Can the addendum be e-signed?

Yes. Electronic signatures are generally enforceable under the ESIGN Act and state e‑signature laws; ensure the signer demonstrates intent, consent, attribution, and that the record is retained and reproducible.

Is a separate BAA required?

If the vendor will create, receive, transmit, or maintain PHI, a BAA or an addendum that meets HIPAA requirements is required to define permitted uses and safeguards.

What authentication is sufficient?

Use reasonable authentication (email plus SMS code or stronger methods) appropriate to the risk profile; higher-risk PHI access may warrant multi-factor or identity-proofing measures.

Do subcontractors need agreements?

Yes. Flow-down BAAs should be required for subcontractors handling PHI; the primary vendor remains responsible for subcontractor compliance under the main agreement.

How long should records be kept?

Retain executed agreements and supporting records in line with HIPAA and applicable federal or state retention rules, commonly six years for HIPAA-related documents, and at least three years for tax-related records.

When is notarization needed?

Most service agreements do not require notarization, but state-specific circumstances or internal policies may require it; verify local rules and include notary blocks only if necessary.

Electronic Signature
Templates
Healthcare
Healthcare BSP with Addendum

Healthcare BSP with Addendum

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE BEHAVIOR SUPPORT PLAN (BSP) WITH ADDENDUM

Patient Information

Patient Name

Date of Birth

Gender

Phone

Address

Emergency Contact

Name

Relationship

Phone

Insurance Information

Provider

Policy Number

Group Number

Subscriber Name

Medical History & Current Health

Current Medications (dose, schedule) Allergies (include reactions) Prior Surgeries / Hospitalizations Chronic Conditions / Diagnoses

Assessment Summary

Presenting Concerns Target Behaviors (operational definition) Antecedents / Typical Triggers Frequency, Duration, Intensity

Behavior Support Plan: Interventions & Procedures

Proactive Strategies (environmental, schedule, supports) Teaching / Replacement Skills Environmental Modifications Reactive Interventions (de-escalation, redirection)

Authorization for physical restraint or hold (only if applicable and staff trained)

If physical intervention is authorized, specify conditions and limitations Medication Protocols Related to Behavior Emergency Response Procedures Monitoring and Data Collection Staff Training Requirements

Plan Effective Date

Next Review Date

Addendum

Addendum Date Addendum Author (name and title) Addendum Summary of Changes

Addendum Effective Date

Addendum Expiration Date (if applicable)

Privacy, Authorization & Acknowledgment

I, Patient Name: , DOB: , acknowledge that I have received an explanation of the Behavior Support Plan and any associated addenda. I understand the purpose, proposed interventions, known risks, and potential benefits of the plan and amendments.

I authorize the health care team to implement the BSP and addendum as documented above and to share the plan with staff and providers as necessary for safe and effective care. I understand that physical restraint or holds will only be used if expressly authorized in this plan, only by trained staff, and only under the documented conditions.

I understand my right to withdraw consent for components of the BSP at any time by notifying my clinical team, subject to applicable safety protocols.

I acknowledge receipt of the facility's privacy practices and authorize necessary disclosures of the BSP to the interdisciplinary team.

Persons/Teams Authorized to Access BSP Authorization Expiration Date

Acknowledgment and Certification

By signing below, I certify that the information provided on this form is accurate to the best of my knowledge. I understand the BSP, including any addenda, and have had the opportunity to ask questions. I consent to implementation of the BSP as described and to the sharing of necessary information with staff and providers involved in my care.

Patient Name:

Signature:

Date:

What the Healthcare BSP with Addendum Is

The Healthcare BSP with Addendum is a written services agreement that governs outsourced business services for a healthcare entity and includes an attached addendum addressing protected health information (PHI). It defines the scope of services (billing, IT, analytics, revenue-cycle management), duties of the business service provider, permitted uses and disclosures of PHI, security controls, breach notification procedures, subcontractor obligations, liability allocation, and retention rules. The addendum typically functions as a Business Associate Agreement (BAA) or HIPAA addendum that augments the base contract and clarifies technical, administrative, and physical safeguards required for compliance.

