Can this attestation be signed electronically?

Yes. Under ESIGN and UETA, electronic signatures are generally legally valid in the United States when intent, consent, attribution, and record retention are satisfied; ensure any required consumer disclosures are provided for consumer‑facing transactions.

Is a Business Associate Agreement always required?

A BAA is required when a vendor performs services involving PHI on behalf of a covered entity. If the attestation indicates PHI access, attach a signed BAA to align contractual obligations and breach notification responsibilities.

What if the signer's name or title is incorrect?

Incorrect signer details can raise enforceability concerns. Correct the form, obtain a reattestation from an authorized representative, and maintain version history so auditors can trace changes and approvals.

Do attestations require notarization or witnesses?

Generally attestations do not require notarization, but state or contract terms may impose witness or notarization rules. Check jurisdictional requirements and contract clauses before assuming none are needed.

How long should attestations be kept?

Retain attestations according to applicable law and policy; HIPAA guidance recommends six years from creation or last effective date. Extend retention when subject to litigation holds or state‑specific mandates.

How do I revoke or amend an attestation?

Issue a written amendment or revocation signed by an authorized representative and circulated to all parties. Update contract records and, if PHI access continues, obtain a replacement attestation promptly.

Electronic Signature
Templates
Healthcare
Healthcare HIPAA Attestation Form

Healthcare HIPAA Attestation Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE HIPAA ATTESTATION FORM

Patient Information

Patient Name

Date of Birth: Gender:

Home Address

Phone: Email:

Emergency Contact

Name

Relationship: Phone:

Insurance Information

Primary Insurance Provider

Policy Number: Group Number:

Subscriber Name

Subscriber Date of Birth: Insurance Phone:

Medical History (brief)

Current Medications Known Allergies Prior Surgeries Chronic Conditions / Diagnoses

HIPAA Authorization and Attestation

I hereby authorize the use or disclosure of my protected health information as described below. This authorization is voluntary and is not a condition of treatment, payment, enrollment, or eligibility for benefits. I understand that the information disclosed under this authorization may include health information relating to diagnoses, treatment, medications, and billing.

Purpose of Disclosure Recipients / Organizations Authorized to Receive Information Types of Information to Be Disclosed (check all that apply)

Medical records and clinical notes Billing and payment information Mental health records (psychotherapy notes excluded unless specified) Substance abuse treatment records HIV/AIDS-related information

I understand that information used or disclosed pursuant to this authorization may be subject to redisclosure by the recipient and no longer protected by federal privacy regulations, except where restricted by law. I also understand that I may inspect or copy the protected health information to be used or disclosed as provided by law.

Authorization Expiration

I understand that I may revoke this authorization at any time by submitting a written revocation to the health care provider's Privacy Officer. Revocation will not apply to information already released in reliance on this authorization prior to receipt of the revocation.

By signing below I attest that the information I have provided on this form is true and correct to the best of my knowledge. I acknowledge that I have received or been offered a copy of the facility's Notice of Privacy Practices and that I understand my rights regarding my protected health information.

A copy of this authorization is as valid as the original. This authorization will remain in effect until the date of expiration above, or until revoked in writing.

Acknowledgments

I acknowledge receipt of the Notice of Privacy Practices. I understand I may revoke this authorization in writing at any time.

Certification and Signature

I hereby certify under penalty of perjury that I am the patient or the patient's personal representative and that I am authorized to execute this HIPAA authorization on behalf of the patient. I further certify that the information provided on this form is accurate and complete.

Patient / Representative Printed Name:

Signature:

Date:

If signed on behalf of patient, Relationship:

If representative, authority to act (briefly describe):

What the Healthcare HIPAA Attestation Form Is

The Healthcare HIPAA Attestation Form documents a party's commitments and controls for handling protected health information (PHI). It records administrative, technical, and physical safeguards, the scope of authorized access, and whether a Business Associate Agreement (BAA) applies. Organizations use it during vendor onboarding, contract execution, or periodic reassessment to show due diligence, clarify responsibilities for breach notification and data handling, and create an auditable record for compliance reviews and investigations under HIPAA and related state privacy laws.

