Ten minutes of the visit go to filling out a paper form while standing at the front desk, and the patient's questions about the procedure come up on the chair, squeezed between the doctor's other questions. A clinic that wants to change this quickly runs into the question of where convenient paperwork ends and something that can never be handed to a form begins.
This page sorts that out into specifics: what a patient has the right to know before a visit, when consent has to be in writing versus when spoken consent is enough, what can realistically move to an online form, and why data in that form needs different handling than an ordinary contact form.
The patient's right to accessible information before a visit
Before the question of consent comes up, the patient has a right to information. Poland's Patient Rights Ombudsman states it directly: a patient has the right to receive accessible information from the doctor about their state of health, diagnosis, proposed and possible diagnostic and treatment methods, the foreseeable consequences of using or not using them, the results of treatment, and the prognosis.
This is information the doctor delivers, not text on a website or a field in a form. An online form can prepare the ground — collecting questions the patient wants to ask, or pointing to a general description of the procedure — but it doesn't replace the actual conversation about a person's health and treatment methods.
What accessible information covers
- the diagnosis and the patient's state of health,
- proposed and possible diagnostic and treatment methods,
- the foreseeable consequences of using or not using those methods,
- treatment results and prognosis.
When consent has to be in writing, and when spoken consent is enough
The second pillar is consent to the service itself. Poland's Patient Rights Ombudsman states that a patient has the right to consent to health services or refuse them, after receiving prior information — and the form that consent takes depends on the type of service.
A surgical procedure or a method with higher risk
For a surgical procedure, or a treatment or diagnostic method that creates higher risk for the patient, consent must be given in writing. That's an unambiguous requirement for form — a ticked box on a form filled out the night before at home doesn't satisfy it.
Every other situation
In every other situation, consent or refusal can be given verbally. That leaves the clinic and the doctor room to decide how that conversation happens — but it doesn't remove the duty to provide the information itself before the procedure. Which specific procedures at a given clinic count as higher risk is a call for the doctor, and a lawyer where it's unclear.
What can reasonably move online, and what stays in the clinic
Separating what can be prepared in advance from what needs the doctor present simplifies the whole process for both sides.
| What | Where | Why |
|---|---|---|
| Health history (allergies, medication, past procedures) | online, before the visit | it's facts, not a clinical decision |
| Contact details and appointment time | online, before the visit | doesn't need the doctor present |
| General information on preparing for the visit | online, before the visit | the same text for every patient |
| Information on diagnosis and treatment methods | only at the clinic | depends on the specific patient and exam |
| Consent to a higher-risk procedure | only at the clinic, in writing | a form requirement following a conversation with the doctor |
Before a clinic plans a full medical questionnaire online, it's worth checking whether the simplest contact form even works — without that, a patient won't reach the first step at all.
Data in the form is a special category — minimisation and access
A medical form isn't an ordinary contact form. UODO points out that medical data qualifies as a special category of personal data under GDPR article 9, and it often reveals much more about a person than a single field suggests on its own.
That translates into concrete rules: a pre-visit form collects only the fields actually needed before admitting the patient, not everything that might theoretically be useful. Data sent from the form to the clinic's system should be encrypted in transit, and access to it limited to the people actually treating that patient, not the whole reception staff.
How not to turn a form into "consent by default"
The biggest trap when moving a questionnaire online is the temptation to add a pre-ticked box reading "I have read and consent to the procedure." That box replaces nothing — consent to a higher-risk procedure requires written form after a conversation with the doctor, not a checkbox ticked at home before the visit.
An online form can collect consent to processing personal data in connection with the form itself — that's a separate, narrower consent, unrelated to the procedure. The two get mixed up most often when one checkbox tries to cover both topics at once; splitting them into two separate fields, each with its own description, removes that risk.
Where the filled-out form ends up: storage and the patient record
A questionnaire filled out online before the visit should go straight into the patient's record in the clinic's system, not sit in a separate reception inbox that someone later re-types by hand. Manual re-entry is an extra step where data can get lost or land in the wrong record when two patients share a similar name.
