45,000+ practices bundle Notice of Privacy Practices acknowledgment, consent to treatment, HIPAA records-release authorization with the six elements 45 C.F.R. Section 164.508(c) requires, telehealth consent where state law calls for it, current medications, and insurance-card upload into one packet. Patients complete it at home in six minutes. Every paid plan ships with a Business Associate Agreement under Section 164.502(e), executable before you upload a single PHI-bearing form.
Every consent form, authorization, and intake packet runs on BAA-covered infrastructure with SOC 2 Type II controls, six-year audit retention, and breach-notification protocols built to the HITECH timeline.
Patient authorizations include the six required elements under 45 C.F.R. Section 164.508(c): description of PHI, named recipient, expiration date or event, signature with date, statement of right to revoke, and the redisclosure warning. Records-release forms separate treatment, payment, and healthcare-operations disclosures from the marketing and sale-of-PHI authorizations that need explicit opt-in. Always have your privacy officer review final templates before deployment.
Every paid plan ships with a HIPAA Business Associate Agreement under 45 C.F.R. Section 164.502(e), executable before you upload your first PHI-bearing form. SOC 2 Type II infrastructure, AES-256 encryption at rest, TLS 1.3 in transit, and the breach-notification protocol the HITECH Act requires within 60 days of discovery. Audit logs persist for the six-year retention period 45 C.F.R. Section 164.530(j) calls for.
Role-based access lets you split front-desk staff from billing from clinicians from your privacy officer, with the minimum-necessary access rule enforced at the field level. Every view, edit, signature, and download is logged with user, timestamp, IP, and action. Daily backups across geographically separated data centers. The audit trail is exactly the evidence you need for an OCR investigation or a HIPAA risk-assessment under 45 C.F.R. Section 164.308(a)(1)(ii)(A).
At the front desk, with a clipboard, a pen, and a waiting room.
From patient's phone, at home, the night before the visit.
Consent to treatment, HIPAA-compliant records-release authorizations, advance directives with state-specific witness and notarization rules, healthcare POAs, telehealth consent, behavioral-health intake, and 42 C.F.R. Part 2 SUD releases. Reviewed by counsel familiar with healthcare regulation.
When the patient books through your scheduling system, the full packet ships by email and SMS. Notice of Privacy Practices acknowledgment, consent to treatment, HIPAA records-release authorization with the Section 164.508(c) elements baked in, current medications and allergies, insurance card upload, and any specialty-specific intake (PHQ-9 for behavioral health, dental medical history, OB intake). Staff see live progress so the front desk knows whether the patient will arrive ready or need a clipboard.
Bundle consent to treatment, NPP acknowledgment, records release, telehealth informed consent, financial-responsibility agreement, and assignment of benefits into one signing flow. The patient works through them in order on their phone. Each form is BAA-covered so the PHI never leaves your covered-entity perimeter without the contractual safeguards 45 C.F.R. Section 164.502(e) requires for transmission to a business associate.
Every view, edit, signature, and download is timestamped with user, IP, and device. Six-year retention satisfies the HIPAA Privacy Rule documentation requirement under 45 C.F.R. Section 164.530(j) and longer where state law (California, Massachusetts, New York) requires more. The chain of custody is exactly what an OCR audit, an internal compliance review, or a malpractice-defense team will ask for.
Primary care, dental, behavioral health (PHQ-9, GAD-7, ROI for substance-use treatment under 42 C.F.R. Part 2), physical therapy, OB and women's health, home health, urgent care, optometry, chiropractic, and more. Telehealth informed consent meets the state-by-state requirements that vary widely (some states require explicit consent in the patient's chart, others permit verbal). OSHA bloodborne-pathogen training acknowledgments cover staff-side compliance.
Less time at the front desk. Faster compliance reviews. Infrastructure designed to earn clinical trust.
Unlimited document creation, unlimited e-signatures, and access to every template. One price, no surprises.
For solo practitioners
Billed monthly
7-day free trial
For small clinics and group practices
Billed monthly
14-day free trial
For multi-location groups
Billed monthly
14-day free trial
“We cut patient check-in time in half. People used to stand at the front desk filling out clipboards for 20 minutes. Now most of them finish intake the night before. Our staff can focus on patients instead of paperwork.”
Danielle Reeves
Clinic Administrator · Lakeview Family Medicine
Minneapolis, MN
“Keeping consent forms organized across two locations used to be a full-time job. Every signed form is stored automatically, searchable by patient or date. Our last compliance review took two hours instead of two days.”
Brian Sato
Dental Office Manager · Sato Dental Group
San Diego, CA
“My caregivers visit patients in their homes, so we need forms signed in the field constantly. Records releases, consent to treatment, advance directives, all on a tablet. No more driving back to the office with papers.”
Patricia Okonkwo
Owner · Gentle Hands Home Health
Charlotte, NC
Send the full packet as one link: Notice of Privacy Practices acknowledgment, consent to treatment, HIPAA records-release authorization, telehealth consent where state law requires it, medications and allergies update, insurance card upload, and any specialty intake (PHQ-9 for behavioral health, OB intake, dental medical history). Patients complete it the night before on their phone. Staff see live progress so the front desk knows whether to greet a fully prepared patient or hand over a clipboard.
