Identifying Parties
Full legal names and contact details for the authorizing party and the recipient organization; establishes who has rights and responsibilities regarding the electronic files.
A written authorization reduces ambiguity about who may access or share electronic records, supports legal compliance with ESIGN and UETA, and documents consent needed for regulated data such as PHI under HIPAA.
Use this form whenever an accountable record of consent, access limits, or authorized recipients is required for compliance, audit, or operational clarity.
A company officer or designated data steward who can lawfully bind the organization and specify permitted file types, recipients, retention periods, and any security controls required for access.
A consumer, patient, or employee providing consent for their personal or health records to be accessed or shared; the form should record their identity, consent method, and ability to withdraw consent.
Full legal names and contact details for the authorizing party and the recipient organization; establishes who has rights and responsibilities regarding the electronic files.
Clear description of file types, data categories, and specific operations permitted (view, copy, transfer, modify); avoids overbroad language that can create compliance risks.
Statement of why access is granted and the effective start and end dates or event that terminates authorization; limits exposure and supports retention policy enforcement.
Required technical and organizational safeguards such as encryption, MFA, or BAA for PHI; ties operational controls to legal obligations.
How the authorizer can revoke consent or request changes, and turnaround expectations for the recipient to comply with revocation.
Where and how signatures occur, acceptable eSignature methods, and any witness/notary steps required to validate the authorization.
| Field | Configuration |
|---|---|
| Signature Field | Required; must be completed |
| Authentication | Email + SMS code or KBA as needed |
| Conditional Fields | Show BAA checkbox when PHI selected |
| Retention Rule | Auto-archive after execution with audit |
Confirm the vendor's compliance certifications and whether a BAA, 21 CFR Part 11 controls, or SOC 2 reports are available for audits.
Provide on request; no IRS filing deadline
Jan 31 to recipient and IRS (IRS)
April 15 filing deadline (IRS)
Retain 3 years or 1 year after termination (8 CFR §274a.2)
6 years retention from creation or effective date (45 CFR §164.530(j))
Originator submits authorization request for review.
Legal or privacy team confirms scope and controls.
Signer authenticates and signs electronically.
Recipient configures access controls per authorization.
| Criteria | Electronic Signature | Digital Signature |
|---|---|---|
| Definition | broad legal method | pki cryptographic method |
| Legal Status | esign/ueta valid | esign/ueta valid |
| Non-Repudiation | audit trail dependent | certificate-based |
| Typical Use | general contracts | high-assurance regulated records |
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Verify | Verify | Verify | Verify |
| Bulk Send | Yes (Business Premium) | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes (BAA) | Yes | Yes | No | No |
The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers.
airSlate SignNow provides us with the flexibility needed to get the right signatures on the right documents.