Who must sign the MOA?

An authorized representative with corporate signing authority must sign. Check internal delegation-of-authority policies and confirm that the signatory’s name and title match organizational records to avoid contract challenges.

Is a BAA required with the MOA?

If the counterparty will create, receive, maintain, or transmit protected health information, a Business Associate Agreement is required under HIPAA. Include the BAA as an exhibit or reference it explicitly in the MOA.

Can the MOA be signed electronically?

Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and record retention are satisfied.

Do MOAs require notarization or witnesses?

Most MOAs do not require notarization by default, but state law or counterparty policy may require notarization or witnesses for specific clauses; check applicable state requirements before execution.

How should executed MOAs be stored?

Store executed originals or certified electronic copies in a secure records system with access controls and encryption, and ensure retention schedules comply with HIPAA and other regulatory rules.

How to handle amendments?

Document amendments in writing, reference the original MOA, include an effective date, and collect signatures from the same authorized signatories or their successors.

Electronic Signature
Templates
Healthcare
Healthcare Facility MOA

Healthcare Facility MOA

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE FACILITY MEMORANDUM OF AGREEMENT (MOA)

This Memorandum of Agreement (MOA) is made and entered into by and between Facility Name: and Partner Entity: , effective as of Effective Date: .

1. Purpose

The purpose of this MOA is to define the roles, responsibilities, and procedures for coordination of patient care, exchange of health information, and shared services between the parties identified above. This MOA establishes the operational framework for referrals, transfer of clinical records, provision of services, and compliance with applicable privacy and data-security obligations.

2. Definitions

For purposes of this MOA: "Protected Health Information" or "PHI" means individually identifiable health information as defined under applicable law; "Discloser" means the party disclosing PHI; "Recipient" means the party receiving PHI.

3. Scope of Services and Responsibilities

3.1 Facility Responsibilities: The Facility shall provide clinical services, maintain medical records, and furnish timely clinical summaries for referred patients in accordance with professional standards and applicable law. The Facility shall ensure that PHI released to Partner Entity is limited to the minimum necessary to accomplish the permitted purpose.

3.2 Partner Entity Responsibilities: The Partner Entity shall accept referrals and provide follow-up care or coordination as specified in referral documents; shall protect PHI as required by this MOA; and shall promptly notify Facility of any adverse events reasonably related to referred patients.

4. Patient Representative for Initial Implementation

Designated patient for initial data exchange (for implementation testing and validation only):

Patient Full Name Date of Birth Gender Address Primary Phone Emergency Contact (Name and Phone)

5. Insurance and Billing Information

Insurance Provider Policy Number Group Number Subscriber Name

6. Medical History

Current Medications Allergies Prior Surgeries Chronic Conditions / Significant Diagnoses

7. Privacy, Confidentiality and HIPAA Compliance

Each party shall implement administrative, technical and physical safeguards to protect PHI in its possession, consistent with applicable law. PHI shall be disclosed only as permitted under this MOA and pursuant to any required patient authorizations. The parties agree to use or disclose PHI only to the minimum extent necessary to accomplish the purposes set forth in this MOA.

In the event of an unauthorized access, use, or disclosure of PHI attributable to a party's act or omission, the responsible party shall notify the other party without unreasonable delay and shall cooperate in any required mitigation, investigation, and notification efforts.

Patient Authorization on File

The parties confirm that a valid patient authorization or permissible legal basis for disclosure exists for PHI exchanged under this MOA.

8. Data Sharing, Transmission and Record Retention

PHI exchanged under this MOA shall be transmitted using secure methods which provide appropriate encryption and access controls. Each party shall maintain records of disclosures and retain clinical records in accordance with statutory retention requirements and professional standards.

Record Retention Period (years)

9. Liability, Indemnification and Insurance

Each party shall be responsible for its own negligent acts and omissions. To the extent permitted by law, each party shall indemnify, defend and hold harmless the other party from any third-party claims arising from the indemnifying party's breach of this MOA or its negligent acts or omissions. Each party shall maintain professional liability and general liability insurance in commercially reasonable amounts during the term of this MOA.

