Can this Exhibit be signed electronically?

Yes. Electronic signatures on contracts are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure all parties consent to electronic records and that consumer disclosures are provided where required.

Is a HIPAA BAA required?

If the vendor will create, receive, maintain, or transmit protected health information, include a HIPAA business associate agreement describing permitted uses, safeguards, and breach notification obligations.

Who must sign the Exhibit?

An authorized corporate signer with authority to bind each party should sign. Include printed name and title in the signature block and confirm internal delegation of signature authority.

Are notarization or witnesses required?

Not usually for service exhibits. Check state or payer-specific rules; certain attestations or power-of-attorney documents may require notarization or witnesses.

How long should I retain the signed Exhibit?

Follow applicable retention rules: at minimum retain for the contract term plus federal or industry-specific periods such as 3 years for tax records or 6 years for HIPAA-related records.

What if the vendor changes personnel or subcontractors?

Update access lists and subcontracting provisions, require written notice and new assurances for PHI handling, and confirm continued compliance with contractual and regulatory safeguards.

Electronic Signature
Templates
Healthcare
Healthcare CoManaged Services Exhibit

Healthcare CoManaged Services Exhibit

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE CO-MANAGED SERVICES EXHIBIT

This Exhibit (Exhibit) is entered into between Client Name: and Provider Name: . Effective Date: .

RECITALS

WHEREAS, Client and Provider are parties to a Master Services Agreement under which the parties may execute one or more exhibits describing co-managed clinical and technology services; and

WHEREAS, the parties desire to set forth the scope, responsibilities, service levels, security and privacy obligations, fees and transition provisions applicable to the Co-Managed Services identified below.

1. SCOPE OF CO-MANAGED SERVICES

Description of Services: The Provider shall perform the Co-Managed Services described in this Exhibit, including system administration, application configuration, clinical workflow optimization, monitoring, and scheduled support activities. Detailed tasks:

Detailed Scope (list major deliverables and exclusions)

2. RESPONSIBILITIES

Client Responsibilities Provider Responsibilities

3. SERVICE LEVELS AND PERFORMANCE

Service Levels: Provider shall meet the service levels set forth below. Latency, availability and response metrics shall be measured monthly and reported to Client.

Uptime Target Priority Response Times

4. SECURITY, PRIVACY AND HIPAA OBLIGATIONS

Compliance: Provider shall implement and maintain administrative, physical and technical safeguards that meet applicable federal and state privacy laws and standards for safeguarding Protected Health Information (PHI). Provider agrees to act as a Business Associate where required and to execute any necessary Business Associate Agreement consistent with this Exhibit.

Specific Security Measures Breach Notification

5. DATA ACCESS, OWNERSHIP AND USE

Data Ownership: Client retains ownership of all Client Data, including PHI. Provider is granted a limited license to use Client Data solely to perform Services under this Exhibit.

Permitted Uses and Disclosures

6. CHANGE MANAGEMENT AND GOVERNANCE

Change Control: All changes to configurations affecting clinical workflows or PHI access shall follow the Change Management process described below, requiring written approval from Client governance prior to implementation unless an emergency justifies immediate action.

Change Management Process

7. FEES, INVOICING AND PAYMENT

Fee Schedule Summary Invoicing Terms

8. TERM, RENEWAL, AND TERMINATION

Term Termination for Cause

9. TRANSITION AND WIND-DOWN

Upon expiration or termination, Provider shall provide transition assistance necessary to transfer services back to Client or to a successor. Transition fees, timelines and deliverables shall be as stated below.

Transition Assistance Description

10. INSURANCE, INDEMNITY AND LIMITATION OF LIABILITY

Insurance Requirements Indemnity

11. CONFIDENTIALITY

Each party shall maintain the confidentiality of the other party's Confidential Information and use such information only as necessary to perform obligations under this Exhibit. Confidential Information includes PHI, trade secrets, pricing and system configurations.

