Scope Summary
Clear description of systems, interfaces, and transactions included in the transfer.
A documented Pre-ISP reduces regulatory and operational risk by confirming the data flow, access controls, and retention strategy before live transfer. It provides evidence of planning for HIPAA compliance and board or security-team review while clarifying responsibilities across IT, security, and clinical teams.
Several roles contribute to and approve the Pre-ISP; coordination prevents last-minute gaps or missed compliance steps.
Final approval is usually required from both security leadership and the data owner before production connections are enabled.
Clear description of systems, interfaces, and transactions included in the transfer.
List of data elements and sensitivity level, including whether PHI is present and permitted uses.
Encryption in transit/at rest, authentication methods, logging, and segmentation details.
Identified threats, likelihood, mitigations, and residual risk after controls are applied.
Schedule, rollback procedures, testing steps, and contact points for incident response.
Signatures, dates, and role-of-signer for each approving authority, with versioning history.
| Field | Configuration |
|---|---|
| Signer Order | Sequential: Project Owner → Security → Privacy → Executive |
| Authentication | Email + SMS code or SSO for internal approvers |
| Conditional Fields | Show BAA and PHI clauses only when PHI checkbox selected |
| Retention Setting | Retain completed PDF and audit trail for 6+ years |
Choose a platform that supports HIPAA controls, audit trails, and the authentication levels needed for approvers.
Ensure the platform can produce a tamper-evident PDF and export the certificate of completion for retention and audits.
Submit at least 10 business days before planned testing start date.
Allow 5–7 business days for technical validation and remediation requests.
Allow 3–5 business days for privacy officer assessment and BAA checks.
Secure approvals at least 2 business days before production cutover.
Conduct within 30 days of transfer to confirm controls and logs.
The team standardized Pre-ISP templates for clinical integrations to reduce review time.
NetSuite connector required a scoped Pre-ISP to document data fields.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day trial | Yes, trial | Yes, trial | Yes, trial | Yes, trial |
| Bulk Send | Yes | Yes | Yes | Yes | Yes |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies by plan | Varies | Varies |