Can this plan be signed electronically?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states if intent, consent, attribution, and record retention are met. Confirm any consumer-facing disclosure requirements or statutory exceptions before relying on e-signatures.

Is a Business Associate Agreement required?

If the co-managed relationship will involve protected health information, execute a Business Associate Agreement before PHI exchange. A BAA documents permitted uses, safeguards, breach notification, and subcontractor obligations under HIPAA (45 CFR Parts 160–164).

Who must sign the plan?

Authorized signatories are individuals with legal authority to bind their organization. Typically this includes hospital administrators, C-suite officers, or delegated managers with written resolution. For vendor entities, include an officer name and title; mismatched signatory authority can invalidate enforcement.

Do witnesses or notarization apply?

Most commercial service agreements do not require notarization or witnesses. State law governs specific witness or notary requirements for deeds, powers of attorney, or statutory instruments. Use notarization when state law or internal policy requires authentication.

How should PHI be shared securely?

Limit PHI to the minimum necessary, use encrypted transmission (TLS 1.2/1.3), role-based access controls, and detailed audit logs. Require BAA, two-factor access for vendor staff, and documented breach response procedures to meet HIPAA obligations.

How long must records be retained?

Retain contract and transactional records per applicable law: at least three years for tax-related documents, six years for HIPAA records, and longer if required by state or industry rules. Document destruction procedures should be specified in the plan.

Electronic Signature
Templates
Healthcare
Healthcare Co-Managed Services Plan

Healthcare Co-Managed Services Plan

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Healthcare Co-Managed Services Plan

Effective Date: Patient Name:

Patient Information

Full Legal Name

Date of Birth:

Gender:

Home Address

Primary Phone:

Email:

Emergency Contact

Relationship:

Phone:

Insurance Information

Primary Insurance Provider

Policy Number:

Group Number:

Subscriber Name:

Medical History (Relevant)

Current Medications Allergies (include drug, food, environmental) Prior Surgeries / Hospitalizations Chronic or Ongoing Conditions

Co-Managing Providers

Primary (Principal) Provider Co-Managing Provider / Specialist

Plan of Co-Managed Services

Purpose: The co-managed services set out below authorize the Primary Provider and the Co-Managing Provider to coordinate patient care, share clinical information, and manage the listed services to achieve the patient’s documented treatment goals.

Services to be Provided (check all that apply)

Medication management and reconciliation Care coordination and case management Laboratory ordering and review Referrals and specialty consult facilitation Telehealth visits as clinically appropriate Remote monitoring and data review Other (specify):

Frequency of planned contacts / reviews: . Responsible party for ongoing management: .

Care Coordination and Data Sharing Authorization

Patient hereby authorizes the Primary Provider and Co-Managing Provider, and their delegates, to exchange protected health information (PHI) necessary for diagnosis, treatment, care coordination, scheduling, billing, and quality improvement related to this Plan. This authorization includes but is not limited to medication lists, laboratory results, diagnostic studies, referral communications, and care notes.

Limitation of Use: PHI disclosed under this authorization shall be used solely for purposes of patient care under this co-management arrangement and shall not be released to third parties except as required by law or further authorized in writing by the patient.

Expiration: This authorization expires on unless earlier revoked in writing by the patient in accordance with the terms below.

Patient Rights; Revocation; Withdrawal

Right to Withdraw: The patient may revoke this authorization at any time by providing written notice to either provider, except to the extent that action has already been taken in reliance on the authorization. Revocation does not affect disclosures made prior to receipt of the revocation.

Right to Inspect: The patient has the right to inspect or obtain a copy of the PHI disclosed pursuant to this Plan as provided by law. Providers will comply with applicable law in responding to requests for access to records.

No Guarantee of Outcome: The patient acknowledges that co-management is intended to improve coordination of care but that no specific outcome is guaranteed. Providers will exercise clinical judgment consistent with applicable standards of care.

Treatment-Specific Consent and Preferences

Patient Preferences Telehealth Consent

I consent to telehealth visits when clinically appropriate. I consent to medication changes recommended by co-managing providers as part of this Plan. I authorize ordering and release of laboratory and imaging results between providers.

