Map forms to workflows: intake vs. referral vs. lab requisition may need different data. Avoid “just in case” fields.
Control exports: PDFs emailed casually defeat your portal’s audit trail.
Train staff on what belongs in free-text boxes—narratives sometimes overshare beyond the structured fields.
Inspectors and partners ask for evidence, not intentions.
Most PHI incidents are human error, not Hollywood hackers.
Retention schedules should tie to legal, payer, and specialty norms—not infinite hoarding.
Treatment, payment, and operations disclosures differ from marketing or research uses—forms should reflect that.