QR Codes for Healthcare: Intake, Surveys, HIPAA Rules

QR codes in healthcare work when the code holds only a link and the page behind it does the protecting. A code on an appointment card or a reception tent card can open an intake form, a survey, a medication guide or directions, and none of that is protected health information as long as nothing about the patient is inside the pattern. Here is what can go behind the code, what HIPAA asks of the page, and the print size.

The short version

The code is public. Anyone who picks up the paper can read what is inside it with a camera or an online QR scanner. So the pattern holds a link, never a name, a date of birth, a result or a prescription.

The page behind the link is where HIPAA applies. An intake form or a portal that handles patient data has to run on a platform that is a business associate of the practice, with the written safeguards the HIPAA Privacy Rule requires in that contract.

Print the address under the code. A patient who cannot scan can type it, a patient who is wary can read the domain first, and an auditor can check it without a phone.

Make the intake and survey codes dynamic, the rest static. The form platform may change; the practice website will not. On QRCodePrime, static QR codes are unlimited and free with no account, and every free account includes 10 dynamic QR codes, free for life, with scan analytics. No credit card required, no watermarks, and no ads on the site or on the redirect. A static code for the practice website never expires, as the QR code expiry guide explains.

What can go behind a healthcare QR code

The test is whether the destination shows anything about one patient. If it does not, the code is a link like any other. If it does, the page needs a login and a platform under a business associate agreement.

The bottom two rows are the ones that cause trouble. A text QR code or a contact card QR code carries its content inside the pattern, so a discharge sheet with a patient's details encoded on it is a disclosure to whoever scans it. The plain text versus SMS code guide explains what those code types hold.

Patient intake before the visit

An intake code opens the practice's form so the patient fills it in on their own phone, at home or in the waiting room, instead of on a clipboard that someone retypes. The code holds the form's link and nothing else. It goes in the appointment confirmation email, on the appointment card, and on a tent card at reception for people who arrive without having done it.

Two decisions matter. First, the form has to live on a platform that can hold protected health information: HHS gives, as an example of a business associate, a "Vendor that offers a personal health record to individuals on behalf of a covered entity." and an app developer that handles patients' data on a practice's behalf. Ask the form vendor for its business associate agreement before the code is printed. Second, make the code a URL QR code in dynamic mode, because the practice may change form vendors long before the appointment cards run out. The printed pattern then holds a short link on qrcodeprime.com, and the destination is edited in the dashboard; the dynamic code editing guide shows the steps.

Appointment reminders and the front desk

A reminder that carries a code can do one thing the text alone cannot: open the right page with nothing to type. A code that opens the booking page lets a patient reschedule; a phone QR code on a printed card dials the office. In a text message a phone code is pointless, because the number is already tappable, so use codes on paper and plain links on screens. A vCard QR code on the appointment card saves the practice's number and address to the patient's contacts in one scan.

If the practice would rather the patient confirm by text, a code that opens a pre-written message is a different tool again, and the plain text versus SMS guide explains which to choose. Whatever the code opens, keep the patient's name and appointment details out of the pattern; the reminder card already has them printed for the person holding it.

Satisfaction surveys after the visit

A survey code on the discharge sheet opens a short form the patient can fill in before leaving. Keep the questions about the visit and not about the person, so the survey needs no login and the code can stay public. Print the survey's address under the code for the patient who answers later from a computer.

Whether a code on the discharge sheet collects more responses than an emailed survey is something a practice can measure with its own numbers: a dynamic code counts scans, and the survey tool counts submissions. No general figure is given here because none was found with a source behind it.

Medication guides and pharmacy codes

A code on a prescription bag or an information sheet can open the general guide for that medication, a video on how to use an inhaler, or the refill page. All of those are written for every patient, so the code is a plain link. What does not belong in the code is the patient's name, the drug name joined to the patient, or anything else that pairs a person with a prescription; the label already carries that for the person holding it, and the code should point at a resource anyone could read.

What HIPAA asks of the page behind the code

HIPAA does not mention QR codes. It governs what happens to individually identifiable health information, so the questions are about the destination and the vendor behind it. The HHS summary of the Privacy Rule defines the vendor side: "In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information." The same summary states what the contract has to do: "In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates."

