Is an electronic signature legally binding?

Yes. Electronic signatures are legally binding in interstate commerce under the ESIGN Act (15 U.S.C. §7001) and under UETA where adopted; ensure intent, consent, attribution, and retention are documented.

Can HIPAA authorizations be signed electronically?

Yes. HIPAA permits electronic authorizations provided the authorization contains required elements and the covered entity documents consent and retention; follow 45 CFR Part 164 rules for authorizations.

Do I need a Business Associate Agreement (BAA)?

Yes. If the eSignature vendor will create, receive, maintain, or transmit PHI on your behalf, execute a BAA before sharing PHI electronically.

What if the signer’s name doesn’t match records?

Mismatched names can delay processing and may invalidate the authorization. Verify identity with ID, update records, and re-execute the form if needed.

How do I revoke an authorization?

A revocation must be signed and dated by the authorizing individual; retain the revocation and notify recipients. Maintain revocation documentation for audit purposes.

Where should signed forms be stored?

Store signed forms in a secure, access-controlled records system with encryption at rest and an audit trail; retain HIPAA records for six years (45 CFR §164.530(j)).

Electronic Signature
Templates
Healthcare
Healthcare COS and HIPAA Form

Healthcare COS and HIPAA Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE COS AND HIPAA FORM

This Healthcare COS and HIPAA Form authorizes the release and use of protected health information (PHI) and documents the patient's consent for treatment, communications, and continuity of care as specified below. The patient (or legal representative) must complete all applicable sections, sign, and date this form for it to be effective. Information disclosed under this authorization may include sensitive categories as indicated by the patient and may be subject to redisclosure by the recipient.

Patient Information

Patient Full Legal Name

Date of Birth

Gender (select all that apply) Male Female Other / Prefer not to say

Address

Primary Phone

Email

Emergency Contact

Name

Relationship

Phone

Insurance Information

Primary Insurance Provider

Policy / ID Number

Group Number

Subscriber Name (if different)

Medical History

Current Medications Allergies (including drug and food) Prior Surgeries / Hospitalizations Chronic Conditions / Current Diagnoses

Consent for Treatment and Continuity of Care (COS)

I consent to medical evaluation, diagnostic procedures, and treatment by authorized providers at this facility. I authorize release of my protected health information as specified below for purposes of treatment, payment, continuity of care, and healthcare operations. I understand that my consent is voluntary and that refusal to sign will not affect my ability to receive treatment, except where allowed by law.

I specifically authorize the following (check all that apply): Consent to treatment and clinical care Authorization to release PHI as described in this form Authorization to release billing and insurance information Consent to contact via phone, voicemail, or email for appointment reminders and clinical communications

Authorization to Release Protected Health Information (PHI)

I authorize the following persons or organizations to receive my PHI (name providers, family members, case managers, or organizations). Specify the recipient(s) and purpose of disclosure. The recipient may use the information only for the stated purpose and may redisclose as permitted by law.

Recipient Name / Organization Recipient Address / Contact Purpose of Disclosure (check all that apply) Treatment / Continuity of care Payment / Insurance Healthcare operations Legal / Administrative Other (specify):

The following categories of health information may be disclosed if indicated below. Check only those categories that you authorize to be released.

Comprehensive medical records (including diagnoses, treatment notes, and test results) Billing and payment information Mental health and psychotherapy notes (if applicable) Substance abuse treatment records (if applicable) HIV/AIDS-related information (if applicable) Genetic testing information (if applicable) Immunization and vaccination records Other (specify): Authorization Expiration This authorization is valid until revoked in writing

I understand that I may revoke this authorization at any time by delivering a written notice to the Privacy Officer or designated official of the releasing provider, except to the extent that action has already been taken in reliance on this authorization. Revocation will not affect disclosures already made in reliance on this authorization prior to receipt of the revocation.

I acknowledge that I understand my right to revoke this authorization and the process for revocation as described above.

HIPAA Privacy Acknowledgment

I acknowledge that I have been provided with the facility's Notice of Privacy Practices, which describes how my medical information may be used and disclosed, and I understand my rights regarding my protected health information under applicable privacy laws. I understand that the facility will make reasonable efforts to safeguard my PHI and will only disclose information as permitted by law and by this authorization.

I acknowledge receipt of the Notice of Privacy Practices and understand my HIPAA rights.

I certify that the information I have provided on this form is true and complete to the best of my knowledge. By signing below I authorize the uses and disclosures described herein and confirm that I have the authority to execute this authorization. I understand that a copy of this signed authorization is as valid as the original.

Patient Name:

Signature:

Date:

If signing as legal guardian or representative, state relationship:

What the Healthcare COS and HIPAA Form Is and when it’s used

The Healthcare COS and HIPAA Form is a combined administrative document used by healthcare organizations to record a Change of Status (COS) for a patient or employee and to obtain required HIPAA authorizations or acknowledgements. It documents identity and status changes, specifies the scope of protected health information to be disclosed, and creates a contemporaneous electronic or paper record of consent, revocation options, and effective dates for recordkeeping and regulatory compliance.

