HIPAA-safe intake forms for therapists

The idea

Form builders are commodity — the crowd said as much about a $29/mo incumbent — but therapists cannot use most of them, because a form that collects mental-health history is PHI and demands a BAA. The compliant option among general builders starts at $39+/mo for a blank-canvas tool that knows nothing about therapy, leaving a solo practitioner to reinvent an informed-consent form from an empty grid.

The wedge is that private practice needs exactly five forms, and they are the same five everywhere: intake, consent, insurance, release of information, card authorization. Ship them pre-built and editable, add e-signature with a real audit trail and insurance-card photo capture, include the BAA in the price, and charge $19/mo. It wins on price against the compliant generalist and wins harder on speaking the buyer’s language — the product is set up before their first coffee refill.

Who pays

The buyer is the solo or small-group private-practice therapist — a huge, reachable population that handles its own admin and already pays for a handful of $10-30/mo tools. $19/mo flat with the BAA included removes both the price and the compliance-anxiety objection. Distribute through therapist Facebook groups and subreddits, practice-building podcasts and consultants, and SEO on HIPAA-compliant intake form searches, which convert with strong intent.

MVP scope

• Five pre-built, editable therapy forms provisioned at signup
• Single secure client link with mobile save-and-resume and 30-day expiry
• E-signature with timestamp, IP, and document-hash audit trail; PDF packet rendering
• Insurance card photo upload with KMS-encrypted storage
• Click-through BAA at checkout and per-client status dashboard with reminders
• Skip for v1: insurance card OCR, EHR integrations (SimplePractice export later), recurring outcome measures (PHQ-9/GAD-7), multi-clinician practices

Build IntakeWell, HIPAA-compliant intake forms for private-practice therapists. Stack: Next.js (App Router) on AWS (not Vercel — keep PHI inside a signed-BAA boundary), Postgres on RDS with field-level encryption using AWS KMS envelope encryption, S3 with KMS for uploads, Stripe for billing.

Template-first, not builder-first: onboarding asks for practice name, logo, and state, then provisions the five forms every practice needs — client intake (history, medications, emergency contact), informed consent with telehealth addendum, insurance information with card photo upload (front/back), release of information, and credit card authorization. Each is editable — toggle sections, edit wording, add custom questions — but never starts blank.

Therapist shares a single secure link; client completes all assigned forms in one mobile-friendly session with save-and-resume, and signs each with a drawn or typed e-signature captured with timestamp, IP, and document hash for an ESIGN-compliant audit trail. Therapist dashboard shows per-client status (sent, started, completed), rendered PDFs of completed packets, and reminder nudges via email.

Non-obvious details: encrypt PHI fields client-side of the database layer with per-tenant KMS data keys so a DB leak exposes ciphertext; auto-expire form links after 30 days; sign a BAA with every paying customer at checkout as a click-through document, and only use subprocessors that offer BAAs.

Pricing: $19/mo flat, unlimited clients and forms, BAA included. 30-day trial, no free tier (PHI liability).