Can this exhibit be signed electronically?

Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and record retention are documented.

Is a BAA required for vendor connections?

If the vendor will create, receive, maintain, or transmit PHI, a Business Associate Agreement is required under HIPAA and must be in place before access is granted.

Do I need notarization or witnesses?

Not typically for TSA exhibits; however, state rules differ for certain attestations. Use local counsel if an exhibit is being treated as an executed affidavit or contains notarial acknowledgements.

What authentication level is sufficient?

Use strong multi‑factor authentication for privileged vendor accounts. Consider higher‑assurance methods for administrative access and follow your risk assessment.

How long should evidence be retained?

Keep signed exhibits and supporting logs according to federal and industry requirements: HIPAA requires six years (45 CFR §164.530(j)); retain other records per IRS, SEC, or state rules as applicable.

Can I use remote online notarization (RON)?

RON is allowed in most states but varies by jurisdiction. Verify your state’s RON statute and technical requirements, including identity proofing and audio‑video recording retention.

Electronic Signature
Templates
Healthcare
Healthcare Networking TSA Exhibit

Healthcare Networking TSA Exhibit

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE NETWORKING TSA EXHIBIT

This Healthcare Networking Transition Services Exhibit ("Exhibit") is entered into under the Master Services Agreement between the parties and sets forth the scope, security obligations, service levels and transition assistance related to networking and connectivity services. Effective Date: .

Parties

Healthcare Provider Legal Name Service Provider Legal Name

1. Scope of Transition Services

The Service Provider shall deliver transition services to maintain and operate networking systems necessary to support Provider operations during the transition period, including but not limited to the services checked below and any additional items expressly described in the Transition Plan.

Included Networking Services (select all that apply) Network connectivity and circuit provisioning Firewall and perimeter security management VPN and remote access management 24/7 network monitoring and alerting Bandwidth management and traffic shaping Change control and scheduled maintenance Site-to-site connectivity and WAN links

Locations Covered by Exhibit Transition Plan Reference / Identifier

2. Term; Termination for Transition

The Exhibit commences on the Effective Date and continues for the period necessary to complete transition unless earlier terminated in accordance with the Master Services Agreement. Transition services shall be provided for a minimum period of days unless extended by mutual written agreement.

Upon termination of the Master Services Agreement or earlier written notice requiring transition, the Service Provider shall provide exit assistance for a period of days, including orderly transfer of services, documentation, and any Provider data required to resume operations.

3. Security, Privacy and Compliance

The Service Provider shall implement and maintain administrative, physical and technical safeguards that meet or exceed applicable law and industry standards for protection of Protected Health Information (PHI), and shall comply with the obligations applicable to a Business Associate under HIPAA where PHI is created, received, maintained or transmitted in the performance of transition services.

Encryption in Transit Encryption at Rest

Access to systems containing Provider data shall be limited to authorized personnel through unique user accounts, multi-factor authentication where feasible, role-based access controls, and logging of privileged activity. Retention of access and audit logs will be for a minimum of days unless otherwise required by law.

4. Incident Response and Breach Notification

The Service Provider shall establish and maintain an incident response process and shall notify the Healthcare Provider without unreasonable delay upon discovery of any security incident or unauthorized access affecting Provider systems or data. Initial notification to Provider's security contact shall occur no later than hours after discovery.

Incident Reporting and Remediation Details

5. Service Levels and Performance

The Service Provider shall use commercially reasonable efforts to meet the following service levels during the Transition Period:

Network Availability (percent) Maximum Mean Time to Repair (hours)

Service credits, remedies, and calculation methodology for any failure to meet service levels shall be set forth in the Master Services Agreement and apply to services provided under this Exhibit.

6. Change Management

All changes to networking configurations, circuits, or security controls that may materially affect Provider operations shall be subject to a written change request and Provider approval. Emergency changes required to mitigate imminent security risks shall be documented and reported to Provider within 24 hours.

Change Request Lead Contact Name Change Request Contact Phone

7. Audit Rights and Recordkeeping

Provider or its designated auditor shall have the right to audit Service Provider's compliance with the security and privacy obligations under this Exhibit, subject to reasonable notice and confidentiality protections. Audit notice shall be provided no less than days in advance, except where immediate access is required to investigate a suspected breach.