10. Term and Termination

This MOA shall commence on the Effective Date and shall continue for Term (months): unless sooner terminated as provided herein. Either party may terminate this MOA for cause upon thirty (30) days' written notice if the other party materially breaches any obligation and fails to cure within the notice period.

11. Notices

All notices required or permitted under this MOA shall be in writing and delivered to the addresses below by hand, certified mail, or reputable courier service. Notice is effective upon receipt.

Facility Notice Address Partner Entity Notice Address

12. Dispute Resolution and Governing Law

The parties shall attempt in good faith to resolve disputes arising under this MOA by negotiation between senior representatives. If unresolved, disputes shall be resolved by binding arbitration consistent with the parties' mutual agreement. This MOA shall be governed by the laws of Governing Jurisdiction: , without regard to conflict-of-law principles.

13. Miscellaneous

This MOA constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior negotiations and understandings. No amendment shall be effective unless in writing and signed by authorized representatives of both parties. Neither party may assign this MOA without the prior written consent of the other, except to an affiliate or successor in interest.

14. Acknowledgment

The undersigned represent and warrant that they are authorized to execute this MOA on behalf of the entity they represent and that the information provided herein is true and correct to the best of their knowledge.

Party A (Facility) - Printed Name:

By:

Date:

Party B (Partner Entity) - Printed Name:

By:

Date:

What the Healthcare Facility MOA Is and when it’s used

A Healthcare Facility MOA (Memorandum of Agreement) is a written contract describing roles, responsibilities, and terms between a healthcare facility and a counterparty such as a vendor, contractor, or partner. Typical MOAs cover scope of services, data handling, payment terms, liability allocation, confidentiality, regulatory compliance, and effective dates. In healthcare settings MOAs often include HIPAA-specific provisions for protected health information handling and may be paired with Business Associate Agreements where required. MOAs are legally binding when executed by authorized signatories and when the parties demonstrate intent and consent to the agreement.

Why a clear MOA matters for healthcare operations

A well-drafted Healthcare Facility MOA clarifies expectations, reduces disputes, and documents compliance obligations such as HIPAA privacy and security requirements. It helps operationalize vendor roles and creates an audit-ready record of agreed responsibilities, timelines, and data protections.

Who commonly prepares and signs a Healthcare Facility MOA

Typical preparers and signers span clinical, administrative, and legal teams; distribution depends on organizational size and risk profile.

Contract Administrators and Procurement: Prepare scope, payment milestones, and contract exhibits; coordinate review with legal and finance.
Health Information Management and Compliance: Review PHI handling, HIPAA obligations, and BAA linkage to ensure regulatory alignment.
Senior Leadership and Authorized Officials: Execute the final agreement and confirm authority to bind the facility.

In larger systems the legal department or corporate counsel often centralizes MOA templates and signature authority; smaller facilities may route via the administrator or CEO.

Step-by-step: completing a Healthcare Facility MOA

Follow these four core steps to complete and execute the MOA accurately and with required approvals.

01

Prepare draft: Assemble scope, deliverables, timelines, and compliance clauses for reviewer input.
02

Internal review: Route to legal, compliance, and clinical leads for redlines and HIPAA review.
03

Signature readiness: Confirm signatory authority, notarization needs, and effective date formatting.
04

Execution: Collect signatures, record the audit trail, and distribute executed copies to stakeholders.

Frequently asked questions about Healthcare Facility MOAs

Answers to common execution, compliance, and storage questions for Healthcare Facility MOAs.

Need help? Contact support

Who must sign the MOA?
An authorized representative with corporate signing authority must sign. Check internal delegation-of-authority policies and confirm that the signatory’s name and title match organizational records to avoid contract challenges.
Is a BAA required with the MOA?
If the counterparty will create, receive, maintain, or transmit protected health information, a Business Associate Agreement is required under HIPAA. Include the BAA as an exhibit or reference it explicitly in the MOA.
Can the MOA be signed electronically?
Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and record retention are satisfied.
Do MOAs require notarization or witnesses?
Most MOAs do not require notarization by default, but state law or counterparty policy may require notarization or witnesses for specific clauses; check applicable state requirements before execution.
How should executed MOAs be stored?
Store executed originals or certified electronic copies in a secure records system with access controls and encryption, and ensure retention schedules comply with HIPAA and other regulatory rules.
How to handle amendments?
Document amendments in writing, reference the original MOA, include an effective date, and collect signatures from the same authorized signatories or their successors.

