Can the exhibit be signed electronically?

Yes. Electronic signatures are generally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure the electronic process captures signer intent, consent, attribution, and retention capability to meet the legal-validity test.

Is a BAA required with every vendor?

A Business Associate Agreement is required when a vendor will create, receive, maintain, or transmit protected health information on behalf of a covered entity. The exhibit can reference or include the BAA language to document responsibilities and breach procedures.

How long must I retain the executed exhibit?

Follow HIPAA's six-year retention requirement for related records (45 CFR §164.530(j)) and retain contract documents per IRS and state rules; reconcile all minimums in a records retention schedule.

When is notarization needed?

Notarization depends on state law and document type. Some states or specific attachments may require notarization; check the applicable state rules or include notarization in the exhibit when parties prefer added authentication.

What should trigger a revision to the exhibit?

Material changes to data handling, new regulatory requirements, expansions of permitted uses, or transfers of systems handling PHI should prompt an exhibit amendment and re-execution by authorized signers.

Who enforces breach notification obligations?

Party responsibilities are contractual; HIPAA enforcement rests with the HHS Office for Civil Rights. The exhibit should set internal notification timelines and vendor duties to support regulatory reporting.

Healthcare Exhibit

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE EXHIBIT

Exhibit Title: Effective Date:

1. Patient Information

Patient Full Legal Name Date of Birth

Gender: Male Female Other Prefer not to say

Home Address Primary Phone Emergency Contact (Name, Relationship, Phone)

2. Insurance Information

Primary Insurer Policy / ID Number Group Number Subscriber Name (if different)

3. Medical History & Current Status

Current Medications Allergies (Drug, Food, Environmental) Prior Surgeries / Hospitalizations Chronic Conditions / Diagnoses

4. Procedure / Services Exhibit

Description of Procedure or Service to be provided:

Purpose and Expected Benefit:

Material Risks, Complications, and Potential Side Effects (not exhaustive). The patient acknowledges that all procedures carry risk, which may include but are not limited to infection, bleeding, allergic reaction, damage to adjacent structures, need for additional procedures, or unforeseen adverse outcomes. The patient affirms understanding these risks and consents to proceed.

Alternatives to the procedure, including no treatment, and associated risks and benefits have been explained to the patient. The patient acknowledges receipt of this information and that the patient had an opportunity to ask questions and receive answers.

5. Authorization for Use and Disclosure of Health Information (HIPAA)

I authorize the disclosure of my protected health information to those persons and entities involved in my care, payment, and health care operations for the purpose of treatment, claims processing, continuity of care, and quality assurance. This authorization includes diagnostic test results, operative reports, consultation notes, and billing information as necessary for the stated purposes.

I understand that I may revoke this authorization in writing at any time, except to the extent that action has already been taken in reliance on this authorization. I understand that a revocation does not affect disclosures already made in reliance on this authorization prior to receipt of revocation.

Authorization Expiration: This authorization will expire on:

I acknowledge receipt of the provider's Notice of Privacy Practices and that I have been informed of my rights with respect to my protected health information.

Consent Options: I consent to the treatment/procedure described above. I authorize release of medical records to third-party payors and referring providers as necessary for payment and continuing care. I consent to receive appointment reminders, billing communications, and clinical information via electronic means (telephone, text, email) where applicable.

6. Representations, Warranty & Acknowledgment

The patient represents that the information provided in this Exhibit is true and complete to the best of the patient's knowledge. The patient warrants that they have disclosed all known material health information, prior procedures, medications, and allergies that could affect the proposed treatment. The patient acknowledges that withholding such information may increase the risk of harm.

The patient understands that the provider will use reasonable medical judgment in delivering care, but no guarantee of outcome is made or implied. The patient accepts financial responsibility for services rendered in accordance with the provider's billing policies.

7. Revocation and Emergency Treatment

The patient may revoke this consent and authorization at any time by providing written notice, except to the extent that the provider has already taken action in reliance on the consent. In the event of an emergency during a procedure, the provider is authorized to take such measures as are medically necessary to preserve the patient's life and health.

8. Additional Administrative Information

Primary Care Provider Additional Instructions / Notes

By signing below, the patient (or legal guardian) certifies that they have read and understand the contents of this Healthcare Exhibit, that all questions have been answered to their satisfaction, and that they voluntarily consent to the procedures, uses, and disclosures described herein.

