Appointment Request Forms: Short, Secure, Clear

Why less is better

Every extra field makes a form slower to fill in on a phone and adds to the information you are responsible for. Dental practices handle personal health information, and the privacy law that applies depends on the province. The Office of the Privacy Commissioner of Canada lists Ontario’s Personal Health Information Protection Act among the provincial health information laws deemed substantially similar to PIPEDA, alongside health laws in New Brunswick, Newfoundland and Labrador and Nova Scotia, and general private sector laws in Alberta, British Columbia and Quebec.¹ In Alberta, the privacy commissioner also lists dentists, dental hygienists and denturists as custodians under the Health Information Act.⁵

Whatever law applies to your practice, a simple principle helps: do not collect what you do not need. A request form does not need a date of birth, health card number, insurance details, medical history or a description of symptoms. Those can wait for a phone call or the first visit.

The fields we recommend

• First and last name.
• Phone number, email address or both, with a choice of how to be contacted.
• New or existing patient.
• Preferred location, for groups.
• Preferred days and times, as simple choices.
• An optional short note, with a reminder not to include health details.
• A consent line explaining how the information will be used, linked to the privacy notice.

Sending requests securely

Some form set-ups send each submission as plain email to a shared inbox. That may be acceptable for a name and phone number, but it is risky once health details creep in through a free-text box. In Ontario, the Information and Privacy Commissioner’s 2016 guidance on email expects health information custodians to use encrypted email for personal health information where feasible, to have an email policy, to obtain consent before sending unencrypted health information and to limit what goes into email in the first place, as summarized by law firm BLG.²

We set up forms so the website itself stores as little as possible, the connection is encrypted with HTTPS, and requests go to an address on your practice domain using authenticated mail. Where your practice software offers a secure request inbox, we route requests there instead. The written plan explains what each option means for your privacy procedures.

Keeping spam out without puzzles

Image puzzles and distorted text make forms harder for people with visual or cognitive disabilities. We use quieter checks: a hidden field that only bots complete, a minimum time before submission, a signed timestamp, a token tied to the browser session and limits on how often one connection can send. Real patients never see them.

Accessible by design

Each field has a visible label, errors are explained in text next to the field, the form works with a keyboard alone and the submit button is large enough to tap easily. WCAG 2.2 sets a minimum target size of 24 by 24 CSS pixels in success criterion 2.5.8, and we go larger for the main button.⁴

After the form is sent

Patients should know what happens next. The confirmation message says when the practice will call back, during which hours, and what to do in an emergency. A copy of the request is not emailed back to the patient by default, because that would send their information again over a channel you do not control.

Follow-up messages and CASL

If you plan to send recall reminders or newsletters by email or text, Canada’s Anti-Spam Legislation applies to commercial messages. The CRTC explains that express consent must be obtained through an opt-in mechanism and that each message must identify the sender and include an unsubscribe mechanism.³ A request form can include an optional, unticked box for newsletters, kept separate from the appointment request itself. Our CASL guide covers this in more detail.

What you receive

• A form with the recommended fields, adapted to your practice and locations.
• Secure delivery to your practice domain or practice software.
• Spam protection without puzzles.
• A plain-language privacy notice section for the form, for your review with your privacy advisor.
• Testing on desktop, phone and keyboard-only use.

Testing before launch

Before a form goes live, we test it end to end: a normal request, an incomplete one, an invalid email address, a very long message, a submission from a phone and one using only a keyboard. We confirm that the request arrives at the right inbox, that the confirmation message is clear and that spam checks do not block real patients. After launch, we recommend sending a test request each month to make sure delivery still works.

Frequently asked questions

Can the form connect to our practice management software?

Sometimes. Some dental software offers online booking or request widgets that can be embedded. Others accept requests by secure email only. We check what your software supports and recommend the simplest secure option.

Should patients describe their symptoms in the form?

We recommend not asking. A request form only needs enough to call the patient back. Clinical details are better discussed by phone or at the appointment, where your team can handle them under your privacy procedures.

How do you stop spam?

With invisible checks that do not bother real patients: a hidden field that bots fill in, a minimum time before a form can be sent, a signed token and rate limits per connection. We avoid puzzles that make the form harder for people with disabilities.

Sources

1. Office of the Privacy Commissioner of Canada: Provincial laws that may apply instead of PIPEDA Regulator
2. BLG: IPC releases guidance on communicating PHI by email (15 September 2016) Secondary source (law firm summary of IPC Ontario guidance)
3. CRTC: Canada’s Anti-Spam Legislation guidance on implied consent Regulator
4. W3C: Web Content Accessibility Guidelines (WCAG) 2.2 Standard
5. Office of the Information and Privacy Commissioner of Alberta: Health Information Act (HIA) overview Regulator

Checked on 29 October 2026. Rules change, so confirm the current version with the regulator before you publish.