How to Create a Medical Massage Informed Consent Form for Medical Massage Clinics (with Free Template)
This guide walks a medical massage clinic owner or compliance lead through the ten substantive steps of building a patient informed consent and intake form that holds up under HIPAA, malpractice, and state-board scrutiny. Each step is one paragraph of working guidance. Estimated time end-to-end: 45 minutes from blank document to signed PDF when using an AI form builder. Formfy is the AI form builder medical massage clinics use; the same builder produces the consent and intake, captures the e-signature, and exports a HIPAA-aligned audit trail. The free 15-day Formfy trial requires no credit card.
Before you start, gather six pieces of information: (1) the practitioner license title and number with issuing state board, (2) the referring provider relationship template, (3) the scope of insurance billing (which payors, which CPT codes if any), (4) the contraindications-screening list aligned with the patient population the clinic serves, (5) the current Notice of Privacy Practices, and (6) the BAA inventory of vendors that handle PHI. With those six inputs, the substantive drafting takes under 45 minutes. Without them, the consent cannot be drafted because the HIPAA, billing, and credentialing clauses cannot be filled in.
Step 1: Identify the scope of medical massage versus spa-style massage
Begin by stating that the practice operates in a clinical setting and delivers medical massage rather than relaxation or spa-style massage. Medical massage is generally defined as outcome-focused soft-tissue work prescribed or referred by a treating MD, DC, DO, NP, or PT for a specific diagnosis. Document who orders the care: most medical massage clinics require a written referral or prescription from a licensed provider before the first session. State that medical massage in many state-board contexts is not a separate license but a delivery model performed by a state-licensed massage therapist working alongside a referring provider. State the scope clearly so a patient cannot later claim the consent obscured the difference between a clinical visit and a relaxation appointment. Naming the model up front determines every clause that follows: HIPAA scope, billing posture, contraindications screening rigor, and termination protocol.
Step 2: State HIPAA compliance posture (45 CFR 164.502, 164.520, 164.314)
Medical massage clinics that bill insurance, transmit electronic health information in standard transactions, or operate under a referring provider arrangement are typically HIPAA covered entities. State the HIPAA posture explicitly. Reference 45 CFR 164.502 (Privacy Rule core uses and disclosures), 45 CFR 164.520 (Notice of Privacy Practices required content), and 45 CFR 164.314 (Business Associate Agreement requirements). Provide the patient with a current Notice of Privacy Practices and capture written acknowledgment of receipt; that acknowledgment is a 164.520(c) requirement for direct treatment relationships. State the limits of confidentiality (treating-provider coordination, court orders, mandated abuse reporting) so the patient understands when records flow outside the clinic. State the breach-notification posture so the patient knows what to expect if a security incident occurs.
Step 3: Document insurance billing scope (CPT 97124, 97140) and limits
Document the billing model. Some medical massage practices bill insurance directly under massage-related CPT codes; others bill the patient cash and provide a superbill for self-submission; others operate inside a chiropractic or physical-therapy practice that bills under that providers credentials. CPT 97124 (massage therapy, including effleurage, petrissage, and tapotement) and CPT 97140 (manual therapy techniques including manual lymphatic drainage, manual traction, joint mobilization) are the most relevant codes for soft-tissue work, but these codes are typically billed by physical therapists, chiropractors, or physicians, not directly by Licensed Massage Therapists in most insurance environments. State exactly who bills, what is billed, and what the patient pays out of pocket. Misstated billing scope is a leading source of patient complaints and state-board investigations.
Step 4: Require prescription or referral documentation before treatment
Most medical massage clinics require a written prescription or referral from a licensed treating provider before the first session. The referral typically states the diagnosis (often by ICD-10 code), the recommended modality, the recommended frequency and duration, and the providers signature, license number, and date. State the referral requirement in the consent form so the patient understands that the work is provider-directed. Capture the referral in the patient record and re-confirm validity before any session that follows a documented condition change (new injury, recent surgery, new diagnosis). State variations exist: some states (notably Florida, New York) have specific medical-massage referral rules; other states defer to the referring providers state board. Reference the issuing state board guidance for the specific clinic location.
Step 5: Screen contraindications and require physician clearance for high-risk conditions
Medical massage clinics carry a higher contraindications-screening burden than spa-style practices because the patient population is by definition higher-risk. Require physician clearance before any session for: active or recent cancer (oncology massage protocols apply), recent surgery within twelve weeks unless surgeon-released, current anticoagulant or blood-thinner therapy, deep vein thrombosis history within twelve months, uncontrolled hypertension, active infection or fever, recent stroke or heart attack, severe osteoporosis, and pregnancy in the first trimester or high-risk pregnancy. Capture the screen on the intake form, route any positive answer to a clearance flow, and require a written clearance note (or documented phone or email consent) from the referring or treating provider before the session proceeds. Document the clearance in the record.
