This article is general information, not legal advice. Talk to your compliance advisor about how privacy rules apply to your practice.
The most common privacy problem at a dental or medical front desk isn’t a hacked server. It’s a clipboard.
Picture a sign-in sheet with columns for name, time, reason for visit and date of birth, sitting on an open counter. Every patient who signs in can read every line above theirs. In a general dental practice, that’s uncomfortable. In a mental health, fertility or addiction practice, a single line can say far more than the patient ever agreed to share.
I build frontkiosk, a visitor sign-in system, and some of our hardest design arguments were about fields we refused to add. This is what I learned about what a front-desk sign-in should ask, what it should never ask, and why visitor sign-in and patient intake are different jobs.
Sign-in sheets aren’t banned. Careless ones are the problem.
A common misconception is that HIPAA forbids sign-in sheets. It doesn’t. Guides from compliance specialists explain that sign-in sheets are allowed when they’re limited to the minimum necessary information and the practice uses reasonable safeguards to protect them (Accountable). A patient glancing at another name can count as an “incidental disclosure”, but only if the practice has taken reasonable steps to prevent it (Curogram).
So the question isn’t “paper or no paper.” It’s two questions:
- What are you asking people to write down?
- Who else can see it?
Dental suppliers already sell peel-off and tear-off sheets marketed for this purpose (Benco), which tells you practices know the open clipboard is a problem and are already paying to fix it.
What a front-desk sign-in should never ask
The Accountable guide lists the details that don’t belong on a sign-in sheet (Accountable). Grouped the way I think about them:
Clinical details. Reason for visit, symptoms, diagnosis, procedure names, medications, test names. “Root canal follow-up” or “pregnancy test” on a shared sheet is the clearest example of saying too much.
Identifiers. Full date of birth, home address, phone number, email address, insurance or member ID, medical record number, Social Security number, driver’s license number.
Financial details. Copay amounts, card details, balances.
Anything that hints at status. Labels like “pre-op” or the name of a specialty clinic can reveal a condition on their own.
The common thread: the sign-in has one job, which is noting that someone arrived and who they’re here to see. Curogram’s guide puts it the same way. Under the minimum necessary standard, check-in usually needs a name and maybe an arrival time, and adding reason for visit, birth date or insurance details to a shared line breaks that standard (Curogram). Everything else belongs in a private conversation at the desk, in a patient portal, or in your practice management system.
What a sign-in can reasonably ask
For most offices, this is enough:
- Name. Some practices use first name and last initial. The Accountable guide suggests that format, or the full name if your risk analysis supports it.
- Arrival time.
- Who they’re seeing, or which department.
If you can’t explain why a field is on the form, take it off. Every extra field is personal data you then have to protect, store and eventually dispose of.
“Minimum necessary” became a product rule
When we designed frontkiosk’s sign-in, we kept getting requests to add “just one more” field: reason for visit, date of birth, insurance carrier. Each request made sense on its own. Someone wanted the front desk to be ready, or wanted a record for later.
We said no to all three. The reasoning was simple. A screen at reception is a public surface. Anything a visitor types there is information you’re now responsible for, collected in the least private spot in the building. If the practice genuinely needs that information, it should collect it somewhere built for that purpose, with the right agreements and controls in place. So frontkiosk is built to collect the minimum: who you are, who you’re here to see, and when you arrived.
A visitor kiosk is not patient intake
This is the distinction I wish more vendors made clearly. A dental or medical office has two very different groups of people walking through the front door:
- Patients, whose arrival is itself health information, and whose intake involves medical history, insurance and consent forms.
- Everyone else: pharmaceutical and supply reps, contractors, IT technicians, couriers, job candidates, family members waiting for a patient.
A visitor sign-in system is for the second group. It answers “who is in the building who doesn’t work here?” Patient check-in and intake belong in tools designed for protected health information, which generally means a vendor willing to sign a Business Associate Agreement and provide the safeguards that go with it.
Vendors in the visitor management category say this openly. Greetly’s healthcare page, for example, says its product is not HIPAA compliant and shouldn’t be used to store PHI (Greetly). That’s an honest line, and a good model. If a visitor system isn’t built and contracted for PHI, don’t put PHI in it.
In practice, that means keeping reps and contractors on the visitor kiosk, keeping patients on your practice’s own check-in process, and not mixing the two on the same sheet.
Each visitor should see only their own screen
The other half of the problem is visibility. Even a minimal sign-in leaks information if the next person can read it.
For paper, that means tear-off strips, peel-off labels, or a cover sheet so only the current line is visible, and putting completed sheets away immediately (Accountable).
For a tablet, it means the screen should reset after each sign-in, and it should never show a list of earlier visitors or suggest names as someone types. That last point is easy to overlook. Security researchers have shown how public check-in screens can leak information. One researcher described using a lobby check-in’s host search to pull a list of 1,642 employee names (Charlie Kelly), and IBM X-Force found flaws in five visitor management systems (Wired). A screen that strangers touch should reveal as little as possible about the people who used it before them, and about your staff.
Keep it only as long as you need it
Whatever you collect, decide how long you keep it and how you dispose of it. Old paper sheets should be stored securely and shredded on schedule, not left in a box under the desk. For digital logs, know where the data lives, who can see it, and how it gets deleted or exported when you no longer need it. Check your retention period with your advisor rather than copying a number from a blog post.
A quick front-desk privacy check
- Read your current sign-in form. Remove every field that isn’t name, time or who they’re seeing.
- Stand where a patient stands. Can you read anyone else’s entry?
- Separate visitors (reps, contractors, couriers) from patient check-in.
- Make sure no screen suggests staff or visitor names to the public.
- Write down how long you keep sign-in records and who disposes of them.
See a minimal sign-in
If you want to see what a sign-in built to collect the minimum looks like, there’s a short demo of frontkiosk at frontkiosk.net/demo. It shows a visitor signing in, the host email, the badge and the who’s-on-site list. It’s a quick way to compare against whatever your front desk uses today.
frontkiosk is a paid product: $29 per location per month, or a one-time $250 lifetime plan for one location. Full details are in the pricing section.