Medical QR Code Generator: What Is Safe to Encode Under HIPAA

By the end of this article you will know which clinic and practice jobs a plain QR code handles safely, which jobs it must never be used for, how to make an emergency medical ID code without misleading yourself about what it protects, and how to print codes that stay scannable on a wall that gets wiped down twice a day. The rule that runs through all of it fits in one sentence: a QR code is a printed string of text that anyone can read, so treat it like text printed on the same sign.

A QR code is not encrypted, and this is not a HIPAA-compliant service

There is no such thing as a secure static QR code. The pattern is a text string encoded in a standard format (ISO/IEC 18004) so that any camera app can decode it. Whatever you put in, anyone who scans it gets out, and so does anyone who photographs the sign, or finds a discarded printout, or sees it over a shoulder. There is no password, no encryption and no way to revoke a code once it is printed.

Quick QR Maker is a free generator that runs in your browser. Nothing you type is uploaded, which means making a code does not itself send anything anywhere. But the site is not a covered entity or a business associate under HIPAA, does not sign business associate agreements, and provides no protection for anything you choose to encode. HIPAA requires that protected health information (PHI) be safeguarded; a plain QR code safeguards nothing. Whether a code you print is compliant depends entirely on what it contains and where it links, and that is a decision for you and your privacy officer, not for a generator.

That is not a reason to avoid codes. It tells you where the line is, and most of what a practice wants a code for sits on the safe side of it.

Safe uses and what they contain

Every entry in this table links to something public or contains something you would happily print in large type on the same sign.

What must never go in a code

• Any PHI as text: diagnoses, medications, allergies, test results, dates of birth, record numbers, insurance member IDs. A code containing "Type 2 diabetes, metformin 500 mg" on a chart sleeve is a disclosure to everyone who walks past with a phone.
• Pre-filled form links. A form URL that carries the patient's name or record number as a parameter puts that information in the code. Link to the blank form instead.
• Pre-authenticated portal links. "Magic links" that log someone in without a password are a session in printed form; anyone who scans the code is that patient.
• Identifying URLs. The address itself is visible. A link to /patients/j-smith/oncology-results discloses two things before the page even loads. Keep URLs generic.
• Reproductions of wristband or chart barcodes. Hospital wristband codes come from the records system and mean nothing outside it. Do not try to recreate that with a public generator, and do not add a code to a chart that says more than the chart cover already does.
• Intake forms on consumer form tools. A code can link to an intake form only if the form service is one your compliance officer has approved for PHI under a signed agreement. A free consumer form builder generally is not.

One more thing: a photograph of a code that contains PHI is PHI. If it goes in a code, assume it will be photographed.

Portal and booking codes

The portal code is the one patients use most, and it is the simplest to get right because the code only has to get them to the login page.

1. Open the portal in a private browser window and copy the address of the login page you land on. If the address contains a session token or a long string of random characters, go back and find the plain login URL from your portal vendor; it is usually short, like portal.yourclinic.com.
2. Paste it into the URL QR generator. A URL under about 80 characters produces a noticeably simpler code than a long one, which matters for the small codes on appointment cards.
3. Print the code with the label "Scan to open the patient portal login" and the typed URL beneath it.
4. Repeat for the booking page. Use a different code for each; a combined "links" page adds a tap and confuses patients who came for one thing.

Pre-visit instructions as a PDF

Fasting instructions, what to bring, where to park and how to prepare for a procedure change more often than the appointment card they are printed on. A code that opens a PDF at a fixed address takes the changes: replace the file, keep the address, and every card already in a patient's wallet shows the current version. The code stores the address, not the file, so you can change the document but not where it lives; QR codes that never expire explains the static-versus-dynamic distinction.

1. Write one document per procedure or visit type in plain language, single column, body text of 12 point or larger, because it will be read on a phone in a parking lot.
2. Upload it to your practice website at an address without a date or version number in it (/prep/colonoscopy.pdf, not /prep/colonoscopy-2026-v2.pdf).
3. Paste the address into the PDF QR code page and download an SVG for the appointment card template and a 300 DPI PNG for the reception poster.
4. Put the code on the appointment card, on the confirmation letter and on the poster at the reception desk.

The document must contain nothing about the individual patient. It is the same sheet for everyone booked for that procedure.

Clinic WiFi

The waiting room WiFi code is the one people will thank you for. It carries the network name and password in a fixed format:

WIFI:T:WPA;S:ClinicGuest;P:welcome2026;;

T is the security type (WPA for almost every network, nopass for an open one), S the network name, P the password. Add H:true; before the final ;; for a hidden network. iOS 11 and later and Android 10 and later read this with the built-in camera and offer to join.

Print only the guest network. The password is readable by everyone who scans, so it must never be the network that carries clinical systems, printers or the practice management software. Ask whoever manages your network for a guest network that is separated from clinical traffic; if you do not have one, do not print a WiFi code until you do. Enter the details in the WiFi QR generator, print the network name and password in text beside the code, and put one in the waiting room and one in each area where patients wait for longer periods, such as infusion or dialysis chairs.

