Chiropractic practices collect more sensitive health information per first visit than most medical specialties. Medical history, current medications, complaint details down to the vertebral level, allergies, pregnancy status, prior surgeries, accident dates that may overlap with active personal injury litigation. All of it is protected health information (PHI) under HIPAA. In a meaningful share of the chiropractic intake forms still in circulation, the HIPAA framing is either missing or incorrect.
This isn’t a regulatory hammer waiting to fall on every practice. Most chiropractors mean well. Most forms are mostly compliant. But for any practice that bills insurance, qualifies as a “covered entity” or “business associate” under 45 CFR Parts 160 and 164, or ever transmits a patient record electronically, the form has specific work to do.
What the intake form itself must do
Collect only what’s needed. HIPAA’s minimum-necessary rule limits collection to what’s required to perform the service. For chiropractic, that’s broad — but it doesn’t include the patient’s Social Security number unless billing requires it. SSN doesn’t belong on a chiropractic intake unless a clear business reason supports collecting it.
Identify the purpose of collection. Either on the form itself or in the practice’s Notice of Privacy Practices (NPP), the patient should understand what PHI is collected, why, how it’s used, and who else sees it.
Separate clinical history from administrative information. The cleaner structure: an intake form holds demographics, insurance, emergency contact, and presenting complaint. A separate clinical questionnaire holds the detailed medical history, medications, prior surgeries, current symptoms. The split matters when records need to be shared with an external party — a referring provider, an attorney request for records, an FMLA paperwork request from an employer — and only the clinical piece should be released without the financial.
What the HIPAA release must do — and why it should be separate
A HIPAA Authorization for Disclosure (often called a “HIPAA release”) is governed by 45 CFR 164.508 and has specific required elements:
- Specific description of the information to be released (not “all records” — what records, what date range)
- Specific person or entity authorized to receive the information
- Purpose of the disclosure
- Expiration date or expiration event
- Statement of the patient’s right to revoke the authorization in writing
- Statement about the risk of re-disclosure once information leaves the practice
- Signature of the patient or the patient’s personal representative
- Date
Combining the HIPAA release with the intake form creates problems. Intake forms get re-signed each visit; a HIPAA release shouldn’t have to be. Patients can revoke a HIPAA release in writing — they shouldn’t be revoking their entire intake by accident. Court-ordered subpoenas operate under different rules than patient-authorized disclosures; conflating them in a single document muddies the analysis.
Best practice: intake and clinical questionnaire on visit one. Separate HIPAA release executed only when actual record disclosure is needed.
Where most chiropractic intakes fall short
Pregnancy disclosure with no rationale. Pregnancy changes which adjustments are safe, but if the form asks “are you pregnant?” without explaining why, patients in early pregnancy who haven’t told family yet sometimes lie. A short line cures the problem: “We ask because some adjustments are modified during pregnancy. Your answer is protected health information and stays in your chart.”
Missing prior PI claim disclosure. A recurring problem: the patient is treating for injuries arising from an accident with an active claim. The patient’s attorney needs the chart. The defendant’s investigator subpoenas the chart. The patient never mentioned the claim on intake, and now the practice is in the middle of a discovery dispute. The intake should ask: “Are you currently in litigation related to any of the injuries you’re seeing us for? If yes, please provide attorney contact information.”
Emergency contact relationship not specified. “Emergency contact” without specifying the relationship creates HIPAA issues. Is the contact a personal representative under state law? Can the practice disclose PHI to them? The form should ask the relationship and follow up with: “Do you authorize this contact to receive information about your treatment?”
No retention statement. Chiropractic records have state-specific retention requirements ranging from five to ten years for adult patients, longer for minor patients. Patients frequently ask how long records are kept. Including the retention policy on the intake form answers the question once, in writing.
A professional starting point
Templateez offers a chiropractic intake set with the intake/questionnaire split described above. The 2-page intake covers patient record, insurance, chief complaint checkboxes by body region, medications and allergies, and chronic-condition history. The 2-page questionnaire covers patient information, health goals, plain-language complaints, habits and lifestyle, service interests, and includes a HIPAA Notice of Privacy Practices acknowledgment in the signature block. The set is $19.99.
For the standalone HIPAA Authorization for Release of Protected Health Information, Templateez offers a 2-page form built to the 45 CFR §164.508 required elements — patient info, source provider, recipient, information to disclose, date range, purpose, format, expiration date or event, right to revoke. Available as a $14.99 standalone to drop into an existing intake.