8. Transition Deliverables and Data Transfer

Key Transition Deliverables

Provider data and configuration exports to be transferred using:

Data Handover Completion Date

9. Fees and Expenses

Fees for transition services, if any, shall be charged in accordance with the Master Services Agreement or as set forth below.

Transition Services Fee (if applicable) Expense Reimbursement Terms

10. Representations, Warranties and Limitations

Each party represents and warrants that it has full right and authority to enter this Exhibit. Service Provider warrants that services will be performed in a professional and workmanlike manner consistent with industry standards. Except as expressly stated, remedies for breach shall be limited as set forth in the Master Services Agreement.

11. Governing Law and Dispute Resolution

This Exhibit shall be governed by the law of the state of without regard to conflicts of law principles. Disputes arising under this Exhibit shall be resolved in accordance with the dispute resolution provisions of the Master Services Agreement.

12. Notices and Contacts

All notices required under this Exhibit shall be provided to the contacts listed below:

Provider Technical Contact Name Provider Technical Contact Phone Service Provider Technical Contact Name Service Provider Technical Contact Phone

13. Miscellaneous

This Exhibit, together with the Master Services Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof. Any amendment or waiver must be in writing and signed by authorized representatives of each party.

Healthcare Provider:

By:

Date:

Service Provider:

By:

Date:

What the Healthcare Networking TSA Exhibit Is

The Healthcare Networking TSA Exhibit is a contractual exhibit used to document technical and network security arrangements between healthcare organizations and third-party service providers. It typically outlines required security controls, data flow diagrams, access restrictions, incident response responsibilities, and compliance obligations tied to protected health information (PHI). The exhibit supplements a broader agreement—such as a services agreement or business associate agreement—by providing technical specifications and operational practices that vendors must meet while connecting to clinical or administrative systems.

Why a TSA Exhibit Matters for Healthcare Connectivity

A Healthcare Networking TSA Exhibit clarifies security expectations, reduces integration risk, and helps both parties meet HIPAA and contractual obligations by documenting technical controls and responsibilities in one place.

Primary users and stakeholders

Teams that prepare or review the Healthcare Networking TSA Exhibit typically include IT security, compliance, legal, and vendor integration leads.

Healthcare provider IT: Network architects and security engineers who define on‑premises and cloud connectivity requirements and validate vendor controls.
Third‑party vendors: Solution providers and MSPs that must describe encryption, authentication, and logging practices before access is authorized.
Privacy and compliance officers: Personnel who check HIPAA coverage, BAAs, and retention obligations to reduce regulatory risk.

Coordinating these groups ensures the exhibit is technically accurate and legally enforceable while supporting safe data exchange.

Who signs and approves this exhibit

IT Director

The IT Director or Chief Information Security Officer typically certifies that the network and security controls meet the provider's technical standards, signs to accept operational responsibilities, and authorizes network changes when needed.

Vendor Executive

An authorized representative of the vendor—often VP of Product or General Counsel—signs to confirm compliance with described controls and agrees to maintain necessary logs, encryption, and incident response cooperation.

Core sections to include in a professional TSA Exhibit

A clear, complete exhibit reduces ambiguity and accelerates secure onboarding by setting measurable technical requirements and acceptance criteria.

Network Diagram

A labeled diagram showing interfaces, firewalls, VPNs, segmentation, and where PHI will traverse. Include IP ranges and VLANs where applicable.

Authentication

Specify MFA methods, SSO protocols (SAML/OIDC), certificate requirements, and acceptable authenticator types for administrative access.

Encryption

State encryption in transit (TLS 1.2 or 1.3) and at rest (AES‑256) requirements, key management expectations, and cipher suite baselines.

Logging and Monitoring

Define required audit logging, retention windows, central logging targets (SIEM), and log formats for security event correlation and forensic needs.

Change Control

Detail maintenance windows, patching cadence, approval flows for configuration changes, and emergency change notification procedures.

Incident Response

Assign responsibilities, notification timelines, evidence preservation steps, and coordination points with the covered entity for breach reporting.

Security and compliance data points to capture

Encryption: TLS 1.2/1.3 | AES‑256

Access Controls: MFA required | Role-based

Audit Trail: Retain logs | 6–12 months

Notices: Breach notification | 72 hours

HIPAA Status: BAA required | PHI covered

Backup: Encrypted backups | Offsite

Step-by-step: preparing and approving the TSA Exhibit

Follow these steps in order to create, review, and finalize the exhibit so technical and compliance teams can proceed with safe onboarding.

