Establishing secure connection…Loading editor…Preparing document…

Healthcare HIPAA Addendum

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE HIPAA ADDENDUM

Patient Information

Patient Name:    Date of Birth:

Phone:    Email:

Insurance (Optional)

Policy/ID #:    Group #:

Authorization to Use and Disclose Protected Health Information (PHI)

I hereby authorize the disclosure of the protected health information described below to the Recipient named in this Addendum. This authorization supplements any existing consent or authorization and governs disclosures not otherwise authorized by the Patient's general consent for treatment or payment.

PHI To Be Disclosed (check all that apply):

Duration and Expiration

This authorization expires on:     or upon the following event:

Revocation and Rights

I understand that I may revoke this authorization at any time by submitting a written revocation to the Health Information Management Department or the Privacy Officer of the disclosing entity, except to the extent that action has already been taken in reliance on this authorization. Revocation will not affect disclosures made prior to receipt of the revocation.

Redisclosure and Limitations

I understand that information disclosed pursuant to this authorization may be subject to redisclosure by the recipient and no longer be protected by federal privacy regulations. However, if the information disclosed includes records protected under state or federal laws (including but not limited to mental health records, HIV-related information, or substance use disorder treatment records), redisclosure is prohibited except as permitted by such laws.

Special Consent Acknowledgments

Notice of Privacy Practices Acknowledgment

I acknowledge that I have received or been offered a copy of the entity's Notice of Privacy Practices explaining how my health information may be used and disclosed and my rights with respect to that information.

Additional Instructions / Limitations

By signing below I authorize the uses and disclosures described in this Addendum. I understand that signing this form is voluntary and that treatment, payment, enrollment, or eligibility for benefits will not be conditioned on signing this authorization except where allowed by law.

Patient Name:

Signature:

Date:

Relationship to Patient (if signed by guardian or personal representative):

Certification: I certify under penalty of law that the information I have provided on this form is true and accurate and that I am the patient or am authorized to sign on behalf of the patient. I understand that I may request a copy of this authorization.

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the Healthcare HIPAA Addendum Is and when it’s used

A Healthcare HIPAA Addendum is a contractual attachment that defines how a business associate will handle protected health information (PHI) on behalf of a covered entity. It supplements a master services agreement or vendor contract by specifying permitted uses, required safeguards, breach notification duties, permitted disclosures, subcontractor rules, and termination conditions. The addendum documents compliance expectations under HIPAA and the Privacy and Security Rules and is commonly executed when a vendor accesses, stores, transmits, or processes PHI for health care operations or payment functions.

Why a clear HIPAA Addendum matters for compliance and risk

A properly drafted HIPAA Addendum reduces regulatory risk, clarifies responsibilities for PHI handling and breach response, and creates contractual remedies and audit rights that help both covered entities and business associates meet 45 CFR §164.502(e) and related HIPAA obligations.

Why a clear HIPAA Addendum matters for compliance and risk

Who typically completes or signs a Healthcare HIPAA Addendum

Covered entities and their vendors must agree on PHI handling before exchanging protected health information.

  • Healthcare providers and clinics that share PHI with third-party vendors for billing, analytics, or patient communications.
  • Business associates such as cloud hosting, billing companies, and IT service providers that store or process PHI.
  • Legal, compliance, or procurement teams responsible for contract risk, audit rights, and breach notification clauses.

Execution usually involves legal, privacy, and contract teams to ensure technical and contractual controls align with HIPAA requirements.

Key signatory roles for the addendum

Privacy Officer — Covered Entity

Responsible for ensuring the addendum reflects the covered entity’s HIPAA policies, verifying permitted uses of PHI, and coordinating technical and administrative safeguards with vendors to reduce exposure and maintain audit readiness.

Compliance Officer — Business Associate

Accountable for implementing the security controls and processes named in the addendum, responding to breach notices, and supplying evidence of safeguards and incident handling to the covered entity upon request.

Core components a professional HIPAA Addendum should include

A compliant addendum covers scope, safeguards, breach rules, subcontractor flow-down, termination, and audit rights. Each component should be explicit and measurable to reduce interpretation gaps during incidents and audits.

Scope of PHI

Specify categories of PHI involved, purpose of use, and any excluded data types so obligations are limited to defined processing activities and records.

Permitted Uses

List allowed purposes (e.g., payment, treatment, operations) and prohibit other uses such as marketing or sale without explicit authorization.

Safeguards

Require administrative, physical, and technical safeguards consistent with HIPAA Security Rule, including encryption, access controls, and periodic risk assessments.

Subcontractors

Obligate subcontractors to execute equivalent flow-down addenda and permit the covered entity to review or audit subprocessors handling PHI.

Breach Notification

Define immediate notification obligations, required content, and timelines for reporting breaches to covered entities and regulatory authorities.

