HIPAA consent form, ready to import into Jotform.
A HIPAA consent form has to do four things: authorize use of protected health information, document consent for treatment, acknowledge receipt of the privacy notice, and capture a signature with a timestamp. Most free consent form templates you find online are PDFs that do one or two of those and skip the rest. This template does all four in Jotform, with e-signature, conditional logic, and a path to a signed BAA on the Gold plan or Enterprise.
What does a HIPAA consent form need to include?
A HIPAA consent form needs four elements: (1) PHI authorization, where the patient agrees to how their protected health information will be used and disclosed; (2) treatment consent, where the patient consents to the proposed care; (3) privacy notice acknowledgement, where the patient confirms they received the practice's Notice of Privacy Practices; and (4) a signature with timestamp. Jotform handles all four as form fields with e-signature capture, stored under HIPAA-plan encryption.
Source: WorkflowKits /hipaa/consent-form : by Buri (Mustafa Burak Ilter), former Jotform engineer (2020-2025).
The kits, ready to install in your account.
Each kit deploys into your own Jotform HIPAA account. No middleware, no platform fees, no vendor lock-in. Pricing covers the build and a window of support.
- Healthcare · HIPAA
HIPAA Patient Intake Kit
General patient intake with consent, insurance, and e-signature built in.
View the kit - Healthcare · HIPAA
HIPAA Therapy Intake Kit
Therapy intake with telehealth consent and PHQ-9/GAD-7 screening.
View the kit - Healthcare · HIPAA
HIPAA Wellness & PHI Consent Kit
Wellness consent: health history, treatment consent, photo release.
View the kit - Healthcare · HIPAA
HIPAA Telehealth Pre-Visit Kit
Telehealth pre-visit with video-specific consent and technology check.
View the kit
Four things, all of them load-bearing.
The Jotform HIPAA plan covers the platform side. The other three pillars are on you - and they are where almost every audit finding comes from.
- BAA in place
- The signed Business Associate Agreement with Jotform: the legal foundation. Without it, you do not have HIPAA compliance no matter what features you turn on.
- Integrations audited
- Every downstream tool that touches a submission (Zapier, Google Sheets, your CRM, your email tool) has to be HIPAA-aware too. One non-compliant Zap leaks the whole setup.
- PHI out of notifications
- Default Jotform email notifications often include the submission body. On HIPAA workflows, those go in the email itself. We strip PHI from notifications and route reviewers back to authenticated Jotform views.
- Access locked down
- Individual accounts, 2FA, role-based permissions on Enterprise. Shared logins are the most common audit finding we see. They are also the easiest to fix.
The full HIPAA loop, not just a form.
- PHI authorization section with conditional disclosure fields
- Treatment consent with specific procedure and provider fields
- Privacy notice acknowledgement with checkbox and link to full notice
- E-signature capture (drawn, typed, or click-to-sign) with timestamp
- HIPAA plan activation and BAA signing walkthrough
- Conditional logic for minor consent, legal guardian, and emergency contact paths
The notes that go deeper.
- Guide · 7 min
Jotform HIPAA: A Practical Setup Guide (From a Former Engineer)
If you handle protected health information, Jotform's HIPAA plan is the right starting point, but the plan alone doesn't make your workflow compliant. Here's what the plan covers, what it doesn't, and what most teams still get wrong.
Read the note - Guide · 9 min
HIPAA-Safe Jotform Integrations: What Breaks PHI, What Doesn't
The Jotform HIPAA plan covers Jotform. It does not cover what happens to a submission once it lands in Zapier, Google Sheets, Slack, or your CRM. Here is the integration-by-integration verdict from a Jotform HIPAA expert who built the integration codepath.
Read the note - Guide · 5 min
The 12-Item HIPAA Jotform Workflow Checklist (Pre-Launch)
Twelve items to check before any Jotform form that handles PHI goes live. If any of these are unchecked, the workflow is not ready. Save the page or copy the list into your decision log.
Read the note - Tutorial · 6 min
How to Get the Jotform BAA Signed: A Step-by-Step Walkthrough
The Jotform BAA is a 10-minute task once you know which screen to click. Here is the exact path: what to enable, what to ask for, and how to verify it actually got signed.
Read the note - Perspective · 8 min
Is Google Forms HIPAA Compliant? (Short Answer: Sort Of)
Google Forms on a free Gmail account is not HIPAA compliant. With a Google Workspace BAA and specific configuration changes, it can be made compliant. But it lacks clinical workflow features, e-signature, and integration audit trails. Here is the honest breakdown.
Read the note - Guide · 10 min
HIPAA-Compliant Form Builders: What to Actually Look For
Most form builders that advertise HIPAA compliance are telling you about one thing: they signed a BAA. A BAA is necessary but nowhere near sufficient. Here is what a compliant form setup actually requires, from a former Jotform engineer.
Read the note - Tutorial · 7 min
Jotform Email Notifications Not Working: Fix It in 10 Minutes
Jotform email notifications fail for six common reasons. Here is how to diagnose and fix each one in under 10 minutes.
Read the note
Questions, with straight answers.
Is a PDF consent form HIPAA compliant?
A printed or emailed PDF is not HIPAA compliant by itself. The form content might be correct, but the storage, transmission, and access controls around it are what make it compliant or not. A Jotform form on the HIPAA plan stores submissions encrypted, requires authenticated access, and falls under Jotform's BAA. A PDF on a shared drive or in an unencrypted email does not.
Can a patient sign a HIPAA consent form electronically?
Yes. Electronic signatures are valid under ESIGN and UETA for HIPAA consent forms, as long as the signature is attributable to the signer, the form cannot be altered after signing, and a timestamp is captured. Jotform's e-signature widget does all three.
What is the difference between consent and authorization under HIPAA?
Consent is the patient agreeing to treatment or general use of their information. Authorization is a specific, HIPAA-required document that permits disclosure of PHI for purposes beyond treatment, payment, and healthcare operations. Most intake forms need both: a treatment consent section and a PHI authorization section. They can be on the same form, but they have to be separate and clear.
Does a HIPAA consent form need to be notarized?
No. HIPAA does not require notarization of consent or authorization forms. Some state laws require witnesses or notarization for specific consents (like mental health or substance abuse treatment). Check your state. The Jotform template does not include notarization; add a witness signature field if your jurisdiction requires it.
Can I use this consent form for minors?
The template includes a conditional path for minor patients. When the date of birth indicates the patient is under 18, the form shows a parent or legal guardian consent section. The guardian signs instead of (or in addition to) the minor, depending on your state's age-of-consent rules for the specific treatment type.
How Jotform compares.
More HIPAA guides.
Ready when you are.
Free 20-minute call. Bring your current Jotform setup (or a blank account); leave with a straight answer about what compliance actually requires for your practice.
Bring the work your team still does by hand.
One 20-minute call: how it runs today, what an agent or automation would change, and whether it is worth building.