HHS's business associate FAQ adds that "A business associate is also directly liable for complying with certain provisions of the HIPAA Rules." For the electronic side, the HHS summary of the Security Rule says that "The Security Rule requires regulated entities to implement reasonable and appropriate administrative, physical, and technical safeguards for protecting ePHI." In practice, for a printed code, that comes down to four checks: the destination uses https; any page that shows or collects patient data sits behind a login; the vendor has signed a business associate agreement; and the code's own scan analytics are reviewed like any other web log. A QRCodePrime dynamic code records, for each scan, the time, the country and city reported by the network, the device type, the browser and the network address. Nothing a patient types on the form passes through the code; a practice that treats network addresses as identifiers should review that log the way it reviews its web server logs.

Directions inside a hospital

A code at the entrance or on the appointment letter can open a map pin or a route to the right building, which is the kind of thing a patient reads on the way rather than types. A Google Maps link in a URL code does it, and the Google Maps QR code guide explains which link to paste so the scan opens the pin or the directions. Keep the printed signs; the code is an addition for the people who prefer it. For a campus with one street address and several buildings, the address QR code guide shows how to encode the exact spot instead of the address.

Patients who will not scan

Smartphone ownership is high, and it is not universal. Pew Research Center's 2026 mobile fact sheet reports that "About nine-in-ten (91%) own a smartphone, up from just 35% in the Center's first survey of smartphone ownership conducted in 2011.", and its table by age puts smartphone ownership among adults 65 and older at 79 percent. A practice with an older panel is therefore planning for roughly one patient in five without a smartphone at all, plus the ones who own one and do not scan.

Three things cover them. Print the destination address under every code in type large enough to read at arm's length, so the patient can type it on any device or ask a family member to. Keep the paper form available, so the code is a shortcut and not a gate. And let the front desk help with the scan when asked; a receptionist who can show where the camera is removes most of the hesitation. The QR code scams guide explains why a printed address also protects patients: it lets them read the domain before they open anything.

How big to print a healthcare QR code

The smallest readable print depends on how many squares the code has, and that depends on what is inside it. The floors below follow Denso Wave's guidance of four printer dots per square at 300 dpi and a four square margin, computed with the same library the generator uses at its error correction level. Denso Wave states that "QR Code requires a four-module wide margin at all sides of a symbol."

Those are floors for a code held in the hand. A sign read from a chair or across a waiting room needs to be several times larger, and the print test guide explains how to check a real print from the real distance. The free generator exports SVG, which scales to any size without blur.

Common healthcare QR code mistakes

Protected health information inside the pattern. A text or vCard code with a patient's details, or a link that opens a result without a login. Treat the code like a notice on the waiting room wall.

A form vendor with no business associate agreement. The code is fine; the destination is not. Ask for the agreement before printing.

A portal login nobody can get through. If the scan lands on a login the patient set up years ago, the front desk ends up resetting passwords. For a one-off task such as intake, a form that needs no account is the shorter path, on a platform that can hold the data.

No address under the code. The patient who cannot scan has nothing to type, and the wary patient has nothing to check.

Linking to a PDF. A PDF on a phone is a pinch-and-zoom exercise at the moment a patient is least able to focus. Link to a page built for a phone and keep the PDF on the portal for people who want to print.

A static code for a form platform that will change. The dynamic version costs nothing on QRCodePrime and saves a reprint of every appointment card. The static versus dynamic comparison has the trade-off. When a printed code already lands on an error page, the expired QR code guide shows how to find the cause from the address inside it.

The healthcare page shows the code types side by side, and the FAQ answers the general questions about what a code can hold.

Sources

• HHS: Summary of the HIPAA Privacy Rule (business associate definition and contract requirements)
• HHS: Business Associates Frequently Asked Questions (examples and direct liability)
• HHS: Summary of the HIPAA Security Rule (safeguards for electronic protected health information)
• Pew Research Center: Americans' Use of Mobile Devices in 2026 (smartphone ownership overall and by age)
• Denso Wave: Point for determining the code area (module size and the four-module margin)