Security and compliance items to include in the MOA

HIPAA protections: BAA required

Encryption: AES-256 data at rest

Access controls: Role-based access

Audit logs: Detailed activity trail

Breach notification: Timing and responsibilities

Record retention: Retention schedule

Potential risks and penalties for incomplete or incorrect MOAs

HIPAA violation: Civil and criminal penalties

Contract dispute: Financial exposure

Operational delay: Service interruptions

Payment hold: Delayed reimbursements

Regulatory fines: State or federal fines

Reputational harm: Loss of trust

Common preparation mistakes to avoid

Using informal or ambiguous service descriptions that create performance disputes and require costly clarifications.
Failing to attach a required BAA when PHI is involved, which exposes the facility to HIPAA compliance risk.
Entering inconsistent party names or tax identification numbers that delay payment and vendor onboarding.
Overlooking signature authority or failing to notarize where state law or counterparty policy requires notarization.

Essential sections to include in a professional Healthcare Facility MOA

Include these six core sections to create a clear, enforceable MOA that addresses both operational and compliance needs.

Parties

Identify legal names, mailing addresses, and contact points for the facility and the counterparty to ensure clear contractual identity.

Scope

Define services, deliverables, performance standards, and acceptance criteria so obligations and deliverables are unambiguous and measurable.

Compensation

Detail payment amounts, invoicing cadence, reimbursement terms, late payment interest, and any holdback or milestone conditions.

Privacy

Describe PHI handling, breach reporting, encryption, and attach a BAA if the party will access protected health information.

Liability

Allocate indemnities, liability caps, and insurance requirements tailored to clinical and nonclinical exposures.

Term & termination

State effective date, term length, renewal conditions, termination rights, and post-termination transition obligations.

Routing and signing flow for an electronic Healthcare Facility MOA

A typical e-signature workflow reduces friction while preserving an audit trail for compliance and recordkeeping.

Upload document: Sender uploads final MOA to the signing platform.
Add fields: Place signature, date, and initial fields for each party.
Authenticate signer: Use email, SMS, or stronger methods for identity verification.
Complete signing: Collect signatures and store the executed copy with an audit trail.

Configuring an electronic workflow for the MOA

Use these workflow settings to ensure secure routing, required approvals, and a complete audit record for the MOA.

Field	Configuration
Signature Order	Sequential or parallel signer routing
Authentication	Email link, SMS code, or KBA
Attachments	Attach BAA or exhibits as required
Audit Trail	Capture IP, timestamps, and action history

Technical requirements for eSigning and secure storage

Confirm platform capabilities before eSigning to meet security and integration needs.

File formats: PDF and DOCX supported
Integrations: Connects to EHRs, SharePoint, NetSuite
Compliance: Supports HIPAA and SOC 2

Ensure the chosen platform supports encryption in transit and at rest, audit trails, and any required BAAs to maintain regulatory compliance.

Timing considerations and typical deadlines for MOA processing

Track execution, delivery, and archival deadlines to maintain enforceability and meet compliance windows.

Execution Date:

Sign and record the effective date in MM/DD/YYYY format upon final signature.

Delivery Window:

Distribute executed copies to stakeholders within 3 business days of final signatures.

Notarization Timing:

If notarization required, complete notarization at execution or within the timeframe specified by law or policy.

Amendment Deadlines:

Document and sign amendments promptly; specify effective dates for changes.

Audit Readiness:

Ensure archive copies are retrievable within 48 hours for regulatory review.

eSignature vendor comparison for Healthcare Facility MOAs

Compare core pricing and compliance attributes relevant to healthcare MOAs; signNow is listed first for parity across plans and features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now