Can this agreement be signed electronically?

Yes. Electronic signatures are enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and retention requirements are met.

Is a BAA always required?

If a party is a business associate under HIPAA, a Business Associate Agreement is required to govern PHI handling; include BAA terms or reference a standalone BAA.

What if the parties disagree on permitted uses?

Negotiate narrow, explicit permitted-purpose language and include escalation and amendment procedures so disputes do not delay operational data transfers.

When is notarization needed?

Notarization is rarely required for DUAs themselves but may be necessary for ancillary documents or where state law or counterparties request greater authentication.

How should breaches be handled?

Define notification timelines, party responsibilities, mitigation steps, and reporting obligations to regulators and affected individuals as required by HIPAA and state breach laws.

How long must we retain the agreement?

Retain executed agreements and related audit logs per retention policy; HIPAA requires certain records be retained six years (45 CFR §164.530(j)); other rules may impose longer periods.

Electronic Signature
Templates
Healthcare
Healthcare Data Use Agreement

Healthcare Data Use Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE DATA USE AGREEMENT

This Healthcare Data Use Agreement (Agreement) is entered into as of by and between:

Covered Entity

Covered Entity Name Covered Entity Address Authorized Representative

Data Recipient

Data Recipient Name Data Recipient Address Authorized Representative

Recitals and Purpose

Covered Entity possesses Protected Health Information (PHI) and/or other patient data and is willing to disclose such data to Data Recipient for the specific, limited purpose set forth below. Data Recipient will use and protect the data in accordance with this Agreement, applicable law, and industry-standard safeguards.

Purpose of Use

Data Description — Elements to Be Disclosed

Select all data elements to be disclosed under this Agreement:

Patient Name

Date of Birth

Social Security Number

Medical Record Number

Address / Contact Information

Dates of Service / Encounter Dates

Diagnoses, Procedures, Treatment, Clinical Notes

Billing and Insurance Information

Other (describe)

If Other, describe

Limited Data Set / De‑identification

The parties acknowledge whether the disclosure constitutes a Limited Data Set, fully de‑identified data, or identifiable PHI. Data Recipient certifies and warrants the accuracy of the selection below.

This disclosure is a Limited Data Set (direct identifiers removed)

This disclosure is De‑identified pursuant to applicable law

This disclosure includes Identifiable PHI

If Limited Data Set or De‑identified, specify residual identifiers retained (if any)

Permitted Uses and Restrictions

Data Recipient shall use the data solely for the Purpose of Use set forth above and shall not use or disclose the data for any other purpose. Data Recipient shall apply the minimum necessary standard, implement administrative, physical and technical safeguards, and shall not attempt to re‑identify individuals or contact subjects.

Research

Health Care Operations / Quality Improvement

Public Health Reporting

If Other Permitted Use, describe

Security and Safeguards

Data Recipient shall implement and maintain administrative, physical and technical safeguards to protect the confidentiality, integrity, and availability of the data, consistent with applicable law and industry practice. This includes encryption in transit and at rest where feasible, unique user authentication, access logging, least privilege access, and secure disposal procedures.

Describe Technical and Organizational Safeguards

Encryption at rest: Encryption in transit:

Breach Notification and Response

Data Recipient shall notify Covered Entity of any unauthorized use, disclosure, or loss of data as soon as practicable but no later than 72 hours after discovery. Notification shall include a description of the nature of the incident, affected data elements, actions taken to mitigate harm, and corrective measures to prevent recurrence.

Breach Notification Procedure / Contacts Data Recipient Incident Contact Name

Return, Destruction, and Retention

Upon termination of this Agreement or at Covered Entity’s request, Data Recipient shall return or destroy all protected data, including all copies and derivatives, and certify destruction. If retention is required by law or documented research protocols, Data Recipient shall identify the retained data and continue to apply the obligations of this Agreement.

Retention End Date If retained, provide justification

Audit, Inspection and Recordkeeping

Covered Entity reserves the right to audit Data Recipient’s compliance with this Agreement. Data Recipient shall maintain records of disclosures and safeguards and shall permit Covered Entity or its designee to inspect security controls and procedures upon reasonable notice.

Data Recipient acknowledges audit and inspection rights

Indemnification and Liability

Data Recipient shall indemnify, defend and hold harmless Covered Entity from and against all claims, liabilities, losses and expenses (including reasonable attorneys’ fees) arising from Data Recipient’s breach of this Agreement or unauthorized use or disclosure of the data. Liability will be subject to any limitations imposed by applicable law.

Term, Termination, and Governing Law

This Agreement shall commence on the Effective Date and continue until the Retention End Date or earlier termination. Either party may terminate for material breach with written notice. Governing law for disputes concerning this Agreement shall be:

Governing Law (State)

Notices

All notices required or permitted under this Agreement shall be in writing and delivered to the representatives identified below.

