On this pageJump to a section
Every field you add to an intake form costs you completions. Every script you add to the same page costs you something else.
The first cost shows up in your dashboard within a week. The second can show up years later in a letter from a regulator. Telehealth intake is the one place in the funnel where growth and compliance pull in opposite directions (the June court ruling on tracking did not change that, as I explained in my HIPAA pixel piece), and most clinics solve it by quietly ignoring one of them.
The cleanest forms I have seen share one trait: someone decided in advance which questions belong on a marketing page and which belong somewhere else. This is educational, not legal advice. Your attorney owns the legal questions.
Why do intake forms sit where conversion and compliance collide?
Because the form is both the sales page's last step and the first clinical record.
For a marketer, a form is a conversion event: more people finishing is better. For a clinician, a form is a medical intake: the information on it is sensitive. Both views are right, and they pull in opposite directions. Conversion wants fewer fields and fewer steps. Compliance wants care about what is collected, where it goes and who sees it.
The hidden third party
A page that collects information is also a page where scripts load. HHS describes tracking technologies as including cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts, and notes that many of them are not apparent to the user.1 The patient sees a form. Behind it, several companies may be receiving data.
- Ad clickLands on a marketing page
- Marketing stepName, email and state only
- Secure clinical intakeHealth history in an environment built for it
- Consent recordWhat was agreed, which text version, when
- Clinician reviewEligibility decided by a licensed clinician
How should you order the fields?
Easy first, sensitive last, and no field without a reason.
- Contact basics. Name and email. Small asks first, so the person starts moving.
- State of residence. Early, because it tells you whether you can serve them. It saves everyone's time.
- What brings them in, at a high level. A short choice, not a paragraph.
- Eligibility screeners. The questions that decide whether the service is appropriate.
- Detailed health history. Medications, conditions, allergies. This is the heaviest part, so earn it with the earlier steps.
- Consent and confirmation. Plain language, then submit.
Split the form, split the environment
Where you can, treat the marketing step and the clinical step as different places. The first step captures an interested person. The second step is a clinical intake inside an environment built for health information. I am not telling you which platform to use. I am telling you not to run a clinical questionnaire inside a page you also use to count ad conversions.
Ask only what you need
Every field should answer the question "what do we do with this?" If nobody can say, delete it. Fewer fields convert better in my experience, and fewer fields means less sensitive data to protect.
How do you capture consent properly?
With words a patient can understand and a record you can produce.
- Plain language. What you collect, why, who sees it and how to ask for deletion, in sentences a non-lawyer can read.
- An unchecked box. The patient ticks it. Pre-checked boxes are a bad look and a worse defense.
- Separate consents. Consent to treatment and communications is different from consent to marketing. Do not bundle them.
- A record. Store what was agreed, the version of the text and the time.
- A way out. Make withdrawing consent as easy as giving it.
Have your attorney review the actual wording. These are practices, not legal language.
What must never reach an ad platform?
Treat these as off-limits unless your counsel has confirmed a lawful basis in writing:
- Answers to health questions
- Medications, conditions and symptoms
- Appointment details
- Any pairing of an identifier, like an email, with the fact that someone is a patient or has a condition
HHS says that impermissible disclosures of protected health information can result in harms like discrimination, stigma and mental anguish, and describes sharing PHI with tracking vendors for marketing purposes without HIPAA-compliant authorization as impermissible.1
What does the enforcement record say?
That sharing health data with ad platforms has already cost companies real money.
| Company and date | What the FTC said |
|---|---|
| GoodRx, February 2023 | Shared prescription and health condition data with advertising companies and platforms, including Facebook, Google and Criteo. $1.5 million civil penalty and a permanent ban on sharing health data for ads. |
| BetterHelp, March 2023 | Gave Facebook email addresses and the fact that people had been in therapy to find similar users. $7.8 million and a ban on disclosing health information for advertising. |
| Cerebral, April 2024 | Complaint alleges sensitive information of nearly 3.2 million consumers went to LinkedIn, Snapchat and TikTok through tracking tools. Proposed order bans most advertising uses of personal and health data. |
The sources: the FTC's GoodRx announcement,2 its BetterHelp announcement3 and its Cerebral announcement.4 In April 2024, the FTC also finalized changes clarifying that its Health Breach Notification Rule covers health apps and similar technologies not covered by HIPAA, and that a breach includes unauthorized disclosures, not only hacks.5
How do you measure conversion without sending health data?
Measure completions in your own systems first.
Count form starts, step completions and submissions on your side, in a system you control. That gives you the numbers you need to improve the form: where people drop, which step loses the most. Whether to share anything at all with an ad platform, and in what form (the mechanics are in my Conversions API baseline), is a decision for you and your attorney to make deliberately, not something a default setting should make for you.
Review the page like a regulator would
Open the page, list every script that loads, and for each one ask what it receives. If you cannot answer, you are not ready to run ads to that page.
A form that converts by quietly sharing a patient's story is not a high-converting form. It is a liability with a thank-you page.
A pre-launch checklist
- List every field and justify each in one sentence.
- Confirm the order runs from easy to sensitive.
- Move the clinical questions to a secure environment.
- List every script and tag on every step of the form.
- Verify consent wording with your attorney.
- Test the full flow on a phone, since many patients will fill it out on one.
- Re-check quarterly.
If you want your funnel reviewed from ad to booking, I am easy to find. Legal sign-off belongs with your attorney.
Keep building.Ekai
Questions people ask
What should a telehealth intake form ask first?
Start with low-effort, low-sensitivity fields such as name, email and state of residence, then move to eligibility and, last, the health history. Place the clinical questions in a secure, appropriate environment rather than on a page loaded with marketing scripts.
Can I put the Meta Pixel on a telehealth intake form?
That is a legal question for your healthcare privacy attorney. HHS guidance and FTC enforcement actions show health data sent to ad platforms creates risk, so do not place advertising scripts on pages where patients enter health information without a confirmed legal basis.
What counts as health information on an intake form?
Answers about conditions, symptoms, medications, treatment goals and appointment details, and sometimes the mere fact that someone is a patient when paired with identifiers. When in doubt, treat it as sensitive.
How should I capture consent on a telehealth form?
Use clear, plain-language statements, an unchecked box the patient ticks themselves, separate consent for care and for marketing, and a record of what was agreed and when. Have your attorney review the wording.
Sources
- 1
- 2
- 3
- 4
- 5