Administrative and Billing Acknowledgment

The patient understands that co-management may result in communications and billing from multiple providers. Insurance coverage determination, co-payments, and deductibles remain the patient’s responsibility. Providers will attempt to coordinate billing but are not liable for denials of coverage by payers.

Billing Contact (if different)

Acknowledgment and Certification

By signing below, the patient certifies that they have read and understand the terms of this Healthcare Co-Managed Services Plan, authorize the exchange of PHI between the listed providers for the purposes described, and consent to the services checked above. The patient affirms that the information provided in this form is accurate to the best of their knowledge.

Patient Name:

Signature:

Date:

If signed by guardian/representative, Relationship:

What the Healthcare Co-Managed Services Plan Covers

The Healthcare Co-Managed Services Plan is a written agreement that defines shared operational responsibilities between a healthcare provider and a co-managed services partner. It documents scope of services, data handling and access, performance metrics, billing and cost allocation, compliance obligations (including HIPAA), roles for clinical and nonclinical tasks, term and renewal rules, and procedures for dispute resolution and transition. The plan can be executed electronically where ESIGN and applicable state law permit, provided consent, attribution, and retention requirements are satisfied.

Why a Formal Co-Managed Services Plan Matters

A co-managed services plan clarifies responsibilities, reduces compliance risk, and documents service-level expectations. It helps prevent billing disputes, makes data-sharing rules explicit for HIPAA compliance, and creates a measurable framework for performance, audits, and orderly transition at contract end.

Who Typically Completes This Plan

Typical signers include healthcare administrators, operations leads, and vendor account managers responsible for implementing co-management arrangements.

Large hospital systems and health networks aligning internal teams with external service providers.
Specialty clinics outsourcing revenue cycle, IT, or administrative workflows to a co-managed partner.
Managed service vendors that supply clinical technology, staffing, or back-office operations.

The plan is suitable where responsibilities overlap and documented controls are needed for patient data and billing accuracy.

Step-by-Step: Completing the Plan

Follow these sequential steps to complete the Healthcare Co-Managed Services Plan accurately and to document governance and compliance obligations.

01

Collect Information: Gather provider, vendor, and contact details; upload contracts and attachments.
02

Define Scope: Describe services, hours, exclusions, deliverables, and responsibilities clearly.
03

Set SLAs: Specify performance metrics, reporting cadence, and remedies for missed targets.
04

Authorize Signatures: List authorized signers and attach BAAs or authorizations where required.

Security and Data Controls to Specify

PHI Handling: Minimum necessary; BAA required.

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest.

Access Controls: Role-based access and two-factor authentication.

Audit Trail: Timestamps, IP, and action history retained.

Certifications: SOC 2 Type II, ISO 27001, PCI DSS.

Data Deletion: Secure destruction and documented process.

Key Risks and Potential Penalties

HIPAA Fines: Civil and criminal penalties.

Contract Disputes: Claim for damages and fees.

Tax Withholding: Backup withholding risk.

Operational Downtime: Service interruption costs.

Invalid Signatures: Enforceability contested.

Data Breach Costs: Breach notification and fines.

Common Preparation Pitfalls to Avoid

Failing to execute a BAA before exchanging PHI can create significant HIPAA liability and complicate breach notification obligations.
Using ambiguous service descriptions or open-ended deliverables leads to disputes over responsibility for staffing, costs, or clinical decisions.
Permitting unauthorized signers or not verifying signing authority risks unenforceable terms and downstream billing problems.
Not defining transition assistance timelines can prolong vendor offboarding and increase operational cost after termination.

Essential Sections Every Plan Should Include

Core sections of a professional Healthcare Co-Managed Services Plan cover scope, data controls, performance measures, fees, compliance, and transition arrangements to ensure predictable operations and risk control.

Scope of Services

Define specific clinical and administrative tasks included, excluded duties, service hours, response times, and escalation paths. Attach exhibits listing deliverables and measurable acceptance criteria to avoid scope creep.

Data & Privacy

List data types exchanged, permitted uses, encryption standards, retention policies, access controls, audit requirements, and require a BAA. Specify breach notification timelines and responsibilities for remediation.

Service Levels

Establish KPIs such as uptime, response time, error rates, and financial remedies or credits for missed targets. Define measurement methods and regular reporting cadence for operational transparency.