A clinic vCard

A vCard code adds the practice to a patient's contacts in one tap: name, phone, address, website and a general email. It belongs on the reception counter, the appointment card and the new-patient pack. Keep it to the practice's details, not a clinician's mobile number, because everyone who scans the card gets every field. Enter the fields in the vCard QR generator; the code carries a vCard 3.0 text block, and the more fields you fill, the denser the pattern, so leave out anything that is not needed to reach the front desk.

Medication information leaflets

A pharmacy shelf or a discharge pack can carry one code per medication that opens the public leaflet for that product from the manufacturer or the regulator. This is safe because the destination is a public page about the drug, not about the patient. Make one code per product with the URL QR generator, or put the product names and leaflet addresses in a CSV and run them through the bulk generator to get a named file for each. Check every link when the leaflet is updated; regulators occasionally move documents, and a code pointing at a broken page is worse than no code.

Wayfinding

A large building benefits from a code at each entrance and elevator lobby that opens a site map PDF, and a code on the appointment letter that opens a map pin for the correct entrance. Both are public. Make the map PDF through the PDF QR code page and the map pin through the URL QR generator with the share link from your maps app. Label the code with the destination, for example "Scan for directions to the outpatients entrance," so nobody scans it expecting something else.

Emergency medical ID codes

People with allergies, chronic conditions or implanted devices often want a code on a wallet card or bracelet so that a responder can learn what matters. A static code can do it, but be clear about three things first.

First, responders may not scan it. A code is a supplement to the engraved or printed text, never a replacement for it. The text should carry the two or three most important facts on its own.

Second, whatever the code contains is readable by anyone who scans it, not only paramedics. Include only what the person would tell a stranger who asked, and nothing that enables fraud: no Social Security number, no insurance ID, no full address, no record number.

Third, a static code cannot be edited. If the medication list changes, the card is reprinted.

There are two ways to build one:

To make the text version, open the generator, choose the text type, and enter the facts in under 150 characters: condition, critical allergy, one emergency contact with a first name and number. Choose error correction level H, because a wallet card gets scuffed and a bracelet tag gets scratched; H recovers roughly 30% of damaged modules, at the cost of a denser pattern. Download an SVG and print at no smaller than 2.5 cm on a card, larger if the card design allows. For a bracelet tag, test the engraved or printed code with two phones before ordering more than one.

For the URL version, the page must open without a login (a responder has no password), which means it is as visible as the text version to anyone who follows the link. The advantage is only that it can be updated. Keep the URL short and free of the person's name.

If you are making a code for a child or a dependent adult, the decision about what to include is the same one you would make about what to write on a card in their pocket. Make it with them where possible, and review it whenever medication changes.

Printing for clinic environments

A clinic is a hard place for a printed code: fluorescent light, disinfectant wipes, laminated surfaces and patients who scan from a chair two meters away. Settings that work:

• Laminate anything on a wall or counter, and choose matte lamination. Gloss reflects the ceiling lights straight into the camera. Matte laminate wipes clean with the same products used on the counter.
• Black modules on a white background. Brand colors are for the border and the label, not the pattern. Aim for a contrast ratio of at least 4.5:1, and do not print light modules on a dark background without testing on several phones first.
• Error correction H for anything that will be handled, wiped or worn: cards, wristbands, counter signs. M is fine for a poster nobody touches. A logo in the middle of the code needs Q or H and should cover no more than roughly 20 to 30% of the area; the design studio shows a live scannability score while you add one.
• Size by distance. The code should be at least one tenth of the distance it will be scanned from. Use the size calculator for your specific content; longer content needs a larger code at the same distance.

• Quiet zone. Leave at least four modules of blank margin around the code. Do not run the brand border right up to the pattern.
• Label every code in plain words with what it opens, and print the typed URL beneath it in at least 14 point for patients who cannot scan or who use a screen reader on a printed letter.
• Export at 300 DPI for PNGs printed at the exported size, or as SVG or PDF for anything the print shop will scale. The print guide covers the file setup.

Checklist before a code goes on the wall

1. Read the decoded content out loud. If it names a person or a condition, or contains a number that identifies anyone, stop.
2. Open the destination in a private browser window on a phone. Confirm it needs no login and shows nothing patient-specific.
3. Upload the exported file to the QR code tester to confirm it decodes to exactly the text you intended, with no trailing space or typo in the WiFi password.
4. Print one at final size on the final stock, laminate it, and scan it under the room's own lighting from the distance in the table with an iPhone and an Android phone.
5. Record the code, its placement, the destination and the print date in a spreadsheet, so a broken link can be traced to every sign that carries it.
6. Have your privacy officer sign off the list once. New codes that follow the same pattern do not need a new review; new kinds of destination do.

Frequently asked questions

Is a QR code from this site HIPAA compliant? The question does not quite apply. A code is only text; compliance depends on what you put in it and what it links to. If it contains no PHI and links only to public pages, there is nothing in the code for HIPAA to regulate. If it contains PHI, no generator can make that compliant.

Can I see how many patients scanned a code? Not from this site; it does not track scans. Your own website analytics will show visits to the destination page, and your privacy notice should cover that as it does any other web visit.

Can I put the portal password in the code so patients do not have to type it? No. Each patient's password is their own, and a code is readable by anyone. Link to the login page only.

Will the codes stop working? A static code has no expiry; it stops working only if the destination page is removed or moved.

For the portal, booking, WiFi and contact codes described here, start with the free generator on the homepage.