Why accurate COS and HIPAA forms matter for compliance and operations

Completing this form correctly preserves patient privacy rights, documents consent under HIPAA, and creates an auditable record for regulatory review and internal workflows.

Typical users and signers of the Healthcare COS and HIPAA Form

Organizations, clinicians, HR teams, and payers commonly complete or request this combined form to record status changes and authorizations.

Healthcare administrators and medical records teams who update patient status and routing information.
Employees and HR staff when employment or benefits status changes affect access to PHI or coverage.
Insurance and billing personnel who need documented authorization for claims, coordination of benefits, or release of records.

Accurate role mapping reduces processing delays and ensures the signature attests to identity and consent for PHI disclosures.

Step-by-step: completing the combined COS and HIPAA form

Follow these steps in order to populate, verify, and finalize the document for internal processing and legal retention.

01

1. Identify: Confirm patient/employee identity and record identifier.
02

2. Describe COS: Enter detailed status change and effective date.
03

3. Specify PHI Scope: List recipients, date range, and data categories.
04

4. Sign and Record: Obtain signature, record timestamp, and route to records.

How the form flows through typical healthcare processes

This outline shows the usual routing from creation through authorization, verification, and archival.

Create: Form populated by clinician or HR representative.
Verify: Identity and details checked against EHR or HRIS.
Authorize: Patient/employee signs; consent recorded.
Archive: Signed form routed to records retention system.

Recommended digital workflow settings for online completion

Configure the digital workflow to capture required fields, authentication, and an audit trail for each signing event.

Field	Configuration
Authentication	Email link with optional SMS code
Required Fields	Make name, ID, date, scope, and signature mandatory
Audit Trail	Enable IP, timestamp, and action logs
Retention Policy	Attach retention tag per HIPAA and institution policy

Technical requirements for secure online completion and sharing

Use a platform that supports secure transport, access controls, and format compatibility for medical records.

Integrations: Salesforce, NetSuite, Microsoft 365
File Formats: PDF, DOCX, HTML
Authentication: Email, SMS, SSO options

Security and compliance features to look for

HIPAA: BAA required

Encryption: TLS 1.2/1.3 in transit

Data at Rest: AES-256 encryption

Audit Trails: Complete signer activity log

Regulatory: ESIGN, UETA compliance

Certifications: SOC 2 Type II, ISO 27001

Penalties and legal risks from incorrect or missing information

HIPAA Violations: Civil and criminal penalties under 45 CFR

Invalid Authorization: Improper scope can void disclosure consent

Regulatory Audit: Missing records increase audit exposure

Patient Harm: Delays in care from misrouted information

State Sanctions: Licensing or administrative penalties

Data Breach Costs: Notification and remediation expenses

Common mistakes that delay processing or invalidate the form

Using inconsistent names between ID and form causes identity verification failures and rework.
Leaving HIPAA scope vague (for example, 'all medical records') can invalidate authorization for a specific disclosure.
Failing to set required fields in digital forms lets incomplete submissions be saved without signature or date.
Not recording audit metadata (IP address, timestamp) weakens evidentiary value in disputes or audits.

Comparison: signNow and common eSignature vendors for HIPAA-enabled forms

This vendor snapshot compares starting price, trial availability, bulk send, audit trail, and HIPAA support across popular eSignature providers.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	No	No	No	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about electronic completion and HIPAA compliance

Answers to common legal, technical, and operational questions when using the Healthcare COS and HIPAA Form.

Need help? Contact support

Is an electronic signature legally binding?
Yes. Electronic signatures are legally binding in interstate commerce under the ESIGN Act (15 U.S.C. §7001) and under UETA where adopted; ensure intent, consent, attribution, and retention are documented.
Can HIPAA authorizations be signed electronically?
Yes. HIPAA permits electronic authorizations provided the authorization contains required elements and the covered entity documents consent and retention; follow 45 CFR Part 164 rules for authorizations.
Do I need a Business Associate Agreement (BAA)?
Yes. If the eSignature vendor will create, receive, maintain, or transmit PHI on your behalf, execute a BAA before sharing PHI electronically.
What if the signer’s name doesn’t match records?
Mismatched names can delay processing and may invalidate the authorization. Verify identity with ID, update records, and re-execute the form if needed.
How do I revoke an authorization?
A revocation must be signed and dated by the authorizing individual; retain the revocation and notify recipients. Maintain revocation documentation for audit purposes.
Where should signed forms be stored?
Store signed forms in a secure, access-controlled records system with encryption at rest and an audit trail; retain HIPAA records for six years (45 CFR §164.530(j)).

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now