Is an electronic signature valid?

Yes. Electronic signatures are generally legally binding under the ESIGN Act (15 U.S.C. §7001) and under UETA where adopted. Ensure intent to sign, consent to electronic records, clear attribution, and retained reproducible records to meet validity tests.

Do I need a Business Associate Agreement (BAA)?

Yes. Where PHI is created, received, maintained, or transmitted, HIPAA requires a BAA. Include BAA terms in the addendum or reference a signed BAA; see 45 CFR §164.502(e) and §164.504(e) for statutory obligations.

Who must sign the addendum?

Authorized representatives with documented signing authority should sign. For organizations this typically means a corporate officer or delegated signatory consistent with bylaws; verification of authority reduces enforceability risk.

Are notarization or witnesses required?

Generally not for commercial service addenda; ESIGN and UETA permit electronic execution. Exceptions exist for certain record types (wills, court orders). Verify state-specific notarization or witness rules if local law or contracting practices require them.

How long must signed addenda be retained?

Follow applicable standards: HIPAA-related records six years (45 CFR §164.530(j)); financial records at least three years (IRC §6501(a)); retain longer if state or industry rules require it.

Can subcontractors be added later?

Yes if the addendum permits subcontractor engagement with required approvals, flow-down obligations, and updated BAAs. Obtain evidence of subcontractor compliance before granting PHI access.

Electronic Signature
Templates
Healthcare
Healthcare Managed Services Addendum

Healthcare Managed Services Addendum

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE MANAGED SERVICES ADDENDUM

This Healthcare Managed Services Addendum (the Addendum) is entered into effective as of (Effective Date), by and between:

Healthcare Entity (Client): Managed Services Provider (Provider):

RECITALS

WHEREAS, the Client and Provider are parties to a Master Services Agreement governing the provision of information technology and managed services; and WHEREAS, the parties desire to set forth additional terms and obligations applicable to services that involve access to, use of, or handling of protected health information and other sensitive healthcare data.

1. DEFINITIONS

For purposes of this Addendum, the following definitions apply: "Protected Health Information" or "PHI" has the meaning set forth under applicable privacy laws; "Services" means the managed services and related deliverables described in Section 2; "Security Incident" means an actual or suspected unauthorized access, use, disclosure, modification or destruction of Client data, including PHI.

2. SCOPE OF MANAGED SERVICES

Provider shall perform the following managed services on behalf of Client. Provider will provide and maintain written procedures and documentation sufficient to demonstrate compliance with the obligations set forth herein.

Description of Services and Deliverables:

3. TERM; EXPIRATION

This Addendum commences on the Effective Date and continues for the term of the Master Services Agreement unless earlier terminated as provided herein. This Addendum shall expire on , unless extended in writing.

4. FEES; PAYMENT

Client shall pay Provider the fees for the Services in accordance with the payment terms of the Master Services Agreement, as modified by this Addendum.

Managed Services Fees (if applicable): Billing Cycle:

5. CONFIDENTIALITY AND PHI HANDLING

Provider acknowledges that compliance with applicable privacy and security laws is material to this Addendum. Provider shall implement and maintain administrative, physical and technical safeguards to protect PHI against any reasonably anticipated threats or hazards to the security or integrity of such PHI.

Data and PHI Retention Policy Summary:

Provider shall limit access to PHI to employees and subcontractors with a legitimate need to perform the Services and shall ensure that such personnel are bound by confidentiality obligations. Provider shall not use or disclose PHI except as permitted by Client in writing or as required by law.

6. SECURITY INCIDENTS; BREACH NOTIFICATION

Provider shall notify Client of any Security Incident involving Client data, including PHI, without unreasonable delay and in any event within seventy-two (72) hours of discovery. Notification shall include the nature and scope of the incident, affected data types, remediation steps taken, and contact information for further inquiries.

Primary Breach Notification Contact Name: Primary Breach Notification Contact Phone/Email:

7. SERVICE LEVELS; REMEDIES

Provider warrants that the Services will meet the service levels set forth below. If Provider fails to meet an applicable service level, Client may be entitled to service credits as set forth in the Master Services Agreement.

Target System Availability (Uptime) Percentage:

8. AUDIT, ACCESS TO RECORDS AND INSPECTION

Upon reasonable notice and during normal business hours, Provider shall permit Client or Client's designated auditor to inspect Provider's facilities, records and systems insofar as they relate to Provider's obligations under this Addendum and the security and handling of PHI, subject to reasonable confidentiality protections.