01

Draft Exhibit: Populate technical fields, diagrams, and control statements.
02

Internal Review: Security and legal validate controls and obligations.
03

Vendor Review: Vendor confirms feasibility and provides evidence where required.
04

Sign and Archive: Authorized signatories execute and store the final exhibit.

Recommended digital workflow settings

Configure a repeatable workflow to reduce manual steps and capture audit evidence during authoring and signing.

Field	Configuration
Signature Type	Electronic signature with timestamp
Authentication	Email + SMS OTP for vendor signers
Attachment	Allow vendor evidence upload (logs, certs)
Audit Trail	Enable full event logging and PDF certificate

Typical eSubmission and approval flow

The exhibit moves through technical review, vendor attestation, and final authorization; this flow preserves accountability and auditability.

Upload Document: Sender uploads the exhibit file to the signing platform.
Place Fields: Add signature, date, and supporting evidence fields.
Send to Signers: Route to vendor and provider signatories in order.
Capture Audit: System records timestamps, IPs, and authentication method.

Technical and integration requirements

Choose a signing platform that supports secure eSigning, audit trails, and integrations required by your IT stack.

File Types: PDF and DOCX support for source and final signed copies
Integrations: CRM/ERP and storage integrations (Salesforce, NetSuite, Box)
Authentication Options: Email, SMS OTP, and advanced options for high-assurance signers

Key timing considerations and deadlines

Plan for review, testing, and signature windows; some security acceptance activities have regulatory or operational timing implications.

Draft Review:

Allow 7–14 business days for internal and vendor technical review.

Penetration Testing:

Schedule up to 30 days for testing and remediation.

Sign-off Window:

Allocate 5 business days for final executive approvals.

Access Activation:

Activate network access only after signed exhibit and evidence submission.

Annual Revalidation:

Revalidate controls and evidence at least annually.

Milestones from draft to live connectivity

Milestone checkpoints help coordinate security testing, approvals, and production activation with clear handoffs between teams.

01

Milestone 1 — Draft Complete

Technical draft finalized and diagram approved by IT.

02

Milestone 2 — Vendor Attestation

Vendor provides control descriptions and evidence artifacts.

03

Milestone 3 — Security Testing

Pen test and vulnerability scan completed and remediated.

04

Milestone 4 — Production Go‑Live

Signed exhibit in place and network access enabled.

Consequences of an incomplete or incorrect exhibit

Regulatory Exposure: HIPAA penalties

Service Disruption: Access denied or delayed

Breach Liability: Increased indemnity exposure

Contractual Remedies: Termination or penalty clauses

Audit Findings: Remediation costs

Operational Risk: Delayed patient care access

Common mistakes to avoid

Using vague acceptance criteria that do not map to measurable tests.
Missing precise network identifiers (IP ranges, VLANs) leading to misrouted traffic.
Relying on weak authentication options for privileged vendor accounts.
Failing to attach vendor evidence such as pen test reports or certificate details.

eSignature vendor pricing and capability snapshot

Compare typical starting prices and essential capabilities for common eSignature providers; signNow is listed first per table conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies	Varies

Frequently asked questions

Answers to frequent issues encountered when preparing, signing, or enforcing a Healthcare Networking TSA Exhibit.

Need help? Contact support

Can this exhibit be signed electronically?
Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and record retention are documented.
Is a BAA required for vendor connections?
If the vendor will create, receive, maintain, or transmit PHI, a Business Associate Agreement is required under HIPAA and must be in place before access is granted.
Do I need notarization or witnesses?
Not typically for TSA exhibits; however, state rules differ for certain attestations. Use local counsel if an exhibit is being treated as an executed affidavit or contains notarial acknowledgements.
What authentication level is sufficient?
Use strong multi‑factor authentication for privileged vendor accounts. Consider higher‑assurance methods for administrative access and follow your risk assessment.
How long should evidence be retained?
Keep signed exhibits and supporting logs according to federal and industry requirements: HIPAA requires six years (45 CFR §164.530(j)); retain other records per IRS, SEC, or state rules as applicable.
Can I use remote online notarization (RON)?
RON is allowed in most states but varies by jurisdiction. Verify your state’s RON statute and technical requirements, including identity proofing and audio‑video recording retention.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now