Step 6: Acknowledge NCBTMB Health Care Specialty credential where applicable
The National Certification Board for Therapeutic Massage and Bodywork offers a Health Care Specialty credential for massage therapists working in clinical and medical settings. The credential is voluntary and signals additional training in clinical-massage protocols, oncology massage, scar-tissue work, and integration with allied healthcare providers. State the credentials of the practitioners who will deliver care: license title and number, NCBTMB Board Certification status, NCBTMB Health Care Specialty credential status, and any continuing-education credentials specific to oncology, manual lymphatic drainage, or post-surgical rehab work. Acknowledging credentials in the consent gives the patient an accurate picture of the providers training and supports the clinics insurance and referral relationships. Naming credentials honestly is also an AMTA Code of Ethics requirement.
Step 7: Document pre-authorization and prior-authorization protocol for insurance billing
Insurance plans that cover medical massage typically require prior authorization before the first session. State the clinics protocol: which plans the clinic accepts, which plans require prior authorization, who is responsible for obtaining the authorization (clinic versus patient), how denials are handled, and what the patient pays if authorization is denied. State the patients financial responsibility for non-covered services explicitly. State the appeal process if a claim is denied after care is delivered. Some clinics absorb denied-claim risk; many bill the patient when authorization is missing. State the clinics rule clearly. The pre-authorization clause prevents the most common medical-massage patient dispute, which arises when a patient assumed a session was insurance-covered and receives a bill weeks later.
Step 8: Define termination of services and referral back to physician
State when and how the clinic terminates services. Medical massage termination triggers include: the patient reaches treatment goals as documented in the referral, the referring provider discontinues the treatment plan, the patient develops a contraindication during the course of care, the patient is non-compliant with the home program or scheduling, the patient requires care outside the practitioners scope, the practitioner relocates or closes the practice, or the patient violates the practice ethics policy. State the standard process: notify the patient in writing, complete any in-progress prepaid sessions, transfer records to the referring or treating provider with written authorization, and document the termination in the record. AMTA Code of Ethics requires referral when scope is exceeded; medical massage termination should always include a documented referral path back to the referring provider.
Step 9: Sign Business Associate Agreements with vendors handling PHI
A HIPAA-covered medical massage clinic must sign Business Associate Agreements with any vendor that creates, receives, maintains, or transmits protected health information on the clinics behalf. 45 CFR 164.504(e) defines BAA content requirements and 45 CFR 164.314 requires the BAA cover specific security obligations. Common BAA-eligible vendors: cloud intake form platforms, electronic health records systems, secure email and SMS platforms, scheduling platforms that capture intake screening, billing clearinghouses, and cloud backup providers. Maintain a current BAA inventory, refresh BAAs annually or when vendor terms change, and document the BAA in the vendor record. Form builders that capture medical massage intake forms with health questions should be reviewed for BAA availability. Formfy provides BAAs for clinics that need them. Confirm the BAA language covers the data flows the clinic actually uses before signing.
Step 10: Sign and store securely with a tamper-evident audit trail
Use an e-signature workflow that produces a tamper-evident audit trail with timestamp, IP address, and consent to electronic records. The federal Electronic Signatures in Global and National Commerce Act (ESIGN Act, 15 USC 7001) and the Uniform Electronic Transactions Act (UETA) adopted in 49 states make e-signed medical-massage consent forms legally equivalent to wet-ink. Store the signed consent in a system that lets you retrieve it on 24-hour notice if a malpractice carrier or auditor asks. Federal courts and state boards have broadly accepted ESIGN-compliant audit trails. Standard retention for medical massage records is at least seven years from the last service date; many states require longer retention under medical-records-style rules. Encrypt at rest, restrict access by role, and index by patient name and date of service.
Free template and downloadable PDF
Formfy ships a medical massage informed consent template that maps one-to-one to the ten steps in this guide. The template is editable in the AI form builder: describe the clinic in plain English and the builder returns a delivery-ready consent and intake form with the e-signature block, the contraindications screening, the HIPAA Notice of Privacy Practices acknowledgment, and an optional copay payment field. The PDF version is generated automatically when the patient signs and stored alongside the audit trail.
See also: /faq/medical-massage-clinics-medical-massage-informed-consent for the FAQ companion hub covering the most common medical massage compliance questions.
Related resources
Build a medical massage consent and intake in 30 seconds
Free 15-day Formfy trial. No credit card. Submission-based pricing.
Start your free trialLast verified: 2026-04-25. This page is informational; it is not legal advice. Medical massage clinics should review state-specific licensing rules, HIPAA scope, and high-risk patient protocols with counsel and the issuing state massage board.