Permitted Uses
Specify exactly what the recipient may do with the data, including permitted analyses, any restrictions on re-identification, and whether derived or aggregate data may be retained or shared with third parties.
Use the Healthcare CDA Draft to standardize data-sharing terms, clarify PHI handling, and document mutual obligations. It reduces negotiation time, highlights HIPAA compliance requirements, and provides a consistent baseline for institutional review, risk assessment, and downstream data governance.
Typical users include legal counsel, data stewards, compliance officers, research investigators, and vendor managers involved in healthcare data exchange.
Selecting appropriate signers and confirming institutional approvals before execution reduces compliance and operational risk significantly.
Typically responsible for approving data-sharing terms, confirming HIPAA safeguards, and signing on behalf of the covered entity after legal review. Coordinates with security and compliance teams to ensure Business Associate Agreement terms and technical controls meet institutional policies and federal requirements.
Leads project-specific decisions about data fields, de-identification techniques, and research use limitations. Must confirm IRB or equivalent approvals before signing and document minimal necessary disclosures to align with HIPAA and institution-specific data governance.
Specify exactly what the recipient may do with the data, including permitted analyses, any restrictions on re-identification, and whether derived or aggregate data may be retained or shared with third parties.
List the specific fields and identifiers to be provided, indicating PHI vs de-identified elements, formats (CSV, HL7), sampling methods, and any patient cohort inclusion or exclusion criteria.
Describe required technical and organizational measures, encryption standards in transit and at rest, access controls, logging, vulnerability patching cadence, and incident response obligations for breaches.
Grant audit or inspection rights, frequency, scope, and remediation steps following findings; specify whether third-party attestation reports satisfy audit requests and how costs are allocated.
Allocate liability caps, indemnification triggers, insurance requirements, and carve-outs for willful misconduct or gross negligence; consider financial exposure from PHI breaches and regulatory fines and penalties.
Define termination rights for cause or convenience, data return or destruction obligations, transition assistance, and survival of confidentiality, audit, and liability provisions after termination.
Initial template completion and internal edits
Legal, privacy, IT, and leadership sign-off
Signatures collected and audit trail recorded
Data delivery, access controls, and retention begin
Allow four to eight weeks for full review and approval
Depends on governance; typical turnaround two to three weeks
Aim for signatures within seven to fourteen days of final draft
Specify delivery dates or milestones in the agreement
Report incidents per 45 CFR §164.404 within required timeframes (typically 60 days)
| Field | Configuration |
|---|---|
| Signing Order | Sequential: drafter → legal → privacy → external partner |
| Authentication Methods and strength options | Email, SMS, KBA; consider MFA for sensitive data |
| Field Types and Validation Rules | Use date, signature, initials, checkbox and conditional fields |
| Storage and Access Controls Policy | Encrypt at rest; role-based access; retention tagging |
| Key Comparison Criteria for Documents | Healthcare CDA Draft | Standard NDA |
|---|---|---|
| Coverage of Protected Health Information | varies | |
| Applicable Regulatory and Compliance Frameworks | hipaa protections | not hipaa-focused |
| Scope of Use Restrictions and Reuse Limitations | narrow uses | broad uses |
| Audit, Reporting, and Oversight Rights | specific audit rights | limited audit provisions |
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Yes | Yes | Yes | Varies |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies | Varies | Varies |