Are electronic signatures legally valid?

Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA statutes where adopted; ensure intent, consent, attribution, and retention to meet legal tests.

Do I need a HIPAA BAA for eSignature vendors?

If the assurance or attachments include PHI and the vendor will access or store PHI, execute a Business Associate Agreement (BAA) before transmitting protected information.

What level of signer authentication is required?

Authentication depends on institutional policy and study risk; common methods include email verification, SMS one-time codes, KBA, or institutional single sign-on for stronger identity assurance.

How do I update or amend a signed assurance?

Amendments should be documented as an addendum signed by the same authorized official and recorded with the original assurance to maintain an auditable change history.

How long should signed assurances be retained?

Retain according to the longest applicable rule: institutional policy, sponsor terms, or HIPAA when PHI applies (HIPAA retention six years under 45 CFR §164.530(j)).

What security features should the vendor provide?

Look for TLS 1.2/1.3 transit encryption, AES-256 at-rest encryption, detailed audit trails, SOC 2 Type II, HIPAA BAA availability, and configurable retention controls.

Electronic Signature
Templates
Healthcare
Healthcare Human Subjects Research Assurance

Healthcare Human Subjects Research Assurance

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE HUMAN SUBJECTS RESEARCH ASSURANCE

Institution Identification

Institution Name Institution Address

Assurance Identification

Effective Date

Expiration Date

Responsible Official and Institutional Contacts

Authorized Official - Name Authorized Official - Title

Office Phone

Email

Institutional Review Board / Ethics Committee

IRB / Ethics Committee Name IRB Contact

Review Mechanism (select all that apply): Full Board Review Expedited Review Exempt Determination Not Applicable

Scope of Assurance and Covered Activities

The institution hereby assures that all human subjects research conducted under its auspices will be designed, reviewed, and conducted in accordance with applicable laws, regulations, and standards for the protection of human subjects, including but not limited to requirements for institutional oversight, informed consent, and data privacy.

Types of Research Covered (check all that apply)

Biomedical Behavioral Social Sciences Other

If Other, describe Vulnerable Populations Included (check all that apply)

Children Pregnant Women/Fetuses Prisoners Cognitively Impaired / Decisionally Incapacitated None of the above

Assurances, Policies and Procedures

The institution certifies that it has in effect written policies and procedures to ensure compliance with ethical and regulatory requirements for human subjects research. Policies shall include: oversight by an IRB or equivalent, processes for obtaining and documenting informed consent, protections for privacy and confidentiality, secure data handling, training of research personnel, conflict of interest management, and procedures to identify and report unanticipated problems and suspensions or terminations of research.

Designated Compliance Officer Record Retention Policy (years) Training Program for Human Subjects Protection

The institution will ensure that all investigators and key personnel engaged in human subjects research complete appropriate instruction in the protection of human subjects prior to participation in research and at intervals thereafter sufficient to maintain competency.

Privacy and Data Security / HIPAA Considerations

The institution affirms that research involving individually identifiable health information will be conducted in accordance with applicable privacy and data security requirements. Where applicable, appropriate authorizations, data use agreements, and safeguards will be implemented to protect confidentiality and limit uses and disclosures of protected information.

Privacy Compliance Acknowledgment

Institution maintains policies and safeguards to protect individually identifiable health information used in research.

Adverse Events, Reporting, and Audit

The institution will ensure prompt reporting of unanticipated problems involving risks to subjects or others and will cooperate with any investigations, audits, or corrective actions conducted by regulatory bodies or the institution's oversight entities. Procedures for reporting, review, and corrective action shall be documented and accessible to relevant personnel.

Describe reporting and audit procedures

Conflict of Interest and Research Misconduct

The institution affirms that it has policies for identification and management of financial and non‑financial conflicts of interest in research. The institution further affirms it has policies and procedures to address allegations of research misconduct, including investigation, corrective action, and notification as required by applicable standards.

Conflict of Interest Policy Name:

Participant Contact Information (if applicable for recruitment)

Use this section if the institution maintains a pool of potential participants or a recruitment contact point for human subjects research.

Contact Name

Contact Phone

Contact Email

Assurance Certification and Signature

By signing below, the authorized institutional official certifies that the institution will: (1) comply with applicable laws, regulations, and ethical standards governing the protection of human subjects in research; (2) maintain an appropriate IRB or ethics review mechanism; (3) ensure informed consent is obtained and documented when required; (4) protect the privacy of subjects and maintain confidential handling of research data; (5) provide education and oversight for investigators and staff; and (6) report promptly to oversight authorities and the IRB any unanticipated problems or suspensions and take corrective actions as required.