Covered Entity Notice Contact Data Recipient Notice Contact

Certifications and Assurances

Data Recipient certifies that it will comply with all applicable privacy and security laws, that it will not use the data to re‑identify individuals, and that it will limit access to authorized personnel who have completed appropriate privacy and security training.

Data Recipient certifies it will not attempt to re‑identify individuals

Data Recipient will apply the minimum necessary standard

Miscellaneous

This Agreement constitutes the entire agreement between the parties with respect to the disclosure and use of the data. Any amendment must be in writing and executed by authorized representatives of both parties.

Covered Entity

Printed Name:

By:

Date:

Data Recipient

Printed Name:

By:

Date:

What a Healthcare Data Use Agreement Is and when it applies

A Healthcare Data Use Agreement is a formal written contract that governs the permitted access, use, disclosure, safeguarding, and retention of protected health information or other health-related data exchanged between parties for research, operations, payment, or administrative purposes. It specifies the data elements, authorized users, permitted purposes, security controls, data de-identification or limited dataset rules, reporting obligations for breaches, and the effective period. In the United States these agreements are often used alongside business associate agreements required by HIPAA, and they must align with ESIGN/UETA requirements when executed electronically.

Why a clear Healthcare Data Use Agreement matters

A precise agreement reduces legal and privacy risk by defining scope, responsibilities, and controls for handling health data, and it documents consent, safeguards, and accountability required under HIPAA and related law.

Who typically prepares and signs these agreements

Organizations and professionals across healthcare and adjacent sectors use Healthcare Data Use Agreements whenever patient or health-related data will be shared for secondary uses such as research, analytics, or service delivery.

Hospitals and provider networks — legal, compliance, or privacy teams negotiate permitted uses and security controls before data sharing.
Health researchers and academic institutions — research compliance offices ensure data access aligns with IRB approvals and minimum necessary standards.
Health IT vendors and business associates — contract and security staff confirm technical safeguards and breach notification obligations.

Properly assigning roles for data controllers, data recipients, and custodians in the agreement streamlines approvals and reduces downstream compliance friction.

Typical signatories and their responsibilities

Privacy Officer

Chief privacy officers or compliance leads typically review permitted uses, approve safeguards, negotiate breach notification procedures, and sign on behalf of covered entities or business associates; they ensure the agreement aligns with HIPAA requirements and the entity’s policies.

Research Director

Principal investigators or research directors often represent the receiving party when data is used for research; they confirm IRB approval, data minimization plans, statistical disclosure controls, and operational processes for secure access.

Security and compliance items to include

Encryption: AES-256 at rest; TLS 1.2/1.3 in transit

Access Controls: Role-based access and MFA

Audit Trail: Detailed logs with timestamps

BAA Requirement: Business associate agreement when required

Retention Tags: Retention schedules and deletion rules

21 CFR / FDA: 21 CFR Part 11 where applicable

Core clauses every Healthcare Data Use Agreement should cover

A complete Healthcare Data Use Agreement organizes legal obligations and technical safeguards so that both parties understand permitted uses, data scope, and how compliance will be monitored and enforced.

Parties

Identify the data owner(s), recipient(s), and any subcontractors by legal entity name, address, and contact for legal notices.

Purpose

Describe permitted purposes for access and processing, such as research, quality improvement, billing, or public health, with specific limitations.

Data Scope

List data elements, whether the dataset is identifiable, limited, or de-identified, and any patient cohorts or date ranges included.

Permitted Uses

Set clear uses and prohibitions (e.g., no re-identification, no resale), and specify allowed secondary analyses and derivative works.

Security Obligations

Specify technical, administrative, and physical safeguards, encryption expectations, access controls, and evidence or audit rights.

Breach and Liability

Outline breach notification timelines, mitigation steps, indemnity, limitation of liability, and insurance expectations where appropriate.

Step-by-step: Complete and execute a Healthcare Data Use Agreement

Follow these sequential actions to draft, review, and finalize the agreement with minimal rework and auditable records.

01

Draft: Prepare a precise document listing scope, parties, and security controls.
02

Internal Review: Have privacy, legal, and IT teams confirm compliance and technical feasibility.
03

Negotiate Terms: Resolve permitted uses, liability, and data handling details in tracked redlines.
04

Execute: Obtain authorized signatures and retain an executed copy with audit logs.

Where to send, store, and who receives the executed agreement

Routing decisions should balance accessibility with security: limit distribution, ensure central archival, and notify operational teams after execution.

Data Steward: Deliver executed agreement to the named data steward for operational controls.
Legal Repository: Store a signed copy in the legal contract repository with restricted access.
Compliance Team: Provide a copy to privacy or compliance staff for monitoring obligations.
Operational Teams: Notify IT and data engineering teams of permitted data access and retention rules.