9. SUBCONTRACTORS

Provider may engage subcontractors to perform portions of the Services provided that: (a) Provider enters into written agreements with each subcontractor imposing obligations no less protective of Client's data and PHI than this Addendum; and (b) Provider remains liable for the acts and omissions of subcontractors.

10. DATA RETURN AND DESTRUCTION

Upon termination or expiration of the Services, Provider shall, at Client's direction, return all Client data and PHI in a machine-readable format and securely delete or destroy any residual copies within the timeframe agreed by the parties.

Preferred Data Return Format / Method:

11. INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify the other for claims arising from its gross negligence, willful misconduct, or material breach of this Addendum. Notwithstanding anything to the contrary, Provider's aggregate liability for claims arising out of or related to this Addendum shall not exceed the total fees paid by Client to Provider under the Master Services Agreement during the preceding twelve (12) months, except for liabilities arising from willful misconduct or violations of applicable privacy laws.

12. INSURANCE

Provider shall maintain commercial general liability, professional liability and cyber liability insurance in amounts customary for the industry and reasonable to cover its liabilities under this Addendum. Provider shall provide evidence of insurance upon Client's request.

13. COMPLIANCE WITH LAW

Provider shall comply with all applicable laws and regulations relating to privacy, security, and the handling of PHI, including rules governing breach reporting and patient privacy. Provider shall cooperate with Client in responding to requests from regulatory authorities concerning the Services and PHI.

14. NOTICES

All notices under this Addendum shall be given in writing to the contacts set forth below or to such other address as either party designates in writing.

Client Notice Contact Name: Client Notice Contact Address/Phone/Email: Provider Notice Contact Name: Provider Notice Contact Address/Phone/Email:

15. MISCELLANEOUS

Except as expressly modified by this Addendum, the Master Services Agreement remains in full force and effect. In the event of any conflict between the Master Services Agreement and this Addendum with respect to the handling of PHI and security obligations, the terms of this Addendum shall control.

Additional Terms / Amendments:

AUTHORIZATION

The undersigned represent and warrant that they are authorized to execute this Addendum on behalf of their respective parties and that execution of this Addendum creates binding obligations enforceable against such party.

Provider - Printed Name:

By:

Date:

Client - Printed Name:

By:

Date:

What the Healthcare Managed Services Addendum Covers

The Healthcare Managed Services Addendum is a contractual attachment that defines how managed service providers (MSPs) will deliver IT, hosting, and support services to healthcare organizations where protected health information (PHI) or other sensitive clinical data is involved. It documents responsibilities for HIPAA compliance, technical and administrative safeguards, breach notification, subcontractor use, and audit rights. The addendum clarifies service scope, data segregation, encryption expectations, incident response procedures, and termination handling. When executed alongside a master services agreement, it allocates risk, establishes reporting timelines, and sets compliance obligations for both parties.

Why a Dedicated Addendum Matters

A Healthcare Managed Services Addendum ensures explicit allocation of HIPAA obligations, documents technical controls and breach procedures, and reduces ambiguity about subcontractor access. It provides enforceable audit rights and documented timelines for incident reporting, limiting regulatory and contractual exposure.

Who Typically Prepares and Signs This Addendum

Typical participants include healthcare covered entities, managed service providers, and contracting officers or counsel who manage vendor relationships and compliance.

Healthcare organizations and clinics — legal/compliance and IT teams that must protect PHI and oversee vendors.
Managed service providers — technical and operations teams delivering services and agreeing to HIPAA controls.
Procurement, security, and legal counsel — review terms, negotiate liability, and approve audit rights.

Clear role definitions speed execution and reduce post-signature disputes about responsibility for PHI and security controls.

Essential Sections to Include in the Addendum

Core sections of a Healthcare Managed Services Addendum define services, data handling, security controls, compliance obligations, incident response, and audit and termination rights.

Scope of Services

Describe covered services, hours of support, included platforms, and explicit exclusions; tie the addendum to the master services agreement to avoid conflicting obligations and ensure scope clarity.

Data Classification

Identify PHI categories, non-PHI data, data residency requirements, retention rules, and handling procedures so both parties apply appropriate safeguards and access controls throughout the service lifecycle.

Security Controls

List minimum technical controls such as encryption in transit and at rest, access logging, multi-factor authentication, vulnerability management, patching windows, and third-party assessment frequency.

Business Associate Terms

Include HIPAA-specific obligations, permitted uses of PHI, breach notification duties, indemnity for violations, and requirement for a signed Business Associate Agreement (BAA) between parties.