Why a Signed HIPAA Attestation Matters

A signed attestation creates a clear, written record of HIPAA commitments; it reduces ambiguity in third‑party arrangements, demonstrates contractual and procedural controls for audits, and helps document due diligence when granting PHI access.

Who Typically Completes This Attestation

Typical users include vendor security leads, compliance officers, and contracting attorneys who review HIPAA obligations during onboarding.

Healthcare providers — privacy and compliance teams validating vendor controls and BAAs.
Business associates and vendors — IT and security leads completing attestations before PHI access.
Health plans and payer risk teams — assessing third‑party access and contractual privacy obligations.

Keep completed attestations with contract records so procurement, privacy, and audit teams can verify controls and review status over time.

Who Signs and Who Manages the Form

Vendor Security Lead

Completes the attestation on behalf of a vendor or subcontractor and documents implemented safeguards, encryption, access control, and breach notification processes. Provides evidence to the covered entity during onboarding and for periodic reassessment; signs as the authorized representative of the service provider.

Covered Entity Officer

Reviews and retains attestations received from vendors to confirm contractual scope and PHI access rules. Tracks reattestations, aligns BAAs and contracts, and stores the form for audit evidence and regulatory inquiries by enforcement agencies.

Essential Data and Security Items to Record

PHI Types: Describe categories of PHI accessed

Safeguards: Technical and administrative controls

BAA Status: Indicate whether a BAA exists

Effective Date: MM/DD/YYYY start date

Authorized Purpose: Purpose for PHI access

Contact Info: Responsible party name and email

Key Risks from an Incorrect or Missing Attestation

Regulatory Enforcement: Potential OCR investigations

Contract Liability: Breach of contractual terms

Operational Exposure: Uncontrolled PHI access

Audit Failures: Missing documentation risk

Reputational Harm: Loss of trust and clients

Data Breach Costs: Remediation and notification expenses

Common Preparation Errors to Avoid

Mismatched legal names between the attestation and government ID or contractual documents, which can invalidate signatures or create onboarding delays.
Failing to attach or reference a required Business Associate Agreement (BAA), leaving obligations and breach responsibilities ambiguous between parties.
Using vague or boilerplate language for safeguards rather than specific controls, making assessments and audits difficult to verify objectively.
Not documenting reattestation timing or material control changes, which complicates compliance evidence when settings or personnel change.

Step-by-Step: Completing the HIPAA Attestation

Follow these steps to complete, sign, and retain an accurate attestation for PHI handling and vendor onboarding.

01

Prepare: Gather contract, BAA, and control descriptions.
02

Complete Fields: Enter names, effective date, PHI types, and safeguards.
03

Review: Legal and compliance review for accuracy.
04

Sign and Store: Execute signatures and save to secure records.

How to Configure an Online Attestation Workflow

Suggested settings for digitizing the attestation ensure secure signing, capture audit evidence, and limit PHI exposure in the workflow.

Field Name and Configuration Settings	Configuration
Signer Authentication Method and Settings	Email link plus SMS one‑time passcode for stronger signer verification
Signature Field Placement and Behavior	Require printed name, signer title, and date in a mandatory signature block
Conditional Field Logic for PHI Access	Reveal PHI details only when the authorized-purpose checkbox is selected
Audit Trail Capture and Retention Settings	Record IP, timestamp, and audit certificate for each signing event

Where to Send and How the Attestation Moves

Typical routing shows how the form flows between requester, signer, and records retention to preserve evidence and control access.

Upload Document: Submit final attestation PDF to the signing platform.
Assign Signers: Add authorized representative emails and role order.
Execute Signatures: Signers authenticate and apply signatures electronically.
Archive: Store signed copy in secure records management system.

Technical Requirements for Secure eSubmission

Use a platform that supports secure formats, strong authentication, and audit trails when collecting attestations electronically.

