Parties
Identify data provider and recipient with legal entity names and contact information.
A DUA reduces legal and compliance risk by setting explicit boundaries for data handling, demonstrating due diligence under federal rules, and documenting technical and administrative safeguards required by regulators.
DUAs are used by organizations that share controlled or sensitive data and need contractual assurances and auditability.
Use a DUA when data recipients require written terms for permitted use, security controls, breach notification, or regulatory compliance.
Identify data provider and recipient with legal entity names and contact information.
Specify dataset contents, formats, identifiers removed or retained, and whether PHI is involved.
List allowed purposes and prohibit reidentification, resale, or unrelated analysis.
Define administrative, technical, and physical safeguards and minimum standards.
Set timelines, required notifications, and remediation responsibilities for incidents.
State retention period, secure destruction methods, and certification of deletion.
| Field | Configuration |
|---|---|
| Effective Date Field | Auto-fill with contract start date; MM/DD/YYYY |
| Signature Field | Require signer name, title, and date entries |
| Conditional Clauses | Show additional security clauses when PHI is selected |
| Audit Trail | Capture IP, timestamp, and authentication method |
Use an eSignature workflow that captures intent, attribution, and a reproducible record to support enforceability under U.S. law.
Confirm the chosen platform supports required compliance features (for example HIPAA BAA, 21 CFR Part 11 where relevant) and provides retrievable audit logs for regulatory review.
Specify delivery date or window (for example within 30 days after signing).
Allow a defined review window (commonly 10–30 business days) for legal and technical checks.
Require notification within 72 hours of discovering a reportable incident.
Set advance notice for renewal or termination (commonly 30–90 days).
Define when access will be revoked after termination (immediately or within specified days).
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Yes | Yes | Yes | Yes |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/yr | Varies | Varies | Varies |
Optica prepared a concise DUA to share investment data with advisors
A healthcare provider used a DUA to share deidentified patient outcomes with a research partner