A church prayer request form works best when it collects just enough detail for meaningful follow-up and gives the person submitting it clear control over who sees what they wrote. Build it around a short list of fields, one firm privacy choice, and a workflow that honors that choice every time.
Fields the Form Actually Needs
Short forms get filled out. Long ones sit in the pew rack. A workable card or online form covers these fields and little else:
- Requester’s name, optional if you accept anonymous submissions.
- Contact information — phone or email — also optional.
- A separate field for the person being prayed for, since members often submit on behalf of a relative or friend. A label like “Who is this prayer for?” prevents confusion.
- Prayer category checkboxes: health, bereavement, employment, relationships, spiritual growth, travel safety, gratitude, and an “Other” line.
- A short description area. On a printed card, three to five lines is usually enough; prompt for specifics (“Please describe the situation briefly”) rather than leaving the space completely open.
- The date, pre-printed on cards or auto-populated online. Timing matters when the request involves a surgery next Tuesday rather than an ongoing struggle.
- A confidentiality preference: “Share with the full congregation” or “Prayer team only.” This single checkbox is the most important privacy feature on the form.
A field asking whether the requester wants a pastoral visit or phone call is worth adding. It saves the team from guessing whether outreach is welcome, and it routes urgent situations faster.
Printed Cards and Online Submissions
Offering both paper and digital options reaches the widest range of people in a congregation.
Printed Cards
Cards in pew racks, near the entrance, or beside a labeled drop box are still the most common approach. Cardstock holds up better than paper when the cards are handled by multiple people. Keep them small enough to fill out in a few minutes — a half-sheet or index-card size works. Put a short instruction at the top (“Please place completed cards in the wooden box near the entrance”) so first-time visitors know what to do with the finished form.
Online Forms
Embedding a form on the church website, or linking to one from the email newsletter, lets members submit requests outside of service hours. Most form builders can send the coordinator an instant email when a new submission arrives, which matters for anything urgent. A QR code on the weekly bulletin bridges the two formats: members who prefer their phone scan the code, and the rest use the card.
If you publish a digital form, basic accessibility helps members with visual impairments or motor difficulties use it. Label every field clearly so screen readers can identify it, maintain strong color contrast between text and background, and make sure the whole form can be completed with a keyboard alone. The Web Content Accessibility Guidelines (WCAG) 2.2, Level AA, are the widely accepted technical standard for accessible web content.
Protecting What People Share
Prayer request forms collect some of the most sensitive information a church ever handles: cancer diagnoses, marital breakdowns, addiction, financial ruin. Mishandling that information damages trust in ways that are hard to repair.
Make the Disclosure Rule Explicit
The confidentiality preference field is the foundation, but the form should also tell the requester where “shared” requests actually appear. A single line does it: “Requests marked ‘congregation’ may be included in the weekly bulletin and prayer email.” That removes any ambiguity before the person writes anything down. When someone marks a request as private, that designation has to be honored without exception, and even requests marked for the congregation should be read or printed only to the extent the person described — paraphrasing is fine, but adding details they did not share is not.
Limit Who Can Read Submissions
Keep the circle small. A prayer team coordinator and two or three team leads can be the only people who read every submission. Volunteers on a prayer chain receive only what the requester authorized for sharing, not the raw form. Store physical cards in a locked cabinet or office rather than an open tray. Keep digital submissions behind a password-protected account with access restricted to authorized staff.
Set a Retention Period
Prayer request forms should not pile up indefinitely. Many congregations keep completed requests for 30 to 90 days to allow for follow-up, then dispose of them — shredding cards and deleting digital entries, including anything sitting in a cloud trash folder. Requests tied to ongoing situations like chronic illness may warrant longer retention. Whatever period you pick, write it down so a change in coordinator doesn’t leave the next person guessing.
Which Privacy Laws Actually Apply
Churches often ask whether HIPAA, COPPA, or the federal Privacy Act govern prayer requests. In almost every case, the answer is no — but the reasoning matters, because the absence of a federal rule puts the responsibility on the church’s own policy.