Termination & Return

Describe return or destruction of PHI upon termination, exceptions for legal hold, and remedies for noncompliance or material breach.

Essential information and fields the addendum should capture

Covered Entity: Full legal name
Business Associate: Full legal name
PHI Scope: Types of PHI shared
Effective Date: MM/DD/YYYY format
Breach Notices: Contact and timeline
Signature Block: Signer name and title

Step-by-step: Signing and executing a HIPAA Addendum

Follow a concise sequence from drafting to execution to ensure contractual and operational readiness before PHI exchange.

  • 01
    Draft: Prepare addendum language aligning with existing contract.
  • 02
    Review: Legal and privacy teams vet scope and safeguards.
  • 03
    Negotiate: Resolve obligations, audit rights, and breach terms.
  • 04
    Execute: Sign and retain executed copies for records.

Configuring the addendum for online completion

Set up fields, authentication, and retention rules when preparing an online HIPAA Addendum workflow.

Field | Configuration Example setup | Value description
Signature Authentication Email link, SMS code, or stronger KBA where required
BAA Attachment Attach executed BAA or reference BAA section
Conditional Fields Show technical controls if PHI access is granted
Audit Trail Enable full event logging and exportable certificate

Digital signing and platform requirements for e-execution

Choose a platform that supports secure e-signing, audit trails, and a HIPAA BAA where required.

  • Authentication: Email, SMS, or multi-factor options
  • Audit Trail: Timestamp, IP, and action log
  • BAA Support: Vendor must offer a BAA

Where to send, store, and register the executed addendum

Routing the signed addendum should be consistent, auditable, and integrated with contract repositories and records management systems.

  • Legal/Contracts: Store executed copy in contract management
  • Vendor Records: Vendor retains its signed copy per agreement
  • EHR / IT Team: Notify operations teams of access rules
  • Audit Archive: Retain audit trail in secure repository

Key timelines, notification windows, and processing expectations

Establish dates and deadlines for execution, breach notification, review cycles, and retention to meet regulatory and internal control obligations.

Effective Date:

Date obligations begin; set as MM/DD/YYYY

Execution Window:

Complete signing before PHI is shared

Breach Notification Deadline:

Notify covered entity promptly; HHS expect reporting within 60 days

Review Cycle:

Annual or trigger-based contractual review

Retention Trigger:

Retention starts at creation or last effective date

Common mistakes when preparing a HIPAA Addendum

  • Omitting a clear PHI scope so parties disagree about what data is covered during an incident.
  • Failing to require subcontractor flow-down, leaving downstream processors without contractual safeguards or audit rights.
  • Using weak signer authentication that makes attribution and intent difficult to substantiate under ESIGN and UETA.
  • Missing breach notification specifics or contact details, causing delayed response and regulatory exposure.

Contract and regulatory risks if the addendum is incorrect or missing

Regulatory Enforcement: OCR investigation risk
Civil Penalties: Monetary fines and settlements
Breach Liability: Potential damages and remediation costs
Contract Termination: Loss of vendor access or service
Reputational Harm: Trust and brand consequences
Operational Disruption: Service interruptions and remediation

Downloading, saving, and attaching supporting documents

Preserve the signed addendum and supporting material in formats that ensure long-term readability, forensic integrity, and auditability for regulatory and contractual reviews.

PDF/A Export

Export the fully executed addendum as PDF/A to preserve fidelity and meet archival standards; include the audit certificate embedded or attached for evidentiary value.

DOCX Source

Retain the original editable DOCX or Word source separately for future amendment workflows, while storing only the signed PDF in the contract repository.

Audit Trail Export

Save a timestamped audit trail showing signer identity, IP, and action log; this supports ESIGN three-prong evidence of intent, attribution, and retention.

Supporting Attachments

Attach the signed BAA, security documentation, evidence of encryption controls, and subprocessors list to the contract folder for review and audits.

Real-world examples of HIPAA Addendum use

Two customer scenarios show how addenda support compliance and operational continuity when vendors handle PHI.

Fertility Clinic — John Butler

A mid-size clinic required a vendor addendum before sharing patient records for billing and reporting

  • The vendor agreed to encryption and audit rights
  • "The airSlate SignNow team has been exceptional, responsive, the API has been great, and we're extremely happy that we chose airSlate SignNow as a company."

Property Management — Tim Martin

A manager needed a PHI flow-down for assisted-living resident care vendors

  • Negotiated subcontractor flow-down and breach notice terms
  • "I can process and execute all of these documents online with 100% compliance and built-in security."

Comparison of eSignature vendors for HIPAA Addendum execution

Vendor pricing and feature availability vary; signNow appears first and entries reflect common plan starting prices and basic capability differences.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Frequently asked questions about Healthcare HIPAA Addenda

Answers to common practical questions on enforceability, e-signing, signatory authority, retention, and breach response.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.