Data Scope
Define which data elements are included (identified PHI, limited dataset, or de-identified data), any derived data, and exclusions to prevent ambiguity.
A Healthcare Research Addendum clarifies legal responsibilities, documents agreed safeguards for protected health information, and reduces regulatory risk when sharing data for research. It provides a formal record of consent, data handling expectations, and technical controls tied to HIPAA obligations.
Parties commonly involved include health system legal or compliance teams, university researchers, data providers, and business associates coordinating research activities.
Understanding each party's role up front reduces revision cycles and supports faster IRB and legal review.
Define which data elements are included (identified PHI, limited dataset, or de-identified data), any derived data, and exclusions to prevent ambiguity.
Specify allowed research purposes, secondary use restrictions, publication rights, and whether commercial reuse is permitted or prohibited.
List required technical and administrative safeguards such as encryption, access controls, logging, and breach notification procedures.
Require IRB approval or exemption documentation, specify compliance with HIPAA and other applicable laws, and name responsible compliance officers.
Describe transfer methods, permitted export locations, secure transport protocols, and any cross-border restrictions.
Include data disposition instructions, timelines for data deletion or return, and verification obligations after termination.
| Field | Configuration |
|---|---|
| Signer Role Mapping | Define signer roles (PI, institutional rep, data custodian) and required order. |
| Required Attachments | Make IRB approval and protocol PDFs mandatory uploads before final signature. |
| Authentication Strength | Use multi-factor or organization SSO for institutional signers to ensure attribution. |
| Audit Trail | Enable detailed logs (IP, timestamp) and retain digitally for compliance. |
Verify that your e-signature and file-sharing platform meet HIPAA and institutional requirements before use.
Date obligations begin; enter as MM/DD/YYYY.
Date the IRB approval lapses; renew before this date.
Start and end dates for permitted data use.
Date for compliance and security reassessment.
Timeline for data return or destruction after termination.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
A specialty clinic sought de-identified outcomes data for outcome benchmarking
A university requested longitudinal EMR data for a grant-funded study