Billing & Fees

Specify compensation models, invoicing cycles, disputed charge resolution, pass-through costs, and responsibilities for taxes. Include audit rights and interest or late fee calculations and reconciliation procedures.

Compliance

Require adherence to HIPAA, applicable state privacy laws, and recordkeeping standards. Define audit access, training obligations, and liability allocations in case of regulatory findings, including remediation plans.

Termination & Handover

Specify notice periods, exit assistance, data return or secure destruction procedures, acceptance criteria for transferred records, and timelines for final reconciliation of accounts and liabilities.

Recommended Digital Workflow Settings

Recommended digital workflow settings for completing and e-signing the Healthcare Co-Managed Services Plan securely and in audit-compliant fashion.

Field	Configuration
Authentication	Email + SMS code or SSO
Document Format	PDF/A or PDF, preserve audit trail
Authentication Strength	Two-factor for BAA signers
Audit Retention	Retain logs 6+ years

Where Executed Plans Are Stored and Filed

Typical routing and storage points for executed Healthcare Co-Managed Services Plans within provider and vendor systems.

Provider Records: Store signed originals in the clinical records system.
Vendor Archive: Vendor keeps a copy in secure document repository.
Legal Counsel: Legal retains executed agreement and amendments.
Compliance Office: Compliance team maintains BAA and audit logs.

Platform Capabilities to Support This Plan

Choose platforms that support secure PDF, integration with EHRs, audit trails, and BAAs for HIPAA workflows.

File Formats: PDF, DOCX, and fillable forms supported.
Integrations: EHRs, NetSuite, Salesforce, Google Workspace.
Authentication: SSO, SMS, and two-factor options.

Important Dates and Recurring Deadlines

Key dates and recurring deadlines to track when implementing and maintaining a co-managed services arrangement.

Effective Date:

Contract start date controlling obligations.

BAA Execution:

Execute before any PHI exchange.

Onboarding Deadline:

Complete onboarding within 30–60 days of execution.

Performance Reviews:

Quarterly SLA reviews and reports.

Record Retention:

Follow HIPAA and tax retention requirements.

Milestone Sequence from Draft to Handover

Sequential milestones from negotiation through operational handover that typically structure the co-managed services lifecycle and compliance checkpoints.

01

Drafting

Prepare initial agreement draft and exhibits.

02

Negotiation

Resolve scope, fees, and liability allocations.

03

Execution

Obtain authorized signatures and BAAs as required.

04

Onboarding

Implement systems, transfer data, and begin monitoring.

eSignature Vendor Pricing and Feature Snapshot

Cost and feature comparison of common e-signature vendors for managing Healthcare Co-Managed Services Plan execution and compliance workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Common Questions About the Plan

Answers to common questions about completing, signing, and maintaining a Healthcare Co-Managed Services Plan, with emphasis on compliance, signatures, and recordkeeping.

Need help? Contact support

Can this plan be signed electronically?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states if intent, consent, attribution, and record retention are met. Confirm any consumer-facing disclosure requirements or statutory exceptions before relying on e-signatures.
Is a Business Associate Agreement required?
If the co-managed relationship will involve protected health information, execute a Business Associate Agreement before PHI exchange. A BAA documents permitted uses, safeguards, breach notification, and subcontractor obligations under HIPAA (45 CFR Parts 160–164).
Who must sign the plan?
Authorized signatories are individuals with legal authority to bind their organization. Typically this includes hospital administrators, C-suite officers, or delegated managers with written resolution. For vendor entities, include an officer name and title; mismatched signatory authority can invalidate enforcement.
Do witnesses or notarization apply?
Most commercial service agreements do not require notarization or witnesses. State law governs specific witness or notary requirements for deeds, powers of attorney, or statutory instruments. Use notarization when state law or internal policy requires authentication.
How should PHI be shared securely?
Limit PHI to the minimum necessary, use encrypted transmission (TLS 1.2/1.3), role-based access controls, and detailed audit logs. Require BAA, two-factor access for vendor staff, and documented breach response procedures to meet HIPAA obligations.
How long must records be retained?
Retain contract and transactional records per applicable law: at least three years for tax-related documents, six years for HIPAA records, and longer if required by state or industry rules. Document destruction procedures should be specified in the plan.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now