Is this required under HIPAA?

The annual plan itself is not a single HIPAA mandate, but documentation of administrative, technical, and physical safeguards supports compliance with HIPAA Security Rule requirements; retain records per 45 CFR §164.530(j).

Can the plan be signed electronically?

Yes; electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and retention criteria are met.

Who must sign the document?

Signers typically include the CISO/CIO and Compliance Officer with executive approval as required by internal governance; the signature block should list required signers explicitly.

How do I update after approval?

Record amendments as new versions with dates, include rationale for changes, circulate to the same approvers, and preserve prior versions for the retention period.

How long must I keep the record?

Follow HIPAA minimum retention of 6 years from creation or last effective date (45 CFR §164.530(j)); financial and tax documents may require different federal retention periods.

What if there is an error discovered later?

Document the correction as an amendment, notify stakeholders as appropriate, and keep both original and corrected versions with an explanation for audit purposes.

Electronic Signature
Templates
Healthcare
Healthcare Annual BSP ISP

Healthcare Annual BSP ISP

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Healthcare Annual BSP ISP

Patient Information

Patient Name

Date of Birth: Gender: Male Female Non-binary Other

Address Primary Phone Email

Emergency Contact

Name Relationship Phone

Insurance Information

Provider Policy Number Group Number Subscriber Name

Medical History

Primary Diagnosis / Relevant Medical Conditions Current Medications (name, dose, schedule) Allergies Prior Surgeries / Hospitalizations Chronic Conditions / Ongoing Health Concerns

Behavior Support Plan / Individual Support Plan

ISP Effective Dates: From to Review Date:

Team Composition (Names, Roles, Credentials, Contact) Behavioral Summary (Functional Assessment Summary) Target Behaviors (Describe each target behavior, operational definition, frequency / severity) Antecedent Interventions / Environmental Strategies Teaching Strategies and Replacement Skills Positive Supports and Reinforcements Crisis and Emergency Procedures (De-escalation, Emergency Contacts, Evacuation) Medication Guidance Related to Behavior (PRN, emergency meds) Monitoring, Data Collection, and Progress Measurement Staff Training and Competency Requirements

Restrictive Interventions

Use of restrictive interventions (including physical restraint, seclusion, or chemical restraint) is permitted only when immediately necessary to prevent imminent risk of serious harm, after all less restrictive alternatives have been attempted or considered. Any restrictive intervention shall be:

Least restrictive, proportionate to the risk, and implemented for the minimum duration necessary
Documented in writing including antecedents, behavior, intervention, duration, and staff involved
Reported and reviewed by clinical leadership within 24 hours
Monitored for safety, health, and compliance with applicable standards

Are restrictive interventions authorized in this plan? Yes No If yes, provide clinical justification and safeguards

Legal Acknowledgements and Consent

By signing this document I authorize the multidisciplinary team to implement the interventions and supports described in this Behavioral Support Plan and Individual Support Plan. I understand that:

I may withdraw consent for any or all aspects of this plan at any time by notifying the clinical team in writing.
My rights, including the right to be free from unnecessary restrictive interventions, will be respected. Any use of restrictive measures will follow the safeguards set forth above.
Documentation of behavioral incidents, interventions, and progress will be maintained in the clinical record.
Emergency medical care will be provided as required to ensure safety.

Privacy and Disclosure Acknowledgment

I acknowledge that Protected Health Information necessary to implement this plan may be shared with members of the treating team, direct support staff, emergency responders, and authorized reviewers in accordance with applicable privacy laws. Disclosures will be limited to the minimum necessary to achieve care and safety objectives.

I acknowledge receipt of and consent to the provisions above I acknowledge Authorization Expiration Date

Review, Oversight and Reporting

The plan will be reviewed at least annually or sooner following a significant change in behavior, medical status, or environment. All incidents meeting reporting criteria will be submitted to oversight as required by organizational policy; corrective action will be documented and implemented when indicated.

Next Scheduled Review Date

Signatures and Certifications

Certification: I certify that I have read the contents of this annual Behavioral Support Plan / Individual Support Plan, that the supports have been explained to me in a language I understand, that I have had the opportunity to ask questions, and that I consent to the implementation of the plan as described unless I withdraw consent in writing.

Patient/Guardian Printed Name:

Relationship to Patient:

Signature:

Date:

What the Healthcare Annual BSP ISP Is and Why It Exists

The Healthcare Annual BSP ISP is an organizational document that records a covered entity's yearly Business Service Plan and Information Security Program for healthcare operations. It consolidates scope, risk assessments, administrative and technical controls, incident response procedures, vendor management, and approval signatures into a single annual record. The form documents steps taken to satisfy HIPAA security and privacy obligations, demonstrates management oversight, and provides an auditable baseline for internal reviewers, auditors, and regulators. It is used to schedule updates, assign responsibilities, and track compliance improvements across the upcoming 12-month cycle.

