A well-drafted exhibit makes service obligations, data safeguards, audit rights, and incident response expectations explicit. That clarity helps both parties meet HIPAA and state privacy obligations, measure vendor performance, and limit disputes over responsibility for PHI, uptime, and remediation.
Typical teams and roles that prepare or sign this exhibit include operational, legal, procurement, and compliance stakeholders at both provider and vendor organizations.
The exhibit is used during negotiations, onboarding, periodic reviews, and when scope or vendor relationships change to keep obligations current and auditable.
Oversees infrastructure, access control, and PHI security. Uses the exhibit to define backups, monitoring, uptime targets, and vendor responsibilities; ensures audit rights and breach-notification timelines align with the organization's incident response and HIPAA obligations.
Manages commercial terms, invoicing, and liability caps. Uses the exhibit to confirm pricing schedules, change-order procedures, service credits for missed SLAs, and insurance and indemnity requirements to align financial exposure with operational delivery.
Describe specific managed services, locations, deliverables, excluded services, and interfaces. Include measurable outputs and responsibilities for software, infrastructure, user support, backups, and incident management to avoid ambiguity.
Define uptime targets, response and resolution times, measurement windows, reporting cadence, and credits for missed SLAs. Specify monitoring tools and acceptance tests used for performance verification.
Detail PHI classification, storage, encryption, data transfer methods, access controls, retention, and secure disposal. Require vendor to follow HIPAA and applicable state privacy law standards.
Enumerate controls, audit rights, penetration testing schedule, BAA terms, breach notification timelines, and responsibility for regulatory audits, evidence production timelines, and remediation plans.
List fee schedules, invoicing intervals, change-order pricing, service credits, and termination charges. Clarify taxes, pass-through costs, and dispute resolution for billing discrepancies.
Set procedures for scope changes, approval authority, impact assessment, transition timelines, and how pricing or SLA adjustments will be applied and documented.
| Field | Configuration |
|---|---|
| Signature Field | Required; enforce signer order and timestamps. |
| Date Field | Auto-fill MM/DD/YYYY; required for execution. |
| PHI Checkbox | Require BAA confirmation before signing. |
| Attachment | Permit lab or SOC reports as PDF uploads. |
For eSigning and secure routing, verify platform integrations, authentication options, and retention controls before deployment.
Enter in MM/DD/YYYY; governs obligations start.
Typically 30–90 days from execution for transition.
HIPAA breach notices within 60 days of discovery.
Quarterly SLA reviews commonly required in exhibit.
60–90 days before contract anniversary for changes.
Finalize scope, pricing, and compliance obligations.
Obtain all signatures and countersignatures.
Complete system access, testing, and data migration.
Conduct SLA audits, incident reviews, and renewals.
Attach or reference a Business Associate Agreement with explicit PHI processing activities, breach response steps, indemnity terms, and notification timelines required under HIPAA.
Specify required insurance types and limits, proof-of-coverage cadence, and responsibility for uninsured losses related to vendor performance or data breaches.
Define operational and compliance reports, delivery formats, responsible parties, and timelines for periodic and ad-hoc reporting including security incidents and audit findings.
Require transition support, data handover format, and timeline upon termination to preserve continuity of care and enable secure retrieval of PHI by the provider.
Optica used a managed services exhibit to consolidate hosting responsibilities and reporting obligations across multiple client sites.
Fertility Centers documented BAAs, authentication controls, and integration responsibilities with external labs in an exhibit.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes (Business Premium) | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |