The forms a therapy practice runs on

A practice produces a recurring set of documents, each with a different sensitivity level and a different right way to handle it.

Step by step — set up private client forms

1. Build a fillable intake form. Create a structured digital intake with the Patient Intake Formatter or a fillable form. Ask only for what you need — collecting less is itself a privacy safeguard.
2. Make consent and releases signable. Build informed-consent, telehealth-consent, and release-of-information forms as signable PDFs with form fields and the consent-form builder, then capture signatures with e-signature.
3. Deliver and collect securely. Send forms through a client portal, or as an encrypted PDF via Protect PDF with the password shared separately. Never email unencrypted mental-health forms.
4. Keep psychotherapy notes separate. Store private process notes apart from the shareable record, with restricted access, since they get heightened legal protection and generally require their own specific authorization to disclose.
5. Redact to the minimum necessary when sharing. When releasing records, use HIPAA Redact to truly remove anything outside the release’s scope, flatten, and verify; see how to redact properly.
6. Store, retain, and dispose by policy. Keep records encrypted at rest with access limited to those who need it, follow your state/board retention period, and dispose of electronic records so they are irretrievable. Document the policy.
7. Make forms accessible. Clear labels, logical tab order, and readable layout — see PDF accessibility — so every client can complete intake independently.

Related reading and tools

• PDF for healthcare (HIPAA): the broader patient-form privacy guide.
• Add fillable form fields: building intake and consent forms.
• Fillable PDF forms: the concepts behind interactive forms.
• Sign a PDF: capturing consent signatures.
• How to redact a PDF: removing details the right way.
• HIPAA Redact tool: permanently remove PHI in your browser.
• All ScoutMyTool PDF tools: the full toolkit.

FAQ

What makes therapy records more sensitive than general medical PDFs?

Mental-health information carries extra stigma and risk, and the law reflects that. Under HIPAA, "psychotherapy notes" — a therapist's private notes analysing a counseling session, kept separate from the rest of the record — get heightened protection: in most cases they may not be disclosed without the client's specific authorization, even for many purposes where ordinary records could be shared. Beyond HIPAA, many states add their own mental-health confidentiality protections. The practical implication for your PDFs is to treat intake forms, session notes, and anything naming a diagnosis as among the most sensitive documents you handle, and to keep private process notes separate from the shareable record.

Should clients fill out intake forms on paper or as a PDF?

A digital fillable PDF (or a portal form) is usually better for both privacy and practicality: the client types into a structured form, you receive legible answers, and you avoid a paper document sitting in a waiting room or getting scanned later. The privacy gain depends on delivery — send and receive the form through a secure channel (a client portal or an encrypted PDF), not plain email. Build the intake as a proper fillable form so fields are named and the data is usable, and include only the questions you actually need; collecting less sensitive information is itself a privacy safeguard.

How do I share an intake or consent form securely with a client?

The most secure option is a client portal that handles authentication and encryption for you. If you do not have one, a password-protected (encrypted) PDF is a reasonable alternative: send the form encrypted and share the password by a separate channel such as a phone call or text. Avoid sending an unencrypted form containing or soliciting mental-health information over plain email. For the return trip, the same rule applies — have clients submit through the portal or as an encrypted file rather than emailing a completed intake in the clear.

How should I handle a release of information (ROI) form?

A release should be specific and limited: name exactly who may receive information, what information, for what purpose, and an expiration date. Build it as a signable PDF so the client's authorization is captured and archived, and keep the signed copy in that client's file. When you then send records under the release, apply the minimum necessary — send only the documents and the portions the recipient is authorized to receive, redacting anything outside the scope. Remember that psychotherapy notes generally require their own separate, specific authorization and are not covered by a general records release.

How do I redact sensitive details when sharing a record?

Use true redaction that removes the underlying text, not a black box drawn over it that can be peeled off or copied out. Redact identifiers and any content outside the scope of what the recipient is authorized to see, then flatten the document so the redaction is permanent, and verify by trying to select or search the redacted text in the output. Also strip document metadata, which can carry the author name and edit history. Only ever distribute the flattened, verified copy, and keep the unredacted original in your secure file.

How long should I keep therapy records?

Retention is governed mainly by state law and your professional licensing board, and periods vary widely — commonly several years after the last session for adults, and longer for minors (often until some years past the age of majority). HIPAA separately requires retaining certain compliance documentation (privacy notices, authorizations, policies) for six years. Because the clinical-record period is set by your state and board rather than by HIPAA, check those specific requirements and document your retention-and-disposal policy. Dispose of electronic records so they are irretrievable, and remember that backups keep copies too.

Is it safe to use an online PDF tool for client forms?

Only if the tool processes files locally in your browser, or you have a Business Associate Agreement with the vendor. A cloud tool that uploads your intake forms and notes is acting as a business associate and would need a BAA before handling this data. ScoutMyTool runs its PDF operations client-side in your browser tab, so the client form never leaves your machine — appropriate for the especially sensitive material a therapy practice handles. Confirm any tool's data handling with your compliance resources before processing real client information.

Citations

1. NIST Special Publication 800-66 Revision 2 — “Implementing the HIPAA Security Rule.” csrc.nist.gov/pubs/sp/800/66/r2/final
2. CDC, Public Health Law — overview of HIPAA, including the Privacy Rule. cdc.gov — HIPAA overview
3. Wikipedia — “Health Insurance Portability and Accountability Act,” including the heightened protection for psychotherapy notes. en.wikipedia.org — HIPAA