This assurance remains in effect for the period identified above and may be amended or terminated in accordance with institutional policy and applicable law. Institution attests that the information provided on this form is true and complete to the best of its knowledge.

Authorized Official Printed Name:

Title:

Signature:

Date:

What the Healthcare Human Subjects Research Assurance Is

A Healthcare Human Subjects Research Assurance documents an institution's commitment to protect participants in human subjects research and to comply with applicable federal regulations, ethical standards, and institutional policies. It typically records institutional review board (IRB) oversight arrangements, responsible officials, assurance numbers, and processes for informed consent, privacy protections for protected health information (PHI), and incident reporting. For studies involving federal funding or regulated clinical investigations, the assurance ensures the institution meets regulatory expectations and can be relied upon by sponsors and oversight bodies.

Why a Formal Assurance Matters for Healthcare Research

A formal assurance establishes institutional responsibility for human subjects protections, clarifies roles for investigators and IRBs, and documents compliance measures for privacy and safety rules such as HIPAA and federal human subjects protections.

Who Typically Prepares or Signs an Assurance

Institutions and individuals across research administration prepare and approve assurances to meet regulatory, sponsor, and institutional requirements.

Institutional Official: Senior administrator who accepts institutional responsibility for human subjects protections and signs the assurance.
Principal Investigator: Provides study-specific details and affirms protocol adherence and informed consent procedures.
IRB Administrator: Confirms IRB oversight, review status, and processes for continuing review and adverse event reporting.

Knowing which role completes each section helps prevent delays and ensures the assurance is accepted by funders, IRBs, and oversight agencies.

Core Elements Included in a Professional Assurance

A complete assurance collects institutional identification, authorizing signatures, IRB and protocol details, PHI safeguards, training requirements, and reporting obligations to create an auditable commitment to participant protections.

Institution ID

Legal entity name, mailing address, and institutional Federalwide Assurance (FWA) or equivalent identifier when applicable; used for official records.

Authorized Official

Name and title of the institutional official authorized to accept responsibility for human subjects protections and to sign on behalf of the institution.

IRB Oversight

IRB name, IRB approval or reliance arrangement details, review frequency, and contact information for the IRB administrator.

Protocol Details

Protocol title, principal investigator, sponsor, and study identifiers that link the assurance to specific research activities.

Privacy Safeguards

Description of PHI protections, whether a HIPAA authorization or waiver applies, and whether a Business Associate Agreement (BAA) is in place.

Reporting & Training

Adverse event and unanticipated problem reporting processes, mandatory investigator training, and recordkeeping and retention provisions.

Required Identification and Reference Fields

Institution Name: Full legal name

FWA / Assurance: Number or 'Not applicable'

IRB Name: Review board title

Principal Investigator: Full name and contact

Protocol Title: Official study title

Effective Date: MM/DD/YYYY

Stepwise Process to Complete an Assurance

Follow these steps in order to prepare a complete and reviewable assurance for human subjects research.

01

Gather documents: Collect IRB approval and protocol materials.
02

Complete fields: Enter institution and study information accurately.
03

Attach PHI agreements: Include HIPAA authorization or BAA as needed.
04

Obtain signatures: Authorized official signs with date and title.

How to Configure an Online Assurance Workflow

Set up the digital workflow to match institutional roles and regulatory requirements for authentication and recordkeeping.

Upload template	Use PDF or DOCX template; ensure form fields mapped.
Add signer roles	Assign roles for PI, IRB rep, and institutional official.
Authentication method	Choose email, SMS code, or advanced auth per policy.
Attach HIPAA BAA	Include executed BAA for any PHI processing parties.
Retention policy	Set secure retention and export settings per law.

Where Completed Assurances Are Sent or Filed

Identify the typical recipients and filing destinations for the signed assurance to ensure compliance and traceability.

Institutional Records: Retain signed assurance in institutional research office.
IRB Office: Provide copy to the IRB for administrative records.
Sponsor or Funder: Send signed assurance to sponsor when required.
OHRP or Registry: Submit or reference FWA when federal oversight applies.

