QR codes in healthcare: what to use them for, and what to never put behind one
QR codes work well for clinic information, forms and aftercare. They are the wrong tool for anything patient-specific. Where the line sits, and why.
Clinics, surgeries and hospital departments have obvious uses for QR codes: a code on a poster that opens visiting hours, one on an appointment card that opens aftercare, one in reception that opens a new-patient form. All of these save staff time and work well.
There is also an obvious failure mode, and it is worth stating plainly before the useful part.
What works well
New-patient and pre-visit forms
A code in reception, or printed on the appointment letter, that opens an intake form. Patients fill it in on their own phone instead of a clipboard, and it arrives typed rather than handwritten. The form itself needs the same protections it would need without a code — encrypted transport, a host covered by your processing agreement, and a privacy notice that mentions it.
Aftercare and discharge instructions
A code on the discharge sheet pointing at guidance for that procedure. People read aftercare at home, hours later, often when something looks wrong and the paper has been lost. Keep these generic by procedure rather than per patient — the page explains what to expect after a particular operation, with no names on it.
Department information and wayfinding
Visiting hours, parking, ward locations, what to bring. This is the content that changes most often and gets reprinted least often, which makes it the best possible fit for a dynamic code.
Equipment and maintenance records
A code on a bed, pump or wheelchair linking to its service history and manual. This is asset tracking rather than patient data, and it has none of the privacy complications.
What does not belong behind a code
- Anything naming a patient, including on wristbands, charts or specimen labels
- Test results, even via a link someone would need to guess — an unguessable URL is not access control
- Appointment details that identify both the person and the clinic they are attending
- Any payload that embeds data directly in the code rather than linking to a protected page
That last point catches people out. A vCard or plain-text QR code carries its contents inside the pattern itself. There is no server, no login and no way to revoke it — anyone who photographs the code has the data permanently. For anything sensitive, a link to an authenticated page is the only sound structure.
Accessibility is not optional here
A healthcare setting has a higher proportion of visitors who cannot use a code than most places: older patients, people without a smartphone, people whose sight or dexterity makes scanning difficult, and people arriving in distress who will not want to.
Keep the paper route open alongside the code rather than replacing it. A poster that shows a code and a short written web address and a phone number serves everyone, and in practice the alternatives get used less than you expect — but the people who need them really need them.
Practical setup
| Use | Code type | Why |
|---|---|---|
| Intake form | Dynamic | Form URLs change; the poster does not |
| Aftercare | Dynamic | Guidance gets revised and old versions must stop serving |
| Visiting hours | Dynamic | The most frequently changed content on any ward |
| Equipment manual | Dynamic | Outlives several document systems |
| Charity or donation page | Dynamic | Campaigns change; the printed code should not |
The pattern is consistent: almost nothing in a clinical setting should be a static code, because almost everything behind it is revised more often than the printed material is replaced. A static code locks in a destination permanently, and an out-of-date aftercare page is worse than no page at all.
Common questions
- Can we put patient information behind a QR code?
- Not patient-identifiable information. A code is readable by anyone who can see it, so it offers no access control at all. Use codes for general information and forms, and keep records behind a proper login.
- Are QR code intake forms compliant with data protection rules?
- The code is only a link, so compliance depends entirely on the page it opens. That page needs encrypted transport, a host you have a processing agreement with, and coverage in your privacy notice — exactly as it would without a code.
- What about patients who cannot scan a code?
- Keep the paper and phone routes open alongside it. A code should remove work for people who prefer it, not become the only way in — and in healthcare that matters more than in most settings.
- Should aftercare codes be static or dynamic?
- Dynamic. Guidance gets revised, and a static code printed last year will keep serving the old version indefinitely with no way to tell it is doing so.