Configuring an online workflow for execution and auditability

Set up fields, authentication, retention tags, and audit settings so each signed agreement is secure and reproducible.

Field	Configuration
Signature Field	Require signer name, title, date; set signature validation
Authentication	Use email plus optional SMS or KBA for higher assurance
BAA Toggle	Record whether a Business Associate Agreement is executed
Retention Tag	Apply retention metadata to automate archival and deletion

Technical and platform considerations for e-execution

Choose a platform that provides secure storage, audit trails, and the authentication required by your organization and regulators.

Integrations: Salesforce, NetSuite, Google Workspace, Microsoft 365
Formats Supported: PDF, DOCX, HTML, Excel
Authentication: Email, SMS OTP, SSO, KBA options

Ensure the platform supports export of a tamper-evident signed PDF and preserves an audit trail showing attribution, timestamps, and IP addresses.

Key timelines and notification expectations

Certain timelines are critical: set internal deadlines for review, BAA execution, breach notifications, and scheduled reassessments of permitted uses.

Effectiveness:

Agreement effective on the signed effective date; align with project start.

BAA Execution:

Execute any required BAA before data transfer begins.

Breach Notification:

Notify covered entity and OCR without unreasonable delay; follow 45 CFR §164.404 timing guidance.

Periodic Review:

Review terms annually or when laws or systems change.

Termination Actions:

Specify data return/deletion timeline post-termination in months.

Key milestones from request to enforceable agreement

Track these milestones to measure cycle time and maintain an auditable progression from request to operational data access.

01

Request Received

Data request logged and triaged for scope and legal fit.

02

Drafting Completed

Draft contains precise data fields, security, and retention terms.

03

Internal Approvals

Legal and privacy signoffs obtained before external negotiation.

04

Execution & Handover

Agreement signed; IT enabled or data transfer initiated per controls.

Common pitfalls to avoid when preparing the agreement

Vague purposes that permit unlimited use and hinder oversight, leading to compliance risk and disputes.
Failure to define data elements precisely, causing downstream misunderstandings and incorrect data transfers.
Neglecting to require a BAA where HIPAA applies, exposing parties to regulatory penalties.
Insufficient access controls or audit rights, making breach detection and legal response difficult.

Consequences of an incomplete or incorrect agreement

Regulatory Fines: Civil penalties under HIPAA enforcement by HHS OCR

Contract Liability: Indemnity obligations and damages claims

Operational Risk: Interrupted data access or halted projects

Reputational Harm: Loss of trust with patients and partners

Data Breach Costs: Response, notification, and mitigation expenses

Legal Challenges: Litigation or regulatory investigations

Real-world examples of Healthcare Data Use Agreements

These anonymized examples show how specific clauses address operational needs in different settings.

Hospital Research Collaboration

A university requested limited clinical records for outcomes research

IRB-approved dataset with de-identification
The agreement required a BAA, technical isolation, and annual audit rights, enabling valid research while protecting PHI.

State Public Health Reporting

A county health department requested case-level data for surveillance

Data shared under limited purposes and time-bound use
Agreement specified retention, breach reporting to state authorities, and no redisclosure without consent.

eSignature vendor comparison for Healthcare Data Use Agreement execution

Compare foundational pricing and compliance features when choosing an eSignature provider for healthcare agreements; signNow appears first in the table as a reference option.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day free trial	Check vendor details	Check vendor details	Check vendor details	Check vendor details
Bulk Send	Yes (plan-dependent)	Available (plan-dependent)	Available (plan-dependent)	Available (plan-dependent)	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about Healthcare Data Use Agreements

Answers to common execution, compliance, and operational questions when preparing and signing Healthcare Data Use Agreements.

Need help? Contact support

Can this agreement be signed electronically?
Yes. Electronic signatures are enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and retention requirements are met.
Is a BAA always required?
If a party is a business associate under HIPAA, a Business Associate Agreement is required to govern PHI handling; include BAA terms or reference a standalone BAA.
What if the parties disagree on permitted uses?
Negotiate narrow, explicit permitted-purpose language and include escalation and amendment procedures so disputes do not delay operational data transfers.
When is notarization needed?
Notarization is rarely required for DUAs themselves but may be necessary for ancillary documents or where state law or counterparties request greater authentication.
How should breaches be handled?
Define notification timelines, party responsibilities, mitigation steps, and reporting obligations to regulators and affected individuals as required by HIPAA and state breach laws.
How long must we retain the agreement?
Retain executed agreements and related audit logs per retention policy; HIPAA requires certain records be retained six years (45 CFR §164.530(j)); other rules may impose longer periods.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now