Confidentiality Exceptions

12. REPORTING, MEETINGS AND ESCALATION

Regular Meetings Escalation Contacts

13. REPRESENTATIVE PATIENT DATA (FOR TESTING/TRAINING)

The following representative patient information may be used for training, testing, or validation only if expressly consented by Client in accordance with applicable law and with appropriate de-identification where required.

Patient Full Name

Date of Birth:

Gender:

Phone:

Address Emergency Contact

14. HIPAA / PRIVACY ACKNOWLEDGMENT

By checking the box below, Provider certifies that it will comply with HIPAA privacy and security rules and that it maintains policies and controls required to safeguard PHI and to limit access to authorized personnel.

Provider certifies HIPAA compliance and agrees to Business Associate obligations Authorization Expiration Date (if applicable)

15. MISCELLANEOUS

Governing Law Amendment

The parties represent and warrant that the individuals signing this Exhibit are authorized to bind their respective organizations, and that this Exhibit, together with the Master Services Agreement, constitute the complete agreement with respect to the Co-Managed Services described herein.

Party Label:

By:

Date:

What the Healthcare CoManaged Services Exhibit Is

The Healthcare CoManaged Services Exhibit is an addendum to a master services agreement that documents shared responsibilities, service levels, data handling, and compliance controls between a healthcare provider and a co-managed services vendor. It defines scope, PHI access rules, security obligations, incident response roles, performance metrics, and billing or cost-sharing terms. The Exhibit clarifies which party performs clinical versus administrative tasks, when escalation occurs, and which regulatory frameworks (for example HIPAA) apply to protected health information processed or accessed under the arrangement.

Why a CoManaged Services Exhibit Matters for Healthcare Contracts

A clear Exhibit assigns operational duties, reduces ambiguity about PHI handling, and documents compliance measures required by HIPAA. It establishes enforceable service levels and a record of shared controls consistent with ESIGN/UETA for electronic execution and retention of the agreement.

Who Typically Completes the Healthcare CoManaged Services Exhibit

The Exhibit is usually prepared jointly by contracting teams representing clinical operations, IT/security, and legal counsel before execution.

Health system contracting teams coordinating vendor responsibilities post-acquisition or during outsourcing.
Managed services vendors defining system access, SLAs, and escalation paths with provider clients.
Information security officers and compliance staff confirming PHI safeguards and auditability.

Final review often requires sign-off from a compliance or privacy officer and an authorized corporate signer to ensure both operational and legal obligations are aligned.

Core Parts of a Professional CoManaged Services Exhibit

A thorough Exhibit organizes governance, technical controls, personnel responsibilities, and measurement criteria to reduce operational risk and support regulatory compliance.

Scope

Precise description of services, systems, and environments covered by co-management, including excluded functions and any third-party integrations.

Roles

Detailed mapping of responsibilities for provider and vendor staff, including access rights, escalation paths, and maintenance ownership for each system or workflow.

Data Handling

PHI access rules, permitted uses, data residency, encryption requirements, and how patient data will be segregated, archived, or destroyed.

Security Controls

Minimum technical controls (authentication, logging, encryption), audit requirements, breach notification timelines, and periodic security assessment obligations.

Service Levels

Measurable KPIs such as uptime, incident response times, backup and restore objectives, reporting cadence, and remedies for SLA failures.

Compliance Attachments

Required addenda (for example a HIPAA BAA), audit rights, certification evidence, and obligations to support regulatory or payer audits.

Essential Compliance and Security Data to Include

Encryption: TLS 1.2/1.3 in transit

Data at Rest: AES-256 encryption

Regulatory: HIPAA BAA required

Audit Trail: Immutable signing logs

Certifications: SOC 2 Type II

21 CFR: 21 CFR Part 11 support

Step-by-Step: Completing the Exhibit

Follow a logical sequence to draft, review, authorize, and archive the Exhibit to reduce rework and maintain auditability.

01

Draft: Populate scope, roles, and controls in a working draft.
02

Internal Review: Have clinical, IT, and legal teams confirm obligations.
03

Vendor Review: Share draft with the vendor and reconcile differences.
04

Sign and Archive: Obtain authorized signatures and retain copies per retention policy.