Primary Purpose and Practical Benefits

This document centralizes the annual security and business-continuity commitments required for HIPAA compliance and operational oversight, reducing regulatory risk and improving continuity of care.

Who Prepares and Who Reviews the Healthcare Annual BSP ISP

Typical creators and reviewers align compliance, IT, and operational leaders before distribution.

IT Security Teams responsible for technical controls, patching, and logging; they provide the risk assessment and mitigation details.
Compliance and Privacy Officers who ensure HIPAA alignment, BAA status with vendors, and regulatory readiness.
Operational Leaders and Department Heads who confirm business process impacts, staffing coverage, and continuity plans.

Final approval normally comes from executive leadership or an authorized designee and is recorded on the signature page.

Primary Signers and Reviewers

CISO / CIO

The Chief Information Security Officer or Chief Information Officer typically certifies the technical and operational sections, provides the final risk acceptance statement, and attests to controls in place. Their signature documents executive-level accountability and is often required by governance frameworks and external auditors.

Compliance Officer

The Compliance or Privacy Officer signs to confirm HIPAA policy alignment, vendor BAAs status, and that required notices and training were completed. This role validates legal and privacy language and maintains the official record for regulatory inspection.

Core Sections to Include in a Professional Healthcare Annual BSP ISP

A comprehensive BSP ISP groups administrative, technical, and physical safeguards with governance, risk assessment, incident response, vendor oversight, and an approval log for the organization and auditors.

Executive Summary

Concise overview of scope, high-level risks, major control changes, and the annual security posture assessment that executives and auditors can review quickly.

Scope and Assets

Inventory of covered systems, PHI repositories, business functions, and critical vendors that fall within the plan's coverage and require ongoing monitoring.

Risk Assessment

Findings from the annual risk analysis including prioritized vulnerabilities, likelihood/impact ratings, and remediation timelines tied to responsible owners.

Controls and Policies

Detailed administrative, technical, and physical safeguards in use or planned, including encryption, access control, logging, and regular training programs.

Incident Response

Roles, escalation paths, notification timelines, breach documentation procedures, and references to breach notification rules and timelines.

Approvals & Review Schedule

Signatures, approval dates, version history, and the scheduled dates for quarterly or annual reassessment to ensure continuous compliance.

Step-by-Step: Completing the Healthcare Annual BSP ISP

Follow these sequential steps to complete, approve, and distribute the annual plan with auditable records and version control.

01

Prepare Draft: Gather risk reports, asset lists, and prior-year actions for inclusion.
02

Populate Fields: Enter organization details, scope, controls, and remediation plans.
03

Review Cycle: Route to IT, compliance, legal, and operational owners for comments.
04

Approval: Collect required signatures and record the approval date and version.

Configuring a Digital Review and Approval Workflow

Recommended workflow settings streamline review, support eSignature validity, and produce a complete audit trail for compliance.

Field	Configuration
Signer Order	Sequential review with required approvers first, then optional stakeholders.
Authentication	Email plus optional SMS or knowledge-based authentication for high-risk approvers.
Notifications	Automated reminders at 3 and 7 days for pending reviewers.
Audit Settings	Enable IP, timestamp, and action logs for every signer and reviewer.

How Digital Completion and Distribution Typically Flow

A standard e-submission flow reduces manual handoffs and centralizes documentation for auditors and legal review.

Draft: Create the plan and mark required fields.
Route: Send to reviewers in the configured signer order.
Sign: Authorized signers apply compliant eSignatures.
Store: Archive the final document with audit trail and version metadata.

Technical and Integration Requirements for eSubmission

Select a platform that provides secure transport, audit trails, and integrations with core systems used by your organization.

Formats Supported: PDF, DOCX, and fillable forms for compatibility with records management.
Integrations: Connectors for Salesforce, Microsoft 365, NetSuite, and Box simplify automated filing and access control.
Authentication: Support for email, SMS codes, and enterprise SSO reduces signer friction while increasing assurance.

Ensure chosen tools can export a tamper-evident copy plus a verification certificate suitable for audits and legal retention.

Key Deadlines and Timing Expectations

Track these common timing requirements to meet regulatory reporting and internal governance schedules for the annual plan.

Annual Issuance:

Publish the updated BSP ISP once every 12 months or sooner if material changes occur.

