PT and Chiro Patient Intake Forms: What to Collect and Why

A new patient intake packet is where three rulebooks hand a clinic their homework at once: HIPAA wants a documented acknowledgment, Medicare wants to know who pays first, and a chiropractor’s initial visit note needs specific history elements before a claim can withstand review. Most intake templates online don’t sort any of that out; they list eight or ten fields under one heading and leave a clinic guessing which are legally required, which the workflow needs, and which are just habit.

This post covers outpatient rehabilitation clinics (physical therapy, occupational therapy, and similar) and chiropractic clinics, not residential or addiction-treatment programs also called “rehabilitation centers.” It sorts intake fields into three buckets: required by rule (with citation), required by workflow because a payer will audit the evaluation and plan of care built on these fields, and optional. It covers the Medicare Secondary Payer (MSP) questions, the ABN rule a routine intake practice violates, the direct-access notices two states require, the chiropractic history elements Medicare’s documentation rules describe, and what to look for in intake software. Current as of September 2026.

What does a physical therapy intake form need to include?

The HIPAA acknowledgment: not a consent, and a six-year record

The clipboard “HIPAA form” isn’t consent to treatment. HIPAA doesn’t require consent for treatment, payment, or operations at all: 45 CFR 164.506(b)(1) says a covered entity “may obtain consent,” and the word is “may.” What’s required is narrower: a provider with a direct treatment relationship must give the Notice of Privacy Practices “no later than the date of the first service delivery” and, except in an emergency, “make a good faith effort to obtain a written acknowledgment of receipt of the notice,” documenting the effort when it isn’t obtained. The notice must also be posted “in a clear and prominent location” at the site and, if the practice’s website describes its services, posted there too (45 CFR 164.520(c)).

The correct intake field, then, is a timestamped receipt acknowledgment plus a way to record when it wasn’t collected and why. Refusal to sign doesn’t block treatment; it just needs documentation, kept “for six years from the date of its creation or the date when it last was in effect, whichever is later” (45 CFR 164.530(j)(2)).

A vendor storing intake responses is also handling PHI on the practice’s behalf, and 45 CFR 160.103 defines that as a business associate, someone who “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including… billing, benefit management, practice management, and repricing.”

The Medicare Secondary Payer questions every rehab intake should ask

MSP rules keep Medicare from paying first when another payer should pay first. MLN006903 puts the obligation on every provider: “Any entity providing items and services to Medicare patients must determine if Medicare is the primary payer,” and its first listed responsibility for anyone billing Medicare is to ask patients about other coverage “at each visit before providing services” (MLN006903, July 2025). Getting it wrong lets Medicare recover mistaken payments under 42 CFR 411.24 (MSP Manual Ch. 3, §20.1).

The employee count decides primacy: an aged beneficiary with a GHP through an employer of 20 or more has the GHP as primary; a disabled beneficiary whose employer (or spouse’s/family member’s employer) has 100 or more also has the GHP as primary (MSP Manual §20.2.1). A separate Part III covers ESRD entitlement. Work injuries, auto accidents, and liability claims are ordinary intake situations, and each changes who gets billed first.

No signature is required, just a record of the date asked, and the record must be “kept for at least 10 years after the date of service that appears on the claim” (MSP Manual §20.2.2).

Two different 90-day rules, easy to confuse. The Manual’s “every 90 days” language is a hospital instruction: hospitals must re-verify MSP information for recurring outpatient services “once every 90 days.” That doesn’t apply to PT or chiro clinics. A separate, unrelated 90 days governs every outpatient therapy plan of care: Benefit Policy Manual §220.1.3 requires recertification “at least every 90 days after initiation of treatment under that plan,” and the initial certification covers “the duration of the plan of care, or 90 calendar days… whichever is less.” That’s a physician or NPP signature on the plan of care, not an intake form; see Medicare plan of care certification. The intake obligation is simpler: ask the MSP questions at start of care and again whenever coverage or the reason for treatment may have changed.

Medicare beneficiaries, ABNs, and the financial policy

Intake should flag Medicare status, including Medicare Advantage, because that changes which forms apply downstream. It doesn’t mean every Medicare patient signs an Advance Beneficiary Notice (ABN) at intake. CMS describes the ABN, Form CMS-R-131, as a notice issued “in situations where Medicare payment is expected to be denied” (CMS FFS ABN page), a per-service notice, not a blanket intake form. The Claims Processing Manual explains why a routine or blanket ABN fails: “‘Routine’ use of written notices is not effective” where “there is no specific, identifiable reason to believe Medicare will not pay,” a generic disclaimer isn’t “acceptable evidence of written notice,” and “blanket written notices” for all claims are “not an acceptable practice” (Claims Processing Manual Ch. 30, §40.3.6 C). The same section names the financial-policy sentence many intake packets rely on: notice standards “are not satisfied by a generic document that is little more than a signed statement by the beneficiary to the effect that, should Medicare deny payment for anything, the beneficiary agrees to pay for the item and/or service.”

ABNs and modifiers in therapy covers when an ABN is mandatory versus voluntary and which modifier follows it onto the claim. A general financial policy is fine, but it can’t replace Medicare enrollment and claim submission: physical therapists are not on the closed list of practitioners who may opt out of Medicare under 42 CFR 405.400, which names physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, certified nurse midwives, clinical psychologists, clinical social workers, marriage and family therapists, mental health counselors, and registered dietitians or nutrition professionals. Medicare beneficiaries in cash-pay practices covers what that means for an otherwise cash-model practice.

Referral, direct access, and state notices

Whether a patient arrives with a referral is intake data with two downstream uses. Direct access is state law: each state sets how long a physical therapist may treat without a referral, what has to happen after that, and what the patient must be told first, so the intake fields depend on where the clinic sits. Two examples show what a state can require at intake.

The fields supporting both needs are the same: referral present, referring provider, date, and, where required, a signed state-specific notice. Medicare requires a certified plan of care regardless of direct-access status; see Medicare plan of care certification.

History, goals, and outcome measures the evaluation will need

Medicare’s documentation standard is oriented around proof of progress: “Documentation should establish through objective measurements that the patient is making progress toward goals” (Benefit Policy Manual §220.3). Intake is where the raw material gets collected, in the patient’s own words: history of present condition, prior level of function, comorbidities, and patient-stated goals.

Standardized outcome measures at intake give the evaluation a baseline. Published minimum important differences: 1.3 to 2.7 points (0-10 scale) for the Patient-Specific Functional Scale, -12 for the Oswestry Disability Index, -14 for the Neck Disability Index, 9 to 16 for the Lower Extremity Functional Scale, and -1.5 to -3.5 for the Numeric Pain Rating Scale (JOSPT 2014). For MIPS reporters, instrument choice also matters: Quality Measure 182 requires a “standardized functional outcome assessment tool” (ODI, Roland Morris, Neck Disability Index, PROMIS, DASH, and others qualify) but excludes pain-only tools, since a VAS “does not meet the criteria” (MIPS Measure 182, 2026 spec). The same spec flags a licensing wrinkle: electronic ODI “is no longer available free of charge,” though a paper version is. UnitedHealthcare’s Optum guide separately lists Neck Index, Back Index, DASH, and LEFS as “highly recommended, but not required” (Optum Clinical Submission Process Guide). Capture the instrument as scored, structured data, and repeat it at progress-report intervals.

Chiropractic intake: what Medicare wants in the initial-visit history

Medicare’s chiropractic initial-visit rule names the required history content directly: “Symptoms causing patient to seek treatment; Family history if relevant; Past health history (general health, prior illness, injuries, or hospitalizations; medications; surgical history); Mechanism of trauma; Quality and character of symptoms/problem; Onset, duration, intensity, frequency, location and radiation of symptoms; Aggravating or relieving factors; and Prior interventions, treatments, medications, secondary complaints” (Benefit Policy Manual §240.1.2). All eight can be collected in the patient’s own words, so the initial-visit note starts from structured data instead of a blank page.

Intake can also carry a contraindication screen flagging conditions the doctor must discuss and chart before using dynamic thrust. Relative contraindications include “articular hyper mobility… severe demineralization of bone; benign bone tumors (spine); bleeding disorders and anticoagulant therapy; and radiculopathy with progressive neurological signs” (Benefit Policy Manual §240.1.3); absolute contraindications near the site include acute inflammatory arthropathies, acute or unstable fractures, unstable os odontoideum, spinal malignancy, and spinal infection. A screen for anticoagulant use, bleeding disorders, bone loss, tumors, recent fracture, cancer history, and progressive numbness or weakness surfaces this before the exam.

What intake cannot do, and what the rule keeps with the clinician, is the rest of the record: present-illness description, physical exam, diagnosis (“must be subluxation, including the level of subluxation”), and treatment plan. “A statement on a claim that there is ‘pain’ is insufficient. The location of pain must be described,” and the exam must satisfy two of four criteria (pain/tenderness, asymmetry/misalignment, range of motion abnormality, tissue/tone changes, informally P.A.R.T., a term the manual itself doesn’t use), “one of which must be asymmetry/misalignment or range of motion abnormality.” See Medicare chiropractic billing for the CMT codes and AT modifier.

What should never be in a URL or an unencrypted email

Two habits create ePHI exposure regardless of what a form asks. The Security Rule’s transmission standard requires technical measures “to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network,” with encryption addressable (45 CFR 164.312(e)). A form link carrying a patient’s name, DOB, diagnosis, or appointment reason in the URL is PHI in transit: it lands in browser history, server logs, and referrer headers on every hop. A link should carry only an opaque token. Unencrypted email carrying intake answers is the same kind of transmission; the safer pattern is a notification email linking to an authenticated page, not the answers themselves. The same section’s access control requirement, limiting access “only to those persons or software programs that have been granted access rights,” is why a reusable link should route to an authenticated session, not expose stored responses to anyone holding the URL.

What to look for in patient intake software

Every requirement below ties to a rule above, or to a capability a vendor should demonstrate rather than promise. General-purpose form tools (Google Forms, JotForm, Typeform, Formstack, IntakeQ) are the usual reference points. JotForm’s physical therapy intake template, for example, lists demographics, emergency contact, insurance, medical history, symptoms, and appointment preferences, carries a disclaimer that it isn’t legal advice, and says nothing about which of those fields carries a legal requirement.

CuratoForm, the healthcare form builder from Rehabilitation Health that runs standalone or as part of PrismEHR, is built around this list: a BAA with every customer, patient-scoped and reusable links with no PHI in the URL, conditional logic, multilingual display, encrypted file uploads, and timestamped signature capture. What makes a form tool HIPAA-ready is the deeper dive on the BAA and Security Rule requirements behind the first and last rows above.

CuratoForm is the healthcare form builder from Rehabilitation Health that runs standalone or as part of PrismEHR. When connected, responses and AI-generated summaries can populate PrismEHR notes, with clinician review, so intake data becomes the chart’s starting point instead of paper to re-key. See how that fits a chiropractic practice, and read what makes a form tool HIPAA-ready for the vendor side of the BAA requirement above.