Configuring the Online Exhibit Workflow

Set up the document template, required fields, and signer order before sending to ensure proper routing and capture of all approvals.

Field	Configuration
Template Setup	Use reusable template with locked sections
Signers Order	Define corporate signer then vendor signer
Authentication	Enable email or SMS code
Retention	Attach archival metadata automatically

Where to Send or File the Completed Exhibit

Route executed Exhibits to the appropriate repositories and operational teams to ensure availability for audits and operational use.

Contract Repository: Upload final PDF to the central contract management system.
Security Team: Provide redacted copy and access list to security.
Business Owner: Send signed copy to clinical operations lead.
Vendor Records: Ensure vendor retains signed original per agreement.

Digital Signing and File Format Requirements

Confirm that the signing platform supports required formats, audit trails, and authentication levels before e-execution.

File Formats: PDF, DOCX support
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS, or advanced options

Key Deadlines and Notice Periods to Track

Identify and calendar critical dates for renewals, performance reviews, termination notices, and required compliance reporting to avoid missed obligations.

Effective Date:

Date when obligations commence; affects retention and SLA start.

Initial Term End:

Contract-specific expiry; note automatic renewal windows.

Renewal Notice Period:

Period required to cancel or renegotiate before renewal.

SLA Review Dates:

Regular cadence for performance measurement and reporting.

Breach Notification:

Timelines for incident reporting to covered entity and regulators.

Milestones from Negotiation to Ongoing Management

Track sequential milestones to coordinate legal, technical, and operational activities required for deployment and sustainment.

01

Negotiation Complete

Final mutual agreement on scope and terms.

02

Execution

Authorized signatures obtained and copies distributed.

03

Implementation

Systems access provisioned and SLAs operationalized.

04

Ongoing Review

Periodic compliance and performance audits conducted.

Common Mistakes to Avoid When Preparing the Exhibit

Vague scope language that fails to separate provider duties from vendor obligations, causing operational disputes and service gaps.
Omitting a HIPAA business associate agreement or not specifying PHI handling procedures, which creates regulatory and contractual exposure.
Missing the authorized signatory's corporate authority or failing to obtain required internal approvals before execution, delaying implementation.
Using informal or inconsistent retention instructions that conflict with legal or regulatory recordkeeping requirements and audit readiness.

Consequences of Errors or Noncompliance

HIPAA Fines: Civil and monetary penalties

Contract Damages: Breach remedies and indemnities

Operational Disruption: Service interruption and costs

Regulatory Action: State agency enforcement

Reputational Harm: Patient trust erosion

Tax Withholding: Backup withholding exposure

Representative eSignature Pricing and Capability Comparison

Comparison of baseline plans and common capabilities across providers to inform platform selection for Exhibit execution. signNow is listed first as the initial vendor column.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

FAQs and Troubleshooting for the Exhibit

Practical answers to common questions about completing, signing, and maintaining the Healthcare CoManaged Services Exhibit.

Need help? Contact support

Can this Exhibit be signed electronically?
Yes. Electronic signatures on contracts are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states; ensure all parties consent to electronic records and that consumer disclosures are provided where required.
Is a HIPAA BAA required?
If the vendor will create, receive, maintain, or transmit protected health information, include a HIPAA business associate agreement describing permitted uses, safeguards, and breach notification obligations.
Who must sign the Exhibit?
An authorized corporate signer with authority to bind each party should sign. Include printed name and title in the signature block and confirm internal delegation of signature authority.
Are notarization or witnesses required?
Not usually for service exhibits. Check state or payer-specific rules; certain attestations or power-of-attorney documents may require notarization or witnesses.
How long should I retain the signed Exhibit?
Follow applicable retention rules: at minimum retain for the contract term plus federal or industry-specific periods such as 3 years for tax records or 6 years for HIPAA-related records.
What if the vendor changes personnel or subcontractors?
Update access lists and subcontracting provisions, require written notice and new assurances for PHI handling, and confirm continued compliance with contractual and regulatory safeguards.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now