Scope of Services
Describe tasks, deliverables, and measurable service levels. Specify what data types, systems, and access methods the vendor will use and any restrictions on subcontracting or onward transfers.
A well‑constructed SCA Agreement aligns expectations, protects patient data, and documents technical and administrative safeguards required under healthcare regulations and electronic signature laws.
Healthcare organizations, vendor contracting teams, and compliance officers commonly work together to prepare and approve SCA language before services begin.
Signatory roles and review cycles should be documented so execution is timely and enforceable under applicable electronic signature rules.
Responsible for ensuring that the SCA Agreement includes HIPAA privacy and security controls, breach notification timelines, and appropriate audit and reporting rights for audit and regulatory response.
Manages operational commitments, service levels, data access scopes, and coordinates technical attestations such as encryption, logging, and incident response obligations.
Describe tasks, deliverables, and measurable service levels. Specify what data types, systems, and access methods the vendor will use and any restrictions on subcontracting or onward transfers.
Define categories of protected health information, permitted uses and disclosures, de‑identification standards if used, and limits on aggregation, sale, or marketing uses.
Require technical safeguards such as encryption, access controls, logging, vulnerability management, and regular security assessments aligned with HIPAA and industry best practices.
When PHI is involved, include or reference a BAA that establishes required HIPAA obligations, breach notification steps, and conditions for termination related to noncompliance.
Set notification timelines, investigation responsibilities, required contents of notices, and remediation obligations for suspected or confirmed data breaches.
Specify effective and expiration dates, renewal mechanics, cure periods, termination for cause, data return or secure destruction, and liability or indemnity limits.
| Field | Configuration |
|---|---|
| Authentication Method | Use email + SMS OTP or higher for vendor signers. |
| Consent Disclosure | Present ESIGN consumer disclosure for consumer-facing transactions. |
| BAA Attachment | Attach executed BAA or require signer acknowledgement when PHI present. |
| Retention Setting | Enable secure storage and exportable audit trail for regulatory audits. |
Ensure the eSignature platform supports required security, integrations, and audit capabilities before routing an SCA Agreement.
Confirm vendor-specific integration options and retention settings to maintain chain-of-custody and to simplify regulatory response and audits.
Allow 7–14 calendar days for full internal review and signatures.
Typical cure periods range from 30 to 60 days.
Provide 30 to 90 days advance written notice for nonrenewal.
Contract should specify notification within 72 hours of discovery.
Allow 30 days for secure data return or destruction after termination.
Finalize initial SCA text and technical attachments before review begins.
Complete HIPAA and security assessment and attach evidence reports.
Execute using configured electronic signing process and retain audit trail.
Provision accounts and access controls after signed agreement is in effect.
A regional hospital engaged a records management vendor with PHI access.
A clinic contracted a telehealth vendor for video consults.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial, no credit card | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes (BAA) | Yes (BAA available) | Yes (BAA available) | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies by plan | Varies by plan | Varies by plan |