Printed Name:

Signature:

Date:

If signed by guardian or representative, Relationship to Patient:

Representative Authority (describe basis for authority):

What the Healthcare Exhibit Is and when it’s used

A Healthcare Exhibit is a contract attachment that documents obligations, data handling rules, and operational details specific to health-related services or transactions. It typically accompanies a master services agreement, business associate agreement, vendor contract, or purchase order and sets out HIPAA-related safeguards, allowed uses of protected health information, reporting obligations, and signature blocks. In U.S. practice a Healthcare Exhibit clarifies who has access to patient data, how data will be stored and transmitted, applicable retention periods, and any required authorizations or consent language.

Why a clear Healthcare Exhibit matters

A concise Healthcare Exhibit reduces ambiguity about PHI handling, aligns contracting parties on HIPAA obligations, and documents steps for breach response and record retention under applicable law.

Who typically prepares and reviews a Healthcare Exhibit

Combining these perspectives helps the exhibit balance regulatory safeguards, operational feasibility, and enforceable contract terms.

Healthcare compliance officers and privacy officers who enforce HIPAA policies and approve PHI-sharing provisions.
Vendor contract managers and procurement teams who negotiate service levels, data access, and indemnity clauses.
Legal counsel and in-house attorneys who review liability, governing law, and signature authority provisions.

Primary signers and approvers

Hospital Administrator

A hospital administrator or director who signs on behalf of a covered entity should have delegated contracting authority and familiarity with HIPAA operational requirements; their signature binds the institution to data handling, breach notification, and access obligations.

Vendor Executive

A vendor executive or authorized representative signing the exhibit must be empowered to accept business associate duties, implement technical safeguards, and commit to contractual indemnities and reporting timelines.

Core components to include in a Healthcare Exhibit

A professional Healthcare Exhibit organizes obligations so technical teams, legal reviewers, and signers can find responsibilities for PHI use, security, and compliance quickly.

Scope of Access

Precisely describe what categories of protected health information may be accessed, processed, or transmitted and for what limited business purposes.

Permitted Uses

List allowed processing activities, any prohibition on re‑disclosure, and circumstances that require prior written consent or a separate authorization.

Security Controls

Specify required administrative, physical, and technical safeguards, including encryption in transit and at rest and access control standards.

Breach Response

Define the breach notification timeline, required contents of notices, forensic responsibilities, and cost allocation for remediation.

Retention & Return

State retention periods, return or destruction procedures for PHI at termination, and any exceptions required by law.

Signatures & Authority

Identify authorized signatories, effective dates, countersignature order if needed, and whether notarization is required for specific attachments.

Security and compliance facts to record

Encryption: TLS 1.2/1.3; AES-256 at rest

HIPAA Status: BAA required for business associates

Audit Trail: Detailed timestamps and action log

Authentication: Multi-factor or equivalent controls

Standards: SOC 2 Type II and ISO 27001

Regulatory Fit: ESIGN and UETA compliant

Step-by-step: completing and executing a Healthcare Exhibit

Follow these ordered steps to prepare, review, sign, and retain a Healthcare Exhibit so it is enforceable and compliant.

01

Draft the Exhibit: Populate scope, security, and retention fields.
02

Internal Review: Legal and privacy teams validate obligations.
03

Signatures: Authorized signers execute in agreed order.
04

Record and Store: Save final executed copy with contract files.

Configuring an online completion workflow for the exhibit

Set form fields, signer order, and authentication so the exhibit can be completed electronically while meeting HIPAA and contract requirements.

Field	Configuration
Signature Authentication	Email link plus optional SMS code
Conditional Fields	Show data-access details only when vendor checkbox selected
Attachment Upload	Allow supporting certificates and BAA documents
Audit Trail	Enable timestamped activity log

Delivery methods and technical integrations for the exhibit

Maintain consistent log records across systems and ensure integrations support exportable audit trails for compliance reviews.

Secure eSignature: Email links, SMS codes, or authenticated portals
Integrations: CRM and document systems like Salesforce or NetSuite
Storage: Encrypted cloud storage with access controls

Where the completed Healthcare Exhibit should be sent or stored

Routing the executed exhibit to the right systems and stakeholders ensures enforceability and quick access for audits or patient requests.

