Is an electronic signature