Internal Review Window:

Allow 30 calendar days for stakeholder review before final approval and signature.

Incident Reporting:

HIPAA breach notifications should follow OCR rules; provide notice without unreasonable delay and within 60 days when applicable (45 CFR §164.404).

Vendor Reconfirmation:

Confirm BAAs and vendor controls annually and record the confirmation date.

Training Refresh:

Complete staff privacy and security training within 90 days of plan issuance and annually thereafter.

Security and Compliance Items to Document

Encryption: TLS 1.2/1.3, AES-256

Audit Trails: Timestamps, IP logs, action history

BAA Requirement: Business Associate Agreement required

Regulatory Standards: HIPAA, SOC 2 Type II

Accessibility: WCAG 2.0 Level AA

21 CFR & FDA: 21 CFR Part 11 compliance available

Key Risks and Regulatory Consequences

HIPAA Fines: Civil and criminal penalties under HIPAA

Breach Notification: Timely reporting obligations per 45 CFR §164.404

Contract Liability: Breach of BAA may trigger damages

Operational Disruption: Service outages and patient care impacts

Audit Findings: Regulatory corrective action plans

Recordkeeping Violations: Failure to retain records as required

Common Preparation Mistakes to Avoid

Incomplete inventory entries that omit cloud-hosted PHI systems lead to under-scoped controls and audit exceptions.
Vague remediation timelines without assigned owners cause delays and reduce accountability during audits and incident response.
Using inconsistent organization names or versions across documents complicates legal review and vendor BAA matching.
Failing to record reviewer comments and version history undermines the audit trail and increases regulatory risk.

Real-World Examples of Annual BSP ISP Usage

Two anonymized examples show how healthcare organizations use the annual plan to improve governance and streamline audits.

Fertility Centers of Illinois

The center documented system scope and vendor BAAs in one annual package to simplify audits.

The approach reduced reviewer follow-ups by consolidating evidence.
After adopting the consolidated annual plan, reviewers reported fewer document requests and a clearer remediation tracking process, improving readiness for regulator inquiries and internal governance meetings.

BIS (Healthcare Operator)

BIS standardized its incident response and training schedule in the annual plan.

Sign-off by CISO ensured executive buy-in.
Standardization provided a single source of truth for tabletop exercises and shortened the time to evidence production during external audits and vendor assessments.

Comparing eSignature Vendors for the Healthcare Annual BSP ISP

Select a provider that supports HIPAA workflows, audit trails, and integrations; the table summarizes starting prices and key capabilities for common vendors.

	signNow	DocuSign ($15/user/mo)	Adobe Sign ($14/user/mo)	PandaDoc ($19/user/mo)	HelloSign ($15/user/mo)
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes; no envelope cap	Yes; 100 envelopes/user/yr cap	Varies by plan	Varies by plan	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Practical Tips for Accurate and Efficient Completion

Apply these proven practices to reduce errors, speed approvals, and maintain a clear audit trail for regulators and auditors.

Centralize Evidence

Attach supporting artifacts such as policy revisions, vendor BAAs, and risk-analysis outputs to the annual ISP to provide a single accessible audit package.

Use Templates

Standardize language across years and use version-controlled templates to reduce drafting time and avoid inconsistencies that complicate reviews.

Record Decisions

Document risk-acceptance decisions, owners, and deadlines inline so auditors can trace who approved what and when without additional requests.

Test Responses

Run tabletop incident-response exercises tied to the ISP to verify roles, contact accuracy, and the effectiveness of documented escalation paths.

Frequently Asked Questions About the Healthcare Annual BSP ISP

Answers to common questions about legal validity, electronic signatures, updates, and recordkeeping for the annual BSP ISP.

Need help? Contact support

Is this required under HIPAA?
The annual plan itself is not a single HIPAA mandate, but documentation of administrative, technical, and physical safeguards supports compliance with HIPAA Security Rule requirements; retain records per 45 CFR §164.530(j).
Can the plan be signed electronically?
Yes; electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and retention criteria are met.
Who must sign the document?
Signers typically include the CISO/CIO and Compliance Officer with executive approval as required by internal governance; the signature block should list required signers explicitly.
How do I update after approval?
Record amendments as new versions with dates, include rationale for changes, circulate to the same approvers, and preserve prior versions for the retention period.
How long must I keep the record?
Follow HIPAA minimum retention of 6 years from creation or last effective date (45 CFR §164.530(j)); financial and tax documents may require different federal retention periods.
What if there is an error discovered later?
Document the correction as an amendment, notify stakeholders as appropriate, and keep both original and corrected versions with an explanation for audit purposes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now