payment, and health care operations, but HIPAA doesn't require it. Many practices still fold a consent statement into the intake packet, and your state law may ask for more. Just don't confuse it with an authorization: a general consent can't stand in for the specific authorization 164.508 requires.
What Goes on the Digital Versions
Each form maps cleanly onto a short online form.
The acknowledgment: the NPP itself (or a link to it) above the signature, the patient's name, a statement confirming they received and had the opportunity to review the notice, a date, and a signature field.
The authorization: fields for patient name and date of birth, the specific information to be disclosed, the person or organization receiving it, the purpose, an expiration date, the revocation and redisclosure statements, and a signature field.
The patient reads, signs, and submits on their phone before the visit.
Why Digital Acknowledgments Hold Up Better Than Paper
Proof of receipt. A digital submission is time-stamped when it's submitted, not when someone writes a date on a piece of paper.
Accessibility. When you're asked for a specific patient's acknowledgment, you can pull it from their record in seconds instead of searching a filing cabinet.
The notice and the signature stay together. A digital form can put the notice text directly above the signature, so the patient sees what they're acknowledging.
The federal ESIGN Act and state UETA laws generally give electronic signatures the same legal effect as handwritten ones. Some states add rules for particular documents, so check yours.
Where to Collect Them
Because these forms collect PHI, the vendor that stores the answers is a business associate, and you need a signed Business Associate Agreement with it before patients submit anything. Our comparison of HIPAA intake form software for therapy practices covers which tools sign one, and on which plan.
In a GetDocsSigned healthcare account, healthcare forms and their submissions run in a separate HIPAA environment under a signed BAA, and the patient record holds the healthcare form submissions, faxed orders and uploaded files for that patient. When you update your NPP, share the new acknowledgment form with active patients and check each patient's record for the updated submission. For authorizations, the expiration date is a field on the form itself, so you can check it in the patient's record before the authorization lapses.
Healthcare accounts start at $199 a month per practice, with unlimited staff users. That includes the BAA and setting up your forms from your blank PDFs. Practices with several locations get a quote. See how healthcare accounts work.
Start Here
If your practice is still collecting HIPAA acknowledgments on paper, this is one of the easiest operational improvements you can make. One form, one link, every new patient completes it before they walk in. Your documentation goes from "hoping it's in the file" to "searchable in seconds."
Build the form once. Update it when your practices change. That's it.
GetDocsSigned sets up healthcare accounts by hand with a signed BAA: healthcare forms, patient records, order tracking and fax. E-signature, payments and the AI form builder are outside that environment. Unlimited users. See how it works