Templates are written with the six required elements of 45 C.F.R. Section 164.508(c) baked into every authorization and the additional protections of 42 C.F.R. Part 2 layered over substance-use-disorder records. Bundle signing, six-year audit retention, role-based access enforcing the minimum-necessary rule, and BAA-covered infrastructure make the paperwork defensible to the OCR without slowing the practice down. Specialty templates cover primary care, dental, behavioral health, PT, home health, OB, urgent care, optometry, and chiropractic.
Every signed document files into the chart with a complete audit trail: who opened it, from what IP, on what device, when each field was completed, and when each signature landed. Search by patient name, MRN, date, document type, or specific authorization purpose. Compliance reviews that used to take days take hours. The audit trail is exactly the evidence an OCR investigator, an internal HIPAA risk-assessment under 45 C.F.R. Section 164.308(a)(1)(ii)(A), or a malpractice-defense team will ask for.
AES-256 encryption at rest, TLS 1.3 in transit, SOC 2 Type II infrastructure, BAA-covered for every paid plan. Role-based access enforces the HIPAA minimum-necessary standard at the field level so billing staff see what billing needs, clinicians see what clinicians need, and the privacy officer sees the audit trail across both. Daily backups across geographically separated data centers. Six-year retention satisfies 45 C.F.R. Section 164.530(j); longer retention available where state law requires it.
A Business Associate Agreement under 45 C.F.R. Section 164.502(e) ships with every paid plan and is executable before you upload your first form containing PHI. The BAA covers the required elements: permitted uses and disclosures, safeguards we maintain, breach-notification timing under HITECH (we notify you of a discovered breach within five business days, well inside the 60-day rule), subcontractor flow-down requirements, and the obligation to return or destroy PHI on termination. Have your privacy officer countersign before any patient data moves.
The records-release and authorization templates include all six elements 45 C.F.R. Section 164.508(c) requires for a valid authorization: a meaningful description of the PHI to be disclosed, the named recipient, the purpose of the disclosure, an expiration date or event, the patient's signature with date, and the statement of the right to revoke plus the redisclosure warning. Marketing and sale-of-PHI authorizations are kept distinct from treatment-related disclosures because the rules differ. Always run final templates by your privacy officer.
State requirements for telehealth informed consent are wildly inconsistent. Some states (Texas, California, Colorado) require explicit written consent in the patient's chart. Others permit verbal consent that the provider documents. A handful require state-specific disclosures about telehealth limitations, prescribing restrictions, and the patient's right to in-person care. The template library includes state-specific telehealth consent forms updated as state medical boards revise their rules. The signed consent files into the patient record with the audit trail intact.
Guided templates walk the patient through the decisions: life-sustaining treatment preferences, artificial nutrition and hydration, pain management, organ donation, and the named healthcare proxy or attorney-in-fact. The completed document is signed electronically and, where state law requires witnesses or notarization (most states still do for advance directives, even with e-sign), the platform supports remote online notarization in the 40-plus states that have authorized it. Copies route to the patient, the proxy, and the chart automatically.
Yes. Combine NPP acknowledgment, consent to treatment, HIPAA records-release authorization, telehealth consent, financial-responsibility agreement, assignment of benefits, and any specialty-specific intake into one packet. The patient receives a single link, works through each in order, and signs everything in one sitting. The completed packet files into the chart with a six-year audit trail. Front-desk staff see real-time progress so they know who is ready before the patient walks in.
Substance-use disorder records get heightened protection under 42 C.F.R. Part 2, which is stricter than HIPAA. The Part 2 release-of-information template captures the additional consent elements Part 2 requires (specific name of the program disclosing, name of recipient, kind of information disclosed, purpose, expiration, signature, and the explicit prohibition on redisclosure notice). Behavioral health intake includes PHQ-9 and GAD-7 with proper scoring, and the records bucket is segregated so a general medical-records request does not pull SUD records without the Part 2 authorization.
Works on any smartphone, tablet, or computer with a modern browser. No app download. The session-level controls let you require re-authentication for staff devices on a short timeout, restrict access by IP range when staff are on-site, and revoke a stolen device's session immediately. The platform never stores PHI on the device itself; everything renders in the browser session and clears on logout. This is the BYOD posture HIPAA's Security Rule expects under 45 C.F.R. Section 164.312(a)(2)(iii).
OSHA bloodborne-pathogen training acknowledgments under 29 C.F.R. Section 1910.1030(g)(2)(vii), annual HIPAA workforce training documentation under 45 C.F.R. Section 164.530(b), employment contracts with state-specific non-compete restrictions where they remain enforceable (and the disclaimers required where they don't, like California Bus. & Prof. Code Section 16600), credentialing packages, and DEA-registration acknowledgments for prescribing providers all live in the same library. Customizable, state-specific, and ready to send for signature.
Join 45,000+ healthcare practices running calmer intake and cleaner records.