Why a BSP Agreement plus Addendum Matters

A combined BSP and HIPAA addendum aligns commercial obligations with privacy and security duties, reduces regulatory risk, clarifies who may access PHI, and documents incident response expectations to meet compliance requirements.

Typical Parties Who Use This Agreement

Organizations and vendors who exchange PHI use Healthcare BSPs with Addenda to define business relationships and compliance obligations.

Hospitals and health systems managing outsourced billing, IT, or analytics partnerships.
Independent physician groups and ambulatory clinics contracting with third-party service vendors.
Revenue-cycle management and medical billing companies serving multiple healthcare clients.

The document helps both covered entities and business associates document responsibilities, reduce ambiguity, and meet HIPAA-related contractual expectations.

Core Elements to Include in a Professional BSP with Addendum

A complete agreement groups commercial terms with a HIPAA-focused addendum that specifies safeguards, permitted uses, breach processes, and subcontractor management to make obligations actionable.

Scope of Services

Precisely list services, deliverables, and any PHI access necessary to perform those services.

PHI Handling Rules

Define permitted uses, minimum necessary standards, and any data de-identification or aggregation rules.

Security Controls

Specify encryption, access controls, logging requirements, and breach detection responsibilities.

Breach Notification

Set timelines and notification recipients for suspected or confirmed breaches, plus coordination steps.

Subcontractor Flow-Down

Require BAAs with subcontractors and describe approval, oversight, and audit rights.

Liability & Indemnity

Allocate responsibility for damages, regulatory fines, and remediation costs arising from vendor actions.

Essential Data Elements to Include

Parties Identified: Full legal names

Services Defined: Detailed service list

PHI Types: Categories of PHI

Access Rights: User roles and limits

Security Specs: Encryption and logging

Retention: Retention period

Step-by-Step: Completing and Executing the Agreement

Follow these steps in sequence to prepare the BSP and addendum, confirm compliance items, and obtain valid signatures.

01

Draft: Populate commercial and PHI-specific clauses.
02

Review: Legal and compliance teams confirm HIPAA alignment.
03

Negotiate: Resolve liability, scope, and subcontractor terms.
04

Execute: Secure signatures and preserve the audit trail.

Customize an Online Workflow for the Healthcare BSP

Configure an e-sign and routing workflow that enforces signer order, authentication, and retention requirements before sending for signature.

Field	Configuration
Authentication	Email plus optional SMS code or KBA
Document Template	Master BSP plus attached HIPAA addendum
Routing Order	Signers in legal/compliance order
Retention Policy	Store signed copy for HIPAA-required period

Where to Send and How Signing Works

Map routing destinations and storage locations so each signed copy is delivered to compliance, legal, and the vendor with an audit trail.

Prepare Document: Upload master BSP and addendum to your signing platform.
Assign Signers: Set signer email addresses and sequence.
Authenticate: Apply agreed authentication method for each signer.
Distribute Copies: Deliver executed PDF and audit report to stakeholders.

Technical and Platform Requirements for eSigning and Storage

Choose a signing platform that supports HIPAA BAAs, encryption at rest and in transit, and retention controls.

Integrations: Salesforce, NetSuite, Google Workspace
Formats Supported: PDF, DOCX, and archival PDF/A
Security Specs: TLS 1.2/1.3; AES-256 at rest

Confirm the vendor will sign a BAA if PHI will be stored or transmitted and ensure audit trails, access logs, and exportability for legal or regulatory review.

Typical eSignature Vendor Pricing and Compliance Snapshot

Compare common vendor starting prices and core capabilities relevant to executing and storing a Healthcare BSP with Addendum; signNow is listed first as a reference point.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Trial available	Trial available	Trial available	Trial available
Bulk Send	Yes	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Primary Penalties and Legal Risks

HIPAA Penalties: Civil and criminal fines

Contract Breach: Indemnity and damages

Regulatory Scrutiny: OCR investigations and corrective action

Data Exposure: Notification costs and remediation

Reputational Harm: Loss of patient trust

Operational Disruption: Service interruptions and audits

Common Preparation Mistakes to Avoid

Failing to attach a signed BAA before beginning work, which can expose the covered entity to regulatory risk and uncertainty.
Using vague scope language that allows broad PHI access without documenting minimum necessary principles and purpose limitations.
Neglecting to require flow-down BAAs with subcontractors, leaving primary organizations exposed for downstream vendor failures.
Skipping a documented security specification (encryption, logging, access controls) that auditors will expect during compliance reviews.