Master Contract File: Attach executed exhibit to the primary agreement record.
Privacy Office: Provide a copy to the privacy/compliance team.
Vendor Record: Store with vendor onboarding documentation.
Document Archive: Preserve an immutable copy in records retention system.

Key dates and timelines to note for Healthcare Exhibits

Track execution, effective, and post-termination dates to meet retention and notification requirements under applicable law.

Execution Date:

Date when all required parties have signed and the exhibit becomes binding.

Effective Date:

Date obligations begin; use MM/DD/YYYY format consistently.

Breach Notification Window:

Follow contract and HIPAA timelines for prompt notification.

Record Retention Start:

Retention typically measured from creation or last effective date.

Access Request Response:

Patient access requests generally processed within statutory timelines.

Typical processing milestones for a Healthcare Exhibit

A standard execution lifecycle includes drafting, internal approvals, signature collection, and archival; track each milestone to avoid delays.

01

Draft Complete

Exhibit content finalized and ready for legal review.

02

Compliance Review

Privacy and security teams confirm controls and BAA needs.

03

Signature Collection

Authorized signers execute in agreed order.

04

Archive and Index

Executed copy stored in records management system.

Common mistakes when preparing a Healthcare Exhibit

Vague data use language that fails to limit PHI sharing to specific purposes, creating legal exposure and operational confusion.
Missing or inconsistent signature authority where signers lack delegated powers, causing enforceability disputes during audits or disputes.
Omitting a required BAA or failing to document a vendor's HIPAA obligations leading to compliance and breach-notification risks.
Incorrect retention instructions that conflict with HIPAA or IRS rules, resulting in noncompliance during regulatory review.

Primary legal and operational risks to address

HIPAA Liability: Civil and criminal penalties for noncompliance

Breach Costs: Notification, remediation, and forensic expenses

Contract Claims: Indemnity and breach-of-contract damages

Invalid Signature: Signature defects can void exhibit terms

Regulatory Audit: Enforcement reviews with document requests

Operational Disruption: Service interruptions from unresolved obligations

Representative eSignature pricing and capability comparison

Basic pricing and compliance features for common eSignature vendors. Choose platforms that meet HIPAA and contractual security requirements.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Practical examples of Healthcare Exhibits in use

These examples show how organizations document PHI handling and contract terms using a focused exhibit.

Fertility Clinic Implementation

A fertility center added a HIPAA addendum to vendor contracts to standardize PHI handling across clinics

The exhibit limited data sharing to treatment and billing only
This reduced review cycles and clarified breach notification steps for all vendor relationships.

Vendor Onboarding

A health system required a standardized exhibit for all new software vendors handling ePHI

The exhibit specified encryption and access controls
That approach accelerated approvals and ensured consistent BAAs were in place across deployments.

Frequently asked questions about Healthcare Exhibits

Answers to common execution, compliance, and retention questions for Healthcare Exhibits used in U.S. contracts.

Need help? Contact support

Can the exhibit be signed electronically?
Yes. Electronic signatures are generally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure the electronic process captures signer intent, consent, attribution, and retention capability to meet the legal-validity test.
Is a BAA required with every vendor?
A Business Associate Agreement is required when a vendor will create, receive, maintain, or transmit protected health information on behalf of a covered entity. The exhibit can reference or include the BAA language to document responsibilities and breach procedures.
How long must I retain the executed exhibit?
Follow HIPAA's six-year retention requirement for related records (45 CFR §164.530(j)) and retain contract documents per IRS and state rules; reconcile all minimums in a records retention schedule.
When is notarization needed?
Notarization depends on state law and document type. Some states or specific attachments may require notarization; check the applicable state rules or include notarization in the exhibit when parties prefer added authentication.
What should trigger a revision to the exhibit?
Material changes to data handling, new regulatory requirements, expansions of permitted uses, or transfers of systems handling PHI should prompt an exhibit amendment and re-execution by authorized signers.
Who enforces breach notification obligations?
Party responsibilities are contractual; HIPAA enforcement rests with the HHS Office for Civil Rights. The exhibit should set internal notification timelines and vendor duties to support regulatory reporting.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now