The rule that comes before everything else
A QR code is public. Anyone can photograph it, and anyone who has it can open whatever it opens. That means a code must never carry anything that identifies a patient, and the page it opens must not show anything patient specific without a login.
A code saying come-and-fill-in-our-intake-form is safe. A code that opens Mrs Patel's results because her name is in the link is not, however obscure the link looks. If you want a patient to reach their own record, send them to a portal that asks who they are. The code gets them to the door; the door does the checking.
- Safe: a blank form, a leaflet, a booking page, a general portal login.
- Safe: a code on equipment pointing at its service record.
- Not safe: any link containing a name, a number or a date of birth.
- Not safe: a results page that opens without asking who is looking.
Where clinics actually get time back
The intake form is the one that changes a waiting room. A code on the appointment letter or the door lets people fill the form in before they arrive, on their own phone, in their own time, instead of on a clipboard with a pen that does not work.
Aftercare is the other one. A printed sheet gets lost, and the version in the drawer goes out of date. A code on a discharge sheet opens advice you can revise centrally, and the patient still has it in three weeks when they actually have the question.
- Appointment letter: the intake form, filled in beforehand.
- Reception desk: booking and rescheduling, which cuts phone calls.
- Discharge sheet: aftercare, revised centrally when guidance changes.
- Leaflet rack: the same leaflet in other languages and in large print.
- Equipment: service record, decontamination status, operator notes.
Accessibility is the part most clinics miss
A leaflet is one size, one language and one format. A page behind a code can be read aloud by a phone, enlarged without a magnifier, and translated by the browser the patient already uses.
That is a genuine reason to use a code here rather than a convenience. Print the web address next to it as well, because a patient without a working camera, or without a smartphone at all, still needs the information, and a code with no fallback excludes exactly the people who need the most help.
What we do and do not record when somebody scans
A dynamic code counts scans, and that is worth understanding before you print one in a clinical setting. We record that a scan happened, the rough location from the network, the device type and the time. We do not store the IP address, and there is no way to work back from a scan to a person.
It is still worth asking what you want counted. Knowing that an aftercare sheet is opened two hundred times a month is useful. Knowing it for a code on a single patient's door would be a question you do not want to have to answer, which is another reason the codes stay general. What we record when somebody scans lists every field.
How big to print it
Rule of thumb: the code should be at least one tenth of the distance it is scanned from. These are the sizes that work in practice for this job.
| Where | Scan distance | Minimum width |
|---|---|---|
| Appointment letter or discharge sheet | 10-14 in (25-35 cm) | 0.8 in (2 cm) |
| Leaflet or consent form | 10-16 in (25-40 cm) | 1 in (2.5 cm) |
| Reception or door sign | 2-4 ft (60 cm-1.2 m) | 2 in (5 cm) |
| Corridor or waiting room poster | 5-8 ft (1.5-2.5 m) | 3.5 in (9 cm) |
Why make it dynamic
Clinical information is revised, and the old version stays in circulation. A leaflet printed with a static code keeps pointing at the aftercare advice that was current when it went to print, long after the guidance changed. A dynamic code points at a short link you control, so updating the advice updates every sheet already handed out, in every drawer and on every fridge door.
Dynamic codes are part of Premium, $4 a month. Static vs dynamic, explained.
Step by step
- 1
Choose something that is the same for everyone
A blank form, a leaflet, a booking page. If the answer is different per patient, the code points at a login, not at the answer.
- 2
Put it on a page you can revise
Clinical advice changes. The destination needs to be something you can edit without reprinting what is already in circulation.
- 3
Make the code dynamic
Paste the address below and save it. Dynamic means an update reaches the sheets already handed out.
- 4
Print the web address beside the code
Not everyone scans. A readable address next to the square is the difference between an accessible leaflet and one that quietly excludes people.
- 5
Download the SVG for the print run
Leaflets and appointment letters go to a printer who will want vector artwork.
- 6
Test it the way a patient will
An older phone, in the waiting room's light, from the distance a person actually holds a letter. Not the designer's screen.
Questions people ask
- Is it safe to use QR codes with patient information?
- Only if the code itself carries none. Point it at a general page or a portal login, never at a link containing a name, a number or a date of birth. A QR code is public the moment it is printed, and anyone who photographs it can open whatever it opens.
- Can a QR code be HIPAA compliant?
- The code is just a printed address, so compliance is about what sits behind it. A code opening a blank form or a login page raises no issue. A code opening a page that shows patient data without authentication does, and that is a problem with the page rather than the code. Take your own compliance advice; we are not qualified to give it.
- What do clinics use QR codes for most?
- Intake forms before the appointment, aftercare on discharge sheets, booking and rescheduling, translated leaflets, and service records on equipment. The common thread is information that is the same for every patient.
- Do you record anything about the patient when they scan?
- No. A scan records that it happened, the device type, the rough network location and the time. We do not store IP addresses and a scan cannot be traced back to a person.
- What about patients who cannot use a QR code?
- Print the web address next to it and keep the paper version available. A code should add a route to the information, never be the only one, because the patients least able to scan are often the ones who need the leaflet most.
Make the code now, change the link later
Free to make and print. Premium ($4/mo) keeps it editable and counts every scan.