Skip to main content
Business Associate Agreement available

HIPAA-Compliant Clinical Assessments

260+ validated clinical assessments built for US practitioners. DSM-5 aligned ADHD assessments, standardized screening tools, and outcome measures — all with instant scoring, US data residency, and neurodivergent-friendly design.

US Data Residency
AES-256 Encryption
Business Associate Agreement
Free to Start
Start Free — No Credit CardBrowse All Assessments

Built for HIPAA Compliance

ClientForms implements the administrative, physical, and technical safeguards required by the HIPAA Security Rule to protect your patients' health information.

Technical Safeguards

AES-256 encryption at rest, TLS 1.2+ in transit, unique user authentication, organisation-scoped access control, and logging of record access by other practitioners, patient record updates, and report exports.

Administrative Safeguards

A named Security and Privacy Officer, written security policies, a documented risk analysis, an incident response and breach procedure, and annual review of all of it.

Physical Safeguards

US-region data centers with SOC 2 Type II certification, facility access controls, workstation security policies, and device and media controls for PHI protection.

260+ Clinical Assessments Available

Comprehensive assessment library covering psychology, occupational therapy, and allied health — from ADHD screening to OT functional assessments and outcome monitoring. All HIPAA-compliant with instant scoring.

ADHD Assessment (DSM-5)

Full DSM-5 aligned diagnostic interview with criterion grouping and instant scoring

Most Popular

AQ-10 Autism Screening

Quick 10-item autism spectrum screening with validated cutoffs (88% sensitivity)

Free Test Available

GAD-7 Anxiety

Generalized Anxiety Disorder 7-item scale (89% sensitivity, 82% specificity)

Free Test Available

PHQ-9 Depression

Patient Health Questionnaire 9-item depression screen (88% sensitivity)

Free Test Available

DASS-21

Depression, Anxiety, and Stress Scale — 21-item version with severity cutoffs

Outcome Monitoring

K10 / CORE-10

Kessler Psychological Distress Scale and CORE Outcome Measure for routine monitoring

Outcome Monitoring
Try free self-tests →Learn about measurement-based care →View all 260+ forms →OT insurance report template →

Measurement-Based Care Made Simple

Fewer than 20% of behavioral health clinicians use routine outcome measurement — yet research shows it significantly improves client outcomes. ClientForms makes it easy.

Track Progress Over Time

Administer PHQ-9, GAD-7, or DASS-21 at intake and regular intervals. Auto-scored results show whether treatment is working.

Document for Payers

Insurance companies increasingly require measurable outcomes. Scored assessments provide the documentation you need.

No EHR Switch Required

Add outcome tracking to your existing workflow. Send assessments via link, email, or tablet — results are scored instantly.

Free to Start

10 scored responses in total on the free tier. No credit card, no commitment — try it with your next client.

US Data Residency

Patient records for US practitioners are stored in US-region data centers. ClientForms is operated from Australia, so administrative and support access to those systems happens from Australia — our Business Associate Agreement states this openly.

Encryption at Rest

All patient data encrypted with AES-256 at rest in US-region infrastructure. Encryption keys managed through industry-standard key management services.

Encryption in Transit

TLS 1.2+ enforced on all connections. HSTS headers prevent protocol downgrade attacks. No unencrypted data transmission.

Access Controls

Role-based access control (RBAC), unique user authentication, automatic session timeouts, and multi-factor authentication support.

Audit Logging

Access to a patient record by a practitioner other than its holder, patient record updates, and report exports are logged against the patient record, and log reviews run quarterly under our written security policies.

Your Compliance Responsibilities

What ClientForms Handles

  • US-region data storage and encryption (AES-256 at rest, TLS 1.2+ in transit)
  • A business associate agreement with the provider that stores your patient records
  • Automatic session timeouts and access controls
  • Logging of record access by other practitioners, patient record updates, and report exports
  • Written breach notification to you within 15 days of discovery, so you can meet your own 60-day deadline
  • An annual security review and a documented risk analysis
  • Backup and disaster recovery through our infrastructure providers

Your Responsibilities

  • Ensure your use of ClientForms is covered by your own HIPAA compliance program
  • Obtain appropriate patient consent before administering assessments
  • Use strong, unique passwords and enable MFA on your account
  • Access patient data only on secure, authorized devices
  • Report suspected security incidents to ClientForms promptly
  • Maintain your own HIPAA policies and workforce training
  • Read and accept the Business Associate Agreement for your practice

Frequently Asked Questions

Is ClientForms HIPAA compliant?
ClientForms operates as a business associate to US practices. Patient records are stored in US-region data centres, encrypted at rest (AES-256) and in transit (TLS 1.2+), with organisation-scoped access control and event logging. A Business Associate Agreement is available to every US account, on every plan, including the free plan.
Where is my patient data stored?
Patient records for US accounts are stored in US-region data centres, encrypted at rest (AES-256) and in transit (TLS 1.2+). ClientForms is operated from Australia, so administrative and support access to those systems happens from Australia. HIPAA does not restrict where a business associate is located, and our Business Associate Agreement states this openly so practices subject to a state or program restriction on offshore access can assess it.
Does ClientForms provide a Business Associate Agreement (BAA)?
Yes, and it covers every US account on every plan, including the free plan. You can read the full agreement at clientforms.app/legal/baa and accept it from Settings, Practice Profile. A countersigned PDF is available on request.
What clinical assessments are available?
ClientForms offers 260+ clinical assessments including DSM-5 aligned ADHD assessments (adult and child), GAD-7 anxiety screening, PHQ-9 depression screening, AQ-10 autism screening, DASS-21, K10, CORE-10, and many more. All assessments include instant scoring and neurodivergent-friendly design.
How does ClientForms handle breach notification?
ClientForms operates as a business associate, not a covered entity. If a breach of unsecured PHI occurs, we notify your practice in writing within 15 days of discovery with the details you need for your own notifications, and your practice notifies affected individuals and the HHS Office for Civil Rights within its own 60-day deadline under the HIPAA Breach Notification Rule.
What is measurement-based care and how does ClientForms support it?
Measurement-based care (MBC) is the practice of routinely administering validated assessments — like the PHQ-9 or GAD-7 — to track client progress with objective data. ClientForms auto-scores these measures and tracks change over time, so you can see whether treatment is working without manual scoring or spreadsheets.
Do I need to switch my EHR to use ClientForms?
No. ClientForms works alongside your existing EHR. Send assessments to clients via link, email, or waiting room tablet. Results are scored automatically and available in your dashboard — no integration required.

Ready to try a different approach?

Calm forms for the people filling them in. Scored results and reports for you.

Setup in 2 minutes
Cancel anytime
Email support
Start your free 30 days

Full Professional access for 30 days, no card. Then a free plan with 3 forms and 10 responses.

Quiet design. Real impact.

Or try a free self-test →