Can we have a sign in sheet in our waiting room?

Yes, seeing a name on the sign in sheet is considered an “incidental disclosure” and not a breach of PHI.  However, many CEs add additional security by having the patient sign on a peel off label which they remove when the person has signed in.  Alternatively, others simply black out the name of the patient after they have checked in.