Key Deadlines and Timing Expectations

Track execution and notification timelines that affect legal enforceability and regulatory obligations to avoid late or inadequate responses.

Effective Date Entry:

Enter and confirm MM/DD/YYYY; obligations begin on this date.

BAA Execution:

Execute the BAA prior to any PHI exchange or system access.

Breach Notification:

Follow HIPAA breach-notice timelines and internal reporting procedures without unreasonable delay.

Periodic Review:

Schedule annual contract and security reviews for changes in scope or technology.

Recordkeeping Start:

Retention periods begin at creation or last effective date as documented.

Real-World Examples of SignNow Customers and Relevance

These brief cases illustrate how organizations used an e-sign solution in service agreements and compliance workflows.

Fertility Centers of Illinois

Needed secure remote signing for patient-related contracts and vendor agreements

Implemented hosted signing and audit trails
"The airSlate SignNow team has been exceptional, responsive, the API has been great, and we're extremely happy that we chose airSlate SignNow as a company," says John Butler, Founder.

Optica Ventures LLC

Required a simple, user-friendly signing flow for customer contracts

Adopted an e-sign platform for staff and clients
Brian Fitzgibbons, COO, noted the interface is easy for both staff and customers, improving turnaround and reducing manual handling.

Who Typically Signs and Approves the Agreement

Chief Compliance Officer

The CCO reviews privacy and security terms, confirms BAA sufficiency, and approves acceptance of vendor safeguards; they coordinate audits and breach response obligations and ensure the contract meets organizational HIPAA policies.

Vendor Authorized Officer

A vendor's CEO or authorized signatory accepts commercial terms, confirms subcontractor obligations, and signs the addendum; this signatory must have authority to bind the vendor to indemnity and data-handling commitments.

Practical Tips for Accurate and Efficient Completion

Adopt a few consistent practices to reduce negotiation friction, speed execution, and support later audits.

Execute BAA First

Require an executed BAA before any PHI transfer; document acceptance and obtain the vendor's compliance contact and incident response plan to reduce regulatory exposure.

Use Clear Scope Language

Limit PHI access to specifically enumerated tasks and list excluded functions; this minimizes unnecessary data access and simplifies monitoring.

Enforce Subcontractor Flow-Down

Mandate subcontractor BAAs, periodic attestations, and audit rights. Ensure contractual flow-down rather than informal assurances to maintain enforceability.

Preserve an Audit Trail

Retain signed PDFs and platform-generated audit reports, including IP, timestamps, and signer authentication method for compliance review and litigation readiness.

FAQs and Troubleshooting for the Healthcare BSP with Addendum

Answers to common questions on legality, e-signing, BAAs, and execution workflows to help avoid routine errors and compliance gaps.

Need help? Contact support

Can the addendum be e-signed?
Yes. Electronic signatures are generally enforceable under the ESIGN Act and state e‑signature laws; ensure the signer demonstrates intent, consent, attribution, and that the record is retained and reproducible.
Is a separate BAA required?
If the vendor will create, receive, transmit, or maintain PHI, a BAA or an addendum that meets HIPAA requirements is required to define permitted uses and safeguards.
What authentication is sufficient?
Use reasonable authentication (email plus SMS code or stronger methods) appropriate to the risk profile; higher-risk PHI access may warrant multi-factor or identity-proofing measures.
Do subcontractors need agreements?
Yes. Flow-down BAAs should be required for subcontractors handling PHI; the primary vendor remains responsible for subcontractor compliance under the main agreement.
How long should records be kept?
Retain executed agreements and supporting records in line with HIPAA and applicable federal or state retention rules, commonly six years for HIPAA-related documents, and at least three years for tax-related records.
When is notarization needed?
Most service agreements do not require notarization, but state-specific circumstances or internal policies may require it; verify local rules and include notary blocks only if necessary.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now