HIPAA’s privacy rules apply to covered entities: health care providers who transmit information electronically for standard transactions, health plans, and health care clearinghouses.1HHS.gov. Covered Entities and Business Associates A church that collects prayer requests mentioning a member’s illness is not performing any of those functions. A church that also operates a health clinic or a self-insured employee health plan could qualify as a covered entity for those specific activities, in which case protected health information from those operations should never appear in a prayer bulletin without written authorization.
The Children’s Online Privacy Protection Act (COPPA) requires operators of commercial websites to obtain verifiable parental consent before collecting personal information from children under 13. The FTC has stated the rule “applies to commercial websites and online services and not to nonprofit entities that otherwise would be exempt from coverage under Section 5 of the FTC Act.”2Federal Trade Commission. Complying with COPPA: Frequently Asked Questions Most religious nonprofits fall outside its scope. Following its protections voluntarily is still good practice: if an online prayer form could be filled out by a child, require a parent’s involvement, and collect no more than a first name and the request itself. There is no reason to ask a child for a home address, phone number, or photograph.
The federal Privacy Act of 1974, sometimes raised in these conversations, applies only to federal executive branch agencies and has no bearing on private organizations including churches.3Department of Justice. Overview of the Privacy Act: 2020 Edition – Definitions
When a Request Describes Abuse or Danger
Occasionally a prayer request describes something that sounds like child abuse, elder neglect, or an imminent threat of harm. This creates a direct conflict between the expectation of confidentiality and a legal duty to report.
Approximately 28 states and Guam specifically list clergy among the professionals required by law to report known or suspected child abuse or neglect, among them Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Georgia, Illinois, Louisiana, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nevada, Ohio, Oregon, Pennsylvania, Vermont, and Wisconsin. In states that designate “all persons” as mandatory reporters, clergy are covered whether or not they are named by title.
Many of those same states carve out a narrow exception for clergy-penitent communications: statements made in confidence to a minister acting in a spiritual counseling role, where the church’s own doctrine requires the communication to remain secret. California does not require a clergy member to report child abuse learned during a penitential communication. Alabama exempts information gained solely through a confidential communication that qualifies as privileged under the state’s rules of evidence. Arizona permits clergy to withhold a report if they determine it reasonable and necessary within the concepts of their religion.
A prayer request card dropped into a public collection box is hard to characterize as a confidential penitential communication, especially when several volunteers handle the cards before anyone reads them. The safer assumption is that whoever reads a request describing possible abuse has a reporting obligation. Marking cards “CONFIDENTIAL — For the pastoral team only” may strengthen the argument that the communication was intended as penitential, but that is a factual determination that varies by state and does not eliminate the obligation in every case.
Train everyone who handles the forms — clergy, church secretaries, ushers, and prayer team volunteers — on your state’s mandatory reporting rules. When in doubt, report. Penalties for failing to report suspected child abuse are real, and good-faith reporters have strong legal protection in every state.
Handling Requests After They Come In
A consistent workflow keeps requests from slipping through the cracks. Collect cards from drop boxes the same day as the service when you can. One designated person transcribes each card into a central log, and the first thing they check is the confidentiality setting. A request marked “prayer team only” should never be read aloud or printed in a bulletin, even accidentally. Digital submissions follow the same path: the coordinator reviews each entry, confirms the privacy setting, and routes it either into the next bulletin draft or to the designated prayer team through a secure channel such as a private email list or group text — not a public social media group.
Send a brief acknowledgment to every requester who left contact information. A short “We received your request and are praying for you” tells the person they were heard. Escalate crisis situations — a hospitalization, a death in the family — immediately to the pastor or pastoral care team rather than waiting for the next review cycle. And set a schedule for checking back on older requests. A note from three weeks ago about a pending surgery deserves a follow-up call. Letting requests accumulate without any response turns the form into a suggestion box no one reads, and people stop using it.