Incident Response

Define breach notification timelines, investigation responsibilities, forensic evidence preservation, regulatory reporting obligations, and communications roles including who notifies affected individuals and regulators.

Subcontractors & Audits

Require prior notice and approval for subcontractors, flow-down of security obligations, right to audit or receive audit reports, and remediation requirements following findings.

Security and Compliance Controls to Specify

Encryption in transit: Use TLS 1.2 and 1.3

Encryption at rest: AES-256 encryption at rest

Independent certifications: SOC 2 Type II; ISO 27001

HIPAA protections: HIPAA-compliant controls; BAA required

FDA / 21 CFR: 21 CFR Part 11 support available

Auditability: Detailed audit trail and timestamps

Step-by-Step: How to Complete and Execute the Addendum

Follow these steps to complete and execute the addendum, whether on paper or electronically, to maintain compliance and auditability.

01

Prepare Document: Attach addendum to master agreement and update SOW references.
02

Review Controls: Verify encryption, access, and backup procedures meet expectations.
03

Obtain Approvals: Get legal and information security sign-off before sending.
04

Execute Signatures: Sign with authorized representatives, record dates, and retain copies.

How Electronic Execution and eSubmission Typically Works

Typical electronic execution workflow for the addendum, from upload to receipt and storage, using compliant eSignature and record retention processes.

Upload Document: Upload PDF or DOCX to eSignature platform.
Assign Signers: Add parties and specify signing order or parallel signing.
Authenticate Signers: Use email link, SMS code, or stronger methods as needed.
Complete & Store: Capture audit trail, deliver signed copies, and archive.

eSignature Pricing and Feature Comparison for Healthcare Addenda

Comparison of common eSignature plans and features relevant to executing Healthcare Managed Services Addenda; signNow is listed first per vendor data.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Key Risks and Potential Consequences of Inadequate Addenda

HIPAA Fines: Civil and criminal penalties possible

Contractual Liability: Indemnity and damages exposure

Breach Notification: Notification and remediation costs

Regulatory Action: Investigations and enforcement activity

Operational Disruption: Service outages and remediation expenses

Invalid Execution: Signature or form errors may void

Practical Tips to Reduce Risk and Speed Execution

Practical recommendations to reduce execution risk, maintain compliance, and simplify audits when using the addendum across organizations.

Adopt and use a standard BAA template

Keep a single approved BAA template for all healthcare engagements, require legal and security review, and include it in vendor onboarding to reduce negotiation time and ensure consistent obligations.

Limit PHI access strictly by role and necessity

Define least-privilege access in the addendum, require role-based controls and MFA, and log privileged activity to support incident analysis and minimize exposure.

Document incident response and notification procedures clearly

Specify timelines for internal notification, regulatory reporting, forensic investigation, and remediation; include sample notification language to accelerate legal and communications workflows.

Require subcontractor flow-down and audit rights

Mandate that subcontractors inherit the same security and privacy obligations, require prior approval for subcontractor use, and retain SOC reports or audit evidence for verification.

Frequently Asked Questions About the Addendum

Common questions and concise answers about execution, enforceability, and compliance when using a Healthcare Managed Services Addendum.

Need help? Contact support

Is an electronic signature valid?
Yes. Electronic signatures are generally legally binding under the ESIGN Act (15 U.S.C. §7001) and under UETA where adopted. Ensure intent to sign, consent to electronic records, clear attribution, and retained reproducible records to meet validity tests.
Do I need a Business Associate Agreement (BAA)?
Yes. Where PHI is created, received, maintained, or transmitted, HIPAA requires a BAA. Include BAA terms in the addendum or reference a signed BAA; see 45 CFR §164.502(e) and §164.504(e) for statutory obligations.
Who must sign the addendum?
Authorized representatives with documented signing authority should sign. For organizations this typically means a corporate officer or delegated signatory consistent with bylaws; verification of authority reduces enforceability risk.
Are notarization or witnesses required?
Generally not for commercial service addenda; ESIGN and UETA permit electronic execution. Exceptions exist for certain record types (wills, court orders). Verify state-specific notarization or witness rules if local law or contracting practices require them.
How long must signed addenda be retained?
Follow applicable standards: HIPAA-related records six years (45 CFR §164.530(j)); financial records at least three years (IRC §6501(a)); retain longer if state or industry rules require it.
Can subcontractors be added later?
Yes if the addendum permits subcontractor engagement with required approvals, flow-down obligations, and updated BAAs. Obtain evidence of subcontractor compliance before granting PHI access.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now