How to Collect Client Information Securely: A Small Business Guide

By Daniel Akselrod · July 2026

You collect client names, addresses, phone numbers, email addresses, dates of birth, insurance information, medical histories, financial details, and Social Security numbers. Maybe not all of those — but almost certainly more sensitive data than you think. And if you are like most small businesses, your “security protocol” for that data is whatever felt convenient at the time.

That is not a judgment. It is just the reality. Small businesses are built by people who are experts in their trade, not in cybersecurity. But data security does not require expertise — it requires basic habits that are easier to implement than most people assume. Here is what actually matters.

Email Is Not Secure (But Everyone Uses It Anyway)

Let us start with the uncomfortable truth: standard email is not encrypted. When a client emails you their date of birth, insurance information, or details about a legal matter, that data travels across the internet in a format that can be intercepted, forwarded, or stored on servers you do not control.

In practice, the risk of an email being intercepted in transit is relatively low. The larger risk is what happens after delivery: the email sits in your inbox indefinitely, it gets backed up to cloud servers, it can be found by anyone who accesses your email account, and it is searchable. If your email account is compromised — and credential stuffing attacks hit small business accounts constantly — every piece of client information you ever received by email is exposed.

Does this mean you should never collect client information via email? Realistically, no. Email is how business communication works, and telling clients to use encrypted messaging apps is impractical. But you can significantly reduce your exposure with two habits:

Use fillable PDF forms instead of freeform email. When a client fills out a structured PDF intake form and emails it back, you download the attachment, save it to the client’s folder, and delete the email. The information lives in a controlled location rather than scattered across your inbox. This is not just tidier — it is the difference between a single point of exposure and an unlimited one.

Never ask for sensitive data in the body of an email. If you need a Social Security number, a credit card number, or detailed medical history, collect it by phone, in person, or via an encrypted file-sharing link. Not in a reply chain.

Digital File Organization: The Security Most People Overlook

File security is not just about encryption and passwords. It is about knowing where client data lives and controlling who can access it. For most small businesses, the biggest vulnerability is not hackers — it is disorganization.

When client information is saved as “scan1.pdf” on your desktop, pasted into a random Notes app entry, written on a sticky note attached to your monitor, and also somewhere in your Gmail search results — you have no security. Not because any one of those locations is inherently insecure, but because you cannot protect data you cannot find and cannot account for.

The fix is straightforward:

• One folder per client. Every piece of client information goes into a dedicated folder. The intake form, correspondence, contracts, notes — all in one place. Cloud storage (Google Drive, Dropbox, OneDrive) is fine; just ensure your account has two-factor authentication enabled.
• Consistent file naming. “LastName_FirstName_Intake_2026.pdf” is findable. “Document (3).pdf” is not.
• Delete what you do not need. If a client texts you their insurance information and you transfer it to their intake form, delete the text. If they email you a filled-out form and you save it to their folder, delete the email. Fewer copies of sensitive data means fewer things to protect.

Password-Protecting Completed Forms

A fillable PDF that contains completed client information should be password-protected before storage. This is not paranoia — it is a trivially simple step that prevents casual access if your device is lost, stolen, or accessed by someone who should not be looking at client files.

Every major PDF reader (Adobe Acrobat, Preview on Mac, and most third-party alternatives) can set a password on a PDF file. It takes about ten seconds. If your computer is stolen from your car — which happens to service professionals constantly — the thief gets a laptop but not your clients’ personal information.

For what it is worth, all Templateez forms ship with owner-password protection that allows clients to fill and print but not edit the form structure. Adding your own password to the completed version adds a second layer that protects the filled-in data.

What “Secure” Actually Means for Non-Healthcare Businesses

Healthcare businesses have HIPAA, which mandates specific technical safeguards, encryption standards, breach notification procedures, and Business Associate Agreements. It is complex and heavily regulated for good reason — medical records are uniquely sensitive.

If you are not in healthcare, your security obligations are simpler but still real. Here is the practical standard most small businesses should meet:

• Two-factor authentication on every account that touches client data. Email, cloud storage, accounting software. This single step prevents the majority of unauthorized access incidents.
• A password manager. Not because it is a security product, but because it eliminates the two biggest password problems: reusing the same password everywhere and writing passwords on sticky notes.
• Screen lock on every device. Laptop, phone, tablet. If you walk away from your desk and a client file is open, the screen should lock automatically within five minutes.
• Encrypted hard drive. Both Windows (BitLocker) and Mac (FileVault) offer built-in drive encryption. Turn it on. If your laptop is stolen, encrypted drive data is unreadable without your login credentials.

None of this requires specialized security knowledge. It requires about 30 minutes of setup, once.

The Liability Difference Between Documented Intake and No Intake

Security is not just about preventing data breaches. It is about having a defensible record of what information you collected, when, and what the client told you. This matters in ways most small businesses do not consider until they are already in trouble.

When a client disputes a scope of work, a completed intake form shows exactly what was requested. When a patient claims they disclosed an allergy that was not accounted for, the intake form either confirms or disproves that claim. When an attorney faces a malpractice allegation, the intake form documents what the client represented about their case at the outset.

Informal intake — verbal conversations, text messages, notes scribbled during a phone call — provides none of this protection. It is your word against the client’s, and that is a position no professional wants to be in.

State Data Breach Notification Laws: Yes, Even Plumbers Should Care

All 50 states, the District of Columbia, and U.S. territories have data breach notification laws. If personal information you hold is exposed — through a hack, a lost laptop, or even an employee who should not have had access — you are legally required to notify affected individuals. In many states, you must also notify the state attorney general.

The definition of “personal information” varies by state but typically includes name combined with Social Security number, driver’s license number, financial account numbers, or medical information. If you collect any of these — and most service businesses collect at least two — you are subject to breach notification requirements.

The penalties for non-compliance range from per-record fines to state enforcement actions. For a plumbing company that collected driver’s license numbers for background checks on property access and then had a laptop stolen, the legal exposure is real.

This is another reason structured intake forms matter: they help you collect only what you need (a well-designed form does not ask for a Social Security number unless the profession requires it) and store it in a predictable location (making it easier to assess the scope of exposure if something goes wrong).

Start Simple, Stay Consistent

Client data security does not need to be complicated. Use structured forms instead of freeform email. Organize files by client. Enable two-factor authentication. Password-protect completed documents. Know what data you have and where it lives.

The businesses that get into trouble are not the ones using unsophisticated technology. They are the ones using no system at all — collecting sensitive information in scattered, inconsistent, and unprotectable ways. A profession-specific intake form is the first step toward a system, and it is a step you can take today.