By the Health Within Reach Editorial Team
Usually much less than most forms ask for. For many community events, a headcount is often all you need. Add a name and one way to reach someone only if you have promised a specific follow-up. Then let each person choose whether to be contacted. Anything else on the sheet needs a stated reason.
This article gives you a worksheet to test every field on a sign-in form. It also covers consent and storage. It is general education, not legal advice. It does not tell you what any law requires of your organization.
What the evidence does and does not say
The research cited here doesn’t address community event sign-in sheets specifically, so ask the event organizer how they handle them. The closest verified sources are broader, so treat the rules of thumb below as practical judgment built on them.
- Collect only what you need. The Federal Trade Commission’s guide Protecting Personal Information: A Guide for Business is built on five ideas: take stock, scale down, lock it, pitch it, and plan ahead. “Scale down” means keeping only what you need. It also says to keep sensitive data only as long as you have a business reason for it, and then dispose of it properly.
- That guide is written for businesses. A volunteer-run community event is not a business. Use it as a practical model, not as a statement of what the law requires of you.
- HIPAA may not apply to your sign-in sheet. HHS’s summary of the HIPAA Privacy Rule says the rule covers health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with certain standard transactions. Whether a specific organizer or partner counts depends on the facts. If a licensed clinic is running screenings at your event, ask that partner how its own forms and records are handled.
- Forms should be easy to understand. The CDC’s health literacy overview defines organizational health literacy as how well organizations help people find, understand, and use information. It cites recommendations to use plain language and each audience’s preferred language. It does not address sign-in forms or consent. Our judgment is that a notice people cannot read is a weak basis for asking them to share anything.
- Ready.gov’s kit page does not cover sign-in forms. Ready.gov’s emergency kit page is about household supplies. Its only overlap with this topic is a reminder to keep copies of important family documents saved electronically or in a waterproof, portable container. We are not using it to support any claim about event forms.
Still uncertain: State-specific rules, funder or grant reporting requirements, and standard retention periods for event sign-in records should be confirmed with the relevant state agency, your funder, or your records policy. Check those with your funder, partners, or a qualified adviser before you finalize a form.
The minimum-data worksheet
Work through this before you print the form. Do it once per event type. Apart from the FTC ideas noted above, the steps below are practical judgment, not legal requirements.
Step 1: Write down why you are collecting anything
Pick the real purposes. Most events have one or two.
- Count how many people came.
- Follow up with people who asked to hear from you.
- Reach someone during the event, for example if a volunteer needs to find an attendee.
- Report to a funder or partner who requires specific information.
If you cannot name a purpose for a field, remove the field.
Step 2: Test each field
For every question on the form, write a one-line answer to each of these:
- What will we do with this answer?
- Who will see it?
- How long will we keep it, and who deletes it?
- Could we do the same job with less, such as a tally mark, a first name, or a range?
If the answers are vague, the field is not ready.
Step 3: Sort the fields
Often reasonable, if it serves a purpose you named:
- A headcount, with no names at all, if counting is the only goal.
- A first name or preferred name, only if someone might need to find or greet the person.
- One contact method, such as a phone number or an email address, only if you promised follow-up and the person opted in.
- Preferred language for follow-up, only if you will act on it.
Ask only when a funder or partner requires it, and tell people why:
- ZIP code or general area.
- Age range instead of birth date.
- Demographic categories. Some reporting programs ask for them. One example is an Arizona cooperative extension sign-in form that asks for gender and ethnicity for reporting purposes. Do not add such questions unless a specific requirement calls for them.
Leave off a public sign-in sheet:
- Social Security numbers, which the FTC guide itself lists as sensitive information.
- Payment card or bank account numbers. The FTC guide advises against keeping card data without an essential business need.
- Insurance ID numbers.
- Health conditions, medicines, or reasons for attending. On a shared sheet, the next person to sign can read what the last person wrote.
- Full date of birth or a home address, unless a specific, stated reason requires them.
Step 4: Separate “I was here” from “please contact me”
This is our recommendation. Let people be counted without agreeing to follow-up. Put contact details in a separate, optional section with its own checkbox. Do not make attending, getting help, or receiving materials depend on handing over contact information unless there is a real reason.
For a real-world pattern, a UK community-funding program publishes a sign-in sheet template. It states that name and postcode are collected to verify attendance, and it treats giving an email address as agreeing to be contacted. That template refers to UK data rules, which do not describe your obligations, but the structure shows the idea. You can adapt this sample wording:
“Signing in is optional. If you would like us to contact you about [specific thing, such as next month’s event], write one way to reach you below and check the box. We will use it only for that. We will delete it by [date]. You can ask us to remove it sooner by [how].”
Keep the notice short, in the language your attendees use, and read it aloud for anyone who has trouble reading.
Step 5: Plan storage before the event
The FTC’s “take stock, lock it, pitch it” sequence maps well onto a sign-in sheet. Answer these on paper before the event.
- Where can the information end up? Include the clipboard, photos of the sheet on a volunteer’s phone, spreadsheets, and email attachments. Ask volunteers not to keep personal copies.
- Who can access it? Name the people and keep the list short.
- How is it protected? Use individual cards or a page that hides earlier entries. Keep paper in a locked place. Protect digital files with a password and limited sharing.
- When and how is it destroyed? Pick a date. Shred paper and delete digital files, including copies. The FTC guide suggests a written retention policy when you must keep information for business or legal reasons. We found no verified standard number of days for event sign-ins, so choose a date that matches your stated purpose and write it down.
- What if it goes missing? Decide in advance who to tell and how.
Next practical decision
Take your current form and cross out every field you cannot tie to a purpose from Step 1. Then split the remaining contact fields into their own optional section with the sample notice above. Before printing, confirm with any funder, partner clinic, or adviser whether they add requirements of their own.
Limits of this page
This article is general education for community organizers. It is not legal, privacy, or medical advice, and it does not describe how any particular organization handles records. If your event includes health screenings, treat screening results as separate from the sign-in sheet. Ask the licensed provider running the screenings how those records are handled. Consult a qualified professional about the rules that apply to your situation.
This page is about event sign-in sheets, not about how this website handles visitor information. For that, see the Privacy Policy. To learn how this publication approaches its content, see the Editorial Policy.