Supported Formats: PDF, DOCX, and exportable audit logs
Integration Options: API, SSO, and common CRMs like Salesforce
Security Certifications: TLS in transit and AES‑256 at rest

Key Timing Considerations and Recommended Deadlines

Establish clear timing for completion, review, and retention to ensure attestations support compliance and contract management workflows.

Before PHI Access:

Complete and sign the attestation prior to granting any access to PHI.

Annual Reassessment:

Review and re‑attest at least every 12 months or upon material control changes.

Contract Renewal:

Reissue or confirm attestations when contracts are renewed or materially amended.

Retain for Compliance:

Maintain signed attestations according to retention rules and organizational policy.

Update After Incidents:

Amend attestations promptly following security incidents or control changes.

Real-World Examples of How Organizations Use Attestations

These representative customer arcs show common scenarios and outcomes when attestations are used correctly.

Fertility Centers of Illinois (John Butler)

During vendor onboarding the clinic required signed attestations from a telehealth vendor to document safeguards and BAAs.

The attestation clarified encryption and access rules.
As a result, the clinic retained auditable evidence linking the vendor's commitments to the clinic contract and satisfied internal and external audit requests without protracted follow-up.

Martin Properties (Tim Martin)

A property management firm used attestations when subcontractors handled tenant health data to document limited access and retention.

The form described purpose and access controls.
This allowed the firm to demonstrate due diligence in procurement records and reduced time needed to respond to regulatory inquiries about third‑party practices.

Practical Best Practices for Accurate Attestations

Adopt these practices to reduce risk, streamline reviews, and make attestations reliable evidence for audits and contracting.

Verify Signer Authority and Identity

Confirm the signer's title and authority to bind the organization, and verify identity using at least one form of government ID or platform authentication to avoid later disputes.

Attach a Signed BAA When Required

When a party will create, receive, transmit, or maintain PHI, attach or reference a fully executed Business Associate Agreement to align contractual responsibilities and breach notification obligations.

Be Specific About Controls and Purpose

Describe safeguards, encryption, logging, and the narrow authorized purpose for PHI access; specificity strengthens the attestation's probative value during audits or investigations.

Centralize Storage and Versioning

Store signed attestations in a secure central repository with version history and exportable audit trails to ensure reliable retrieval for compliance and legal needs.

eSignature Vendor Comparison: Pricing and Capabilities

Basic pricing and feature differences across common eSignature vendors to inform platform selection for HIPAA attestation workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7‑day free trial	Varies by plan	Varies by plan	Trial available	Trial available
Bulk Send	Yes	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently Asked Questions About HIPAA Attestations

Answers to common questions about signing, BAAs, retention, and what to do when details change.

Need help? Contact support

Can this attestation be signed electronically?
Yes. Under ESIGN and UETA, electronic signatures are generally legally valid in the United States when intent, consent, attribution, and record retention are satisfied; ensure any required consumer disclosures are provided for consumer‑facing transactions.
Is a Business Associate Agreement always required?
A BAA is required when a vendor performs services involving PHI on behalf of a covered entity. If the attestation indicates PHI access, attach a signed BAA to align contractual obligations and breach notification responsibilities.
What if the signer's name or title is incorrect?
Incorrect signer details can raise enforceability concerns. Correct the form, obtain a reattestation from an authorized representative, and maintain version history so auditors can trace changes and approvals.
Do attestations require notarization or witnesses?
Generally attestations do not require notarization, but state or contract terms may impose witness or notarization rules. Check jurisdictional requirements and contract clauses before assuming none are needed.
How long should attestations be kept?
Retain attestations according to applicable law and policy; HIPAA guidance recommends six years from creation or last effective date. Extend retention when subject to litigation holds or state‑specific mandates.
How do I revoke or amend an attestation?
Issue a written amendment or revocation signed by an authorized representative and circulated to all parties. Update contract records and, if PHI access continues, obtain a replacement attestation promptly.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now