Technical and Security Considerations for eSubmission

Use a platform that supports secure PDFs, auditable signatures, and HIPAA-compliant workflows for any assurance that touches PHI.

File formats: PDF, DOCX, and printable archives
Authentication: Email, SMS, or advanced methods
Integrations: CRMs and cloud storage supported

Ensure the vendor provides an auditable trail (timestamps, IP, signer identity), encryption in transit and at rest, and a HIPAA Business Associate Agreement when PHI is involved.

Timelines and Typical Timeframes to Monitor

Track approval dates, continuing review cycles, and reporting timelines closely; timely filings and reports avoid noncompliance findings and sponsor delays.

IRB Approval Date:

Document start of approval period immediately

Continuing Review:

Schedule per IRB-approved interval

Adverse Event Reporting:

Follow IRB/sponsor timelines for reporting

Funder Requirements:

Meet sponsor submission deadlines as stated

Record Retention Start:

Retention begins on study closeout date

Common Preparation Errors to Avoid

Using inconsistent names for the institution or PI across documents causes processing delays and may invalidate the assurance.
Omitting an executed BAA when PHI is shared can create HIPAA compliance gaps and expose the institution to regulatory risk.
Failing to attach IRB approval letters or documentation of IRB reliance arrangements leads to rejection by sponsors or oversight bodies.
Using informal or unsigned electronic images without a verifiable audit trail undermines enforceability and acceptance by regulators.

Consequences of an Incorrect or Incomplete Assurance

Loss of Funding: Federal awards at risk

Regulatory Action: Findings by oversight agencies

HIPAA Penalties: Civil fines and corrective action

Study Suspension: Enrollment or activity halted

Legal Exposure: Liability for participant harm

Reputational Harm: Institutional credibility affected

Practical Tips for Accurate and Efficient Completion

Apply these practical measures to reduce review cycles, facilitate acceptance by sponsors and IRBs, and maintain an auditable record.

Use consistent identifiers

Match the legal institution name, FWA number, and PI name to IRB and sponsor records to avoid reconciliation issues during review.

Attach supporting documents

Include IRB approval letters, consent form versions, HIPAA authorizations, and any BAAs to make the assurance review-ready for auditors.

Standardize electronic workflows

Set templates with fixed fields, required attachments, and signer roles to lower errors and speed processing across multiple studies.

Audit and archive

Retain the signed assurance and audit trail in secure, access-controlled storage to satisfy sponsors, auditors, and regulators.

Representative Use Cases and Institutional Examples

These condensed examples show how organizations document assurances to meet oversight, privacy, and sponsor requirements.

Fertility Clinic Example

A clinic completed an assurance to document IRB oversight for a multi-site study

staff attached IRB approval letters and BAAs
The signed record enabled the sponsor to confirm compliance and proceed with enrollment while preserving auditability.

Academic Medical Center

An academic center submitted a single institutional assurance covering multiple investigator-initiated studies

the research office centralized PI attestations and training records
centralization reduced duplication and eased sponsor and auditor requests.

eSignature Vendor Pricing and Compliance Snapshot

Compare typical starting prices, trial availability, bulk send capability, audit trail presence, HIPAA compliance, and envelope limits across common eSignature vendors.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently Asked Questions About the Assurance

Answers to common questions about legal validity, HIPAA considerations, signatures, updates, storage, and vendor security for the assurance.

Need help? Contact support

Are electronic signatures legally valid?
Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA statutes where adopted; ensure intent, consent, attribution, and retention to meet legal tests.
Do I need a HIPAA BAA for eSignature vendors?
If the assurance or attachments include PHI and the vendor will access or store PHI, execute a Business Associate Agreement (BAA) before transmitting protected information.
What level of signer authentication is required?
Authentication depends on institutional policy and study risk; common methods include email verification, SMS one-time codes, KBA, or institutional single sign-on for stronger identity assurance.
How do I update or amend a signed assurance?
Amendments should be documented as an addendum signed by the same authorized official and recorded with the original assurance to maintain an auditable change history.
How long should signed assurances be retained?
Retain according to the longest applicable rule: institutional policy, sponsor terms, or HIPAA when PHI applies (HIPAA retention six years under 45 CFR §164.530(j)).
What security features should the vendor provide?
Look for TLS 1.2/1.3 transit encryption, AES-256 at-rest encryption, detailed audit trails, SOC 2 Type II, HIPAA BAA availability, and configurable retention controls.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now