Scope
Describe permitted services, excluded clinical tasks, work hours, and deliverables.
A clear written agreement reduces regulatory exposure, sets boundaries for PHI access, allocates liability, and establishes service levels. It helps ensure HIPAA compliance, documents a business associate relationship when required, and creates predictable processes for onboarding, audits, and termination.
Healthcare organizations, clinics, telehealth providers, and outsourced virtual assistant firms use this agreement to document responsibilities and data controls.
The document helps legal, compliance, operations, and procurement teams align on risk, payment, and access rules.
Describe permitted services, excluded clinical tasks, work hours, and deliverables.
Specify data categories accessed, minimum necessary rules, and role-based access.
Include a Business Associate Agreement (BAA) detailing safeguards and breach reporting.
Define encryption, authentication, device rules, and incident response obligations.
State rates, billing cadence, expense reimbursement, and payment terms.
List termination rights, data return/destruction, and transition assistance provisions.
| Field | Configuration |
|---|---|
| Template Setup | Create reusable template with locked privacy and signature fields |
| Authentication | Use email + SMS code or stronger methods for signer verification |
| Routing | Set role-based signing order and conditional routing |
| Notifications | Enable completion emails and store certificate of completion |
Confirm platform features and integrations before executing an electronic signature workflow for PHI or regulated data.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial, no credit card | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies | Varies | Varies |
A clinic standardized virtual assistant contracts to control PHI access and automation.
A small clinic used a templated agreement to onboard remote intake staff quickly.
Complete signing before start of services
BAA must be effective at the same time as PHI access
Provide written renewal or termination notice per contract
Notify covered entity immediately on suspected breach
Retain relevant tax documents per IRS timelines
Prepare scope, PHI categories, and security obligations
Compliance and legal finalize BAA and controls
Parties sign; verify eSignature audit trail
Provision accounts and enforce device policies