Who has access to the completed form, how long it's kept, and when it gets deleted are questions a clinic should have answers to before launching the form — ideally settled together with whoever is responsible for data at the practice.
How much time an online form actually saves
Moving part of the questionnaire online isn't a legal requirement in itself — it's an organisational decision worth calculating before making it.
This is an illustrative example with assumed figures — substitute your own: with 14 patients a day, each saving an average of 6 minutes thanks to filling out the health history before arriving, the clinic recovers 14 × 6 = 84 minutes a day of reception and chair time that used to go into writing out the same fields on paper.
Those 84 minutes are calculated for one specific example, not a guaranteed outcome of every rollout — the actual saving depends on how many fields the current paper form has and how many patients actually fill in the form before arriving.
Do it yourself: split the form into "before the visit" and "at the clinic"
Take the current paper form and sort every field into two columns: "can be filled out before the visit" and "needs the doctor present." Health history, contact details and questions about past procedures go in the first column; consent to a specific procedure and the conversation about treatment method go in the second.
Remove fields from the form that nobody ever reads or uses — if a field exists "just in case," it's a good candidate for removal under the data minimisation principle. Add a short preparation text to the online version: what to eat, what to avoid, what time to arrive — the same text for every patient, with no individual arrangements.
What it looks like when a system runs the preparation for a visit
Once the appointment is booked, a system can run the rest of the preparation on its own, leaving the conversation and the consent exactly where they have to stay — with the doctor.
- 01appointment booked
- →02link to the form
- →03data in the record
- →04reminder to prepare
- →05conversation with the doctor
In this scenario the system doesn't assess the patient's state of health and doesn't replace consent to a procedure — it only carries what can actually be carried: the health history, contact details, and an appointment reminder.
A multi-step form where questions depend on earlier answers instead of one long list of fields is a job for Lead forms. Booking the appointment itself and keeping track of open slots is run by Booking Systems, while the reminder to prepare and about the visit goes out through Automatic messages. The completed form lands straight in one patient record thanks to Customer Data, and the whole thing — from booking to reminder — ties together through CRM and automations. A clinic website that guides a patient step by step from search to a booked appointment is what Websites and stores builds.
Where the data moving through these automations physically ends up is a separate topic, covered in our article on automation and GDPR. A similar mechanism — one queue instead of scattered requests across several channels — works outside the clinic too, as shown in our article on query handling automation. What a system can take over, and what always stays with a person, is laid out more broadly in our article on process automation in a company, and where to start such a rollout step by step is covered in our article on four automation thresholds.
Frequently asked questions
Can a patient's health questionnaire be moved online entirely?
The history itself — allergies, current medication, past procedures — yes, since that's collecting facts, not a clinical decision. Information about the diagnosis, treatment methods, and consent to a specific procedure stay with the conversation with the doctor at the clinic.
Does a checkbox on an online form replace written consent to a procedure?
No. For a surgical procedure or a higher-risk method, consent must be given in writing, after a conversation with the doctor — a ticked box on a form filled out at home before the visit doesn't meet that requirement.
Does consent have to be in writing in other cases too?
Not always — in situations that aren't a surgical procedure or a higher-risk method, consent or refusal can be given verbally. Which procedures at a specific clinic count as higher risk is decided by the doctor.
Which fields on an online form are safe from a GDPR standpoint?
The ones actually needed before admitting the patient — medical data is a special category of personal data, so the form should collect the minimum fields, send them over an encrypted connection, and limit access to the people treating that specific patient.
What happens to a completed form after it's submitted?
It should go straight into the patient's record in the clinic's system, without manual re-entry from a separate mailbox. Who has access to it and how long it's kept are things the clinic should settle before launching the form.
Does an online form release the doctor from providing information before the procedure?
No. A form can collect the health history and the patient's questions in advance, but accessible information about health status, treatment methods and prognosis is delivered by the doctor in person, not by text in a form.