Hipaa compliant intake forms: Intake Compliance Rules
The Intake Compliance Rules carries 8 published figures read from 3 sources' own pages, from 30 to 90 day, read 17 October 2026.
Clipboardo sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
- 330 to 40
- 40 to 50
- 50 to 60
- 360 to 70
- 70 to 80
- 280 to 90
Bands
| Bucket | Value |
|---|---|
| 30 to 40 | 3 sources |
| 40 to 50 | 0 sources |
| 50 to 60 | 0 sources |
| 60 to 70 | 3 sources |
| 70 to 80 | 0 sources |
| 80 to 90 | 2 sources |
3 of the 14 named sources read in full publish a figure; 11 publish none, read 17 October 2026.
By requirement
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| requirementbreach notice posting | 90day | 90 to 90day | 1 |
| requirementbreach toll-free line | 90day | 90 to 90day | 1 |
| requirementrevised privacy notice | 60day | 60 to 60day | 2 |
| requirementact on an access request | 30day | 30 to 30day | 1 |
| requirementact on an amendment request | 60day | 60 to 60day | 1 |
| requirementopt-out request | 30day | 30 to 30day | 1 |
| requirementdo-not-call list version | 31day | 31 to 31day | 1 |
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| eCFR 45 CFR part 164 - security and privacy | 90day | breach notice posting | 2026-10-17 |
| eCFR 45 CFR part 164 - security and privacy | 90day | breach toll-free line | 2026-10-17 |
| eCFR 45 CFR part 164 - security and privacy | 60day | revised privacy notice | 2026-10-17 |
| eCFR 45 CFR part 164 - security and privacy | 60day | act on an amendment request | 2026-10-17 |
| eCFR 45 CFR 164.520 - notice of privacy practices | 60day | revised privacy notice | 2026-10-17 |
| eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation | 31day | do-not-call list version | 2026-10-17 |
| eCFR 45 CFR part 164 - security and privacy | 30day | act on an access request | 2026-10-17 |
| eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation | 30day | opt-out request | 2026-10-17 |
The sentence each figure was read from (8)
- eCFR 45 CFR part 164 - security and privacy, read 2026-10-17:
(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and
- eCFR 45 CFR part 164 - security and privacy, read 2026-10-17:
(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.
- eCFR 45 CFR part 164 - security and privacy, read 2026-10-17:
(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.
- eCFR 45 CFR part 164 - security and privacy, read 2026-10-17:
(i) The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request, as follows.
- eCFR 45 CFR 164.520 - notice of privacy practices, read 2026-10-17:
(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.
- eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation, read 2026-10-17:
It uses a process to prevent telephone solicitations to any telephone number on any list established pursuant to the do-not-call rules, employing a version of the national do-not-call registry obtained from the administrator of the registry no more than 31 days prior to the date any call is made, and maintains records documenting this process.
- eCFR 45 CFR part 164 - security and privacy, read 2026-10-17:
(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.
- eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation, read 2026-10-17:
(B) The notice states that the recipient may make a request to the sender of the advertisement not to send any future advertisements to a telephone facsimile machine or machines and that failure to comply, within 30 days, with such a request meeting the requirements under paragraph (a)(4)(v) of this section is unlawful;
Read in full, publishes no figure
11 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- HHS - HIPAA for professionals, the Privacy Rule, read 2026-09-12: read in full and no accepted figure on the page
- HHS - model notices of privacy practices, read 2026-10-10: read in full and no accepted figure on the page
- HHS - sample business associate agreement provisions, read 2026-09-12: read in full and no accepted figure on the page
- HHS - HIPAA Security Rule, read 2026-10-10: read in full and no accepted figure on the page
- FTC - Telemarketing Sales Rule, read 2026-10-17: read in full and no accepted figure on the page
- ESIGN Act, Public Law 106-229, read 2026-09-12: every candidate on the page was refused
- FCC - stop unwanted robocalls and texts, read 2026-10-10: read in full and no accepted figure on the page
- ABA - Model Rules of Professional Conduct, conflict of interest (current clients), read 2026-10-10: read in full and no accepted figure on the page
- ABA - Model Rule 1.18, duties to prospective clients, read 2026-10-10: read in full and no accepted figure on the page
- ICO - lawful basis: consent, read 2026-10-17: read in full and no accepted figure on the page
- eCFR 45 CFR 164.502 - uses and disclosures, general rules, read 2026-10-17: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 14 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 8 figures, never sentences; 22 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per obligation x per regime: what the rule requires of an intake specifically (the notice that must be given, the consent that must be obtained and in what form, the agreement that must exist with the vendor, the record that must be kept and for how long, the screen that must be run before a matter opens), the citation, the penalty band, and the date last amended.
The derivation is the CHECKLIST no regulator publishes: the union of what a single electronic intake form must satisfy when it is simultaneously a HIPAA disclosure, an e-signature, a marketing consent and, for a law firm, a Rule 1.18 exposure - and the state-by-state divergence where a bar has adopted the model rule with changes.
22 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (16)
- HHS - HIPAA for professionals, the Privacy Rule(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR part 164 - security and privacy(the publisher's own terms; quoted for reporting and comment)
- HHS - model notices of privacy practices(the publisher's own terms; quoted for reporting and comment)
- HHS - sample business associate agreement provisions(the publisher's own terms; quoted for reporting and comment)
- HHS - HIPAA Security Rule(the publisher's own terms; quoted for reporting and comment)
- eCFR 47 CFR 64.1200 - TCPA restrictions on telephone solicitation(the publisher's own terms; quoted for reporting and comment)
- FTC - Telemarketing Sales Rule(the publisher's own terms; quoted for reporting and comment)
- ESIGN Act, Public Law 106-229(the publisher's own terms; quoted for reporting and comment)
- FCC - stop unwanted robocalls and texts(the publisher's own terms; quoted for reporting and comment)
- ABA - Model Rules of Professional Conduct, conflict of interest (current clients)(the publisher's own terms; quoted for reporting and comment)
- ABA - Model Rule 1.18, duties to prospective clients(the publisher's own terms; quoted for reporting and comment)
- ABA Formal Opinion 510(the publisher's own terms; quoted for reporting and comment)
- ICO - lawful basis: consent(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.520 - notice of privacy practices(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.502 - uses and disclosures, general rules(the publisher's own terms; quoted for reporting and comment)
- americanbar.org(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Intake Compliance Rules carries 8 published figures read from 3 sources' own pages, from 30 to 90 day, read 17 October 2026.
3 of the 14 named sources read in full publish a figure; 11 publish none, read 17 October 2026.
Intake Compliance Rules, requirement breach notice posting: median 90 day across 1 source, read 17 October 2026.
Intake Compliance Rules, requirement breach toll-free line: median 90 day across 1 source, read 17 October 2026.
Intake Compliance Rules, requirement revised privacy notice: median 60 day across 2 sources, read 17 October 2026.
Intake Compliance Rules, requirement act on an access request: median 30 day across 1 source, read 17 October 2026.
Intake Compliance Rules, requirement act on an amendment request: median 60 day across 1 source, read 17 October 2026.
Intake Compliance Rules, requirement opt-out request: median 30 day across 1 source, read 17 October 2026.
Intake Compliance Rules, requirement do-not-call list version: median 31 day across 1 source, read 17 October 2026.
Cite as: "Clipboardo Intake Compliance Rules", updated 2026-10-18, https://clipboardo.com/datasets/intake-compliance-rules/.
Download the CSV (8 rows, computed 2026-10-18)