What a clinic form should (and shouldn't) collect
A clinic website form is a digital receptionist — its job is to turn a visitor into a booked appointment request your front desk can act on within minutes. That means collecting just enough to call them back and schedule effectively:
- Name + phone + email — so the front desk can confirm and remind.
- Appointment type — new patient, follow-up, consultation, urgent/same-day, specialist referral.
- Preferred days/times — speeds scheduling, reduces phone tag.
- Location preference — if your practice has multiple clinics.
- Brief reason for visit — helps staff prioritize urgent cases.
What to keep off a public website form: detailed medical history, medication lists, insurance/policy numbers, Social Security numbers, and anything else that constitutes protected health information. Collect those through your practice-management system or a secured, BAA-covered portal once the appointment is set.
A practical note on patient privacy
This matters enough to address directly: most general-purpose contact forms are not designed to carry protected health information, and most form vendors do not sign a Business Associate Agreement (BAA). The compliant approach is to keep the public form limited to appointment-request basics — the same information a patient would leave in a voicemail — and route anything clinical into a system that is explicitly HIPAA-covered.
splitforms stores submissions in row-level-secured Postgres and is GDPR-compliant, making it suitable for minimal appointment-request forms. But if your workflow requires collecting PHI online, you need a vendor that will sign a BAA for that data. Confirm your specific obligations with your compliance advisor. This guide is general information, not legal advice.
You don't need expensive software just to take requests
Practice-management suites like Epic, Cerner, and Athenahealth are essential for charting, e-prescribing, and billing. But the narrow task of "let a website visitor request an appointment and notify the front desk instantly" doesn't require a hospital-grade EHR. A hosted form backend handles it: the request hits your front-desk inbox and a dashboard within seconds, and you forward it into scheduling from there.
- Instant delivery — dedicated SMTP so requests reach the inbox, not spam.
- Team alerts — push each request to a shared Slack or Teams channel via Slack webhook or Teams webhook.
- AI spam filtering — keeps bot noise out of the front-desk queue without CAPTCHA.
- Free up to 500 requests/month — more than enough for most single-location clinics.
Copy-paste appointment-request form
Paste into your site and swap YOUR_ACCESS_KEY for the one from your free splitforms account. Note the deliberate absence of clinical and insurance fields.
<form action="https://splitforms.com/api/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
<input type="hidden" name="subject" value="New appointment request" />
<label>Full name<input type="text" name="name" required /></label>
<label>Phone<input type="tel" name="phone" required /></label>
<label>Email<input type="email" name="email" required /></label>
<label>Appointment type
<select name="appointment_type" required>
<option>New patient exam</option>
<option>Follow-up visit</option>
<option>Specialist consultation</option>
<option>Urgent / same-day</option>
<option>Annual physical</option>
<option>Other</option>
</select>
</label>
<label>Preferred location
<select name="location">
<option>Main clinic</option>
<option>North branch</option>
<option>South branch</option>
</select>
</label>
<label>Preferred days / times
<input type="text" name="preferred_times" placeholder="e.g. weekday mornings" />
</label>
<label>Brief reason for visit (no medical details please)
<textarea name="message" rows="3" placeholder="e.g. annual checkup, knee pain consultation"></textarea>
</label>
<!-- honeypot -->
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
<button type="submit">Request appointment</button>
</form>Want bookings in a spreadsheet too? Connect your form with Google Sheets without Zapier or Notion.
Mistakes that cost clinics patients
- Collecting PHI on a public form. Medical history and insurance numbers don't belong on a general website form. Keep them in a BAA-covered system.
- Relying on phone-only intake. Younger patients prefer to book online. A form captures requests 24/7, even when the front desk is closed or on lunch.
- No instant alert. A same-day appointment request seen three hours later is a lost patient. Push requests to a monitored channel.
- Deliverability you never tested. Submit your own form and confirm it lands. Why form emails go to spam.
- Using CAPTCHA. It frustrates patients on mobile and tanks completion rates. Use a honeypot plus AI spam filtering instead — see the comparison.
What to do next
- Get a free splitforms access key — 500 submissions/month, no credit card.
- Related: dental practice forms · school forms
- Add to your site: WordPress · Squarespace · Wix
- Privacy: GDPR-compliant form submissions
- Questions? Email hello@splitforms.com
FAQ
What fields should a clinic contact form include?
Keep the public website form focused on booking: patient name, phone, email, appointment type (new patient, follow-up, consultation, urgent), preferred days/times, and a brief reason for visit. Do not collect detailed medical history, medication lists, or insurance numbers on a public website form — those belong in a HIPAA-covered system with a signed Business Associate Agreement. The website form's job is to start the conversation, not to be the medical chart.
Is a website contact form HIPAA-compliant?
A plain website contact form is generally not the right place for protected health information (PHI), and most general-purpose form tools are not covered by a BAA. The safe pattern: use the website form only for basic appointment-request details and move anything clinical into a HIPAA-covered system. If you must collect PHI online, use a vendor that explicitly offers a BAA. This article is general guidance, not legal advice — confirm with your compliance advisor.
How much does a clinic contact form cost?
splitforms offers 500 submissions/month for free with no credit card required — more than enough for most single-location clinics. The Starter plan at $1/month adds signed webhooks for real-time alerts to your front desk. Pro is $5/month for 5,000 submissions, or $59 for a 3-year plan. Most competitors charge $10–$50/month for equivalent features.
How do I make sure appointment requests reach the front desk instantly?
Wire a splitforms webhook to your front-desk Slack, Microsoft Teams, or a phone SMS alert via Twilio. When a patient submits the form, the webhook fires within a second. The front desk sees the request immediately instead of discovering it in an inbox hours later. This is critical for clinics — patients who get a callback within 30 minutes are far more likely to keep the appointment.
Will the form work on my existing clinic website?
Yes. Whether your site is WordPress, Wix, Squarespace, or custom-built, you paste the HTML form and point it at the splitforms endpoint. No plugin or platform upgrade needed. The form uses native HTML input types so mobile patients get the right keyboard automatically — critical since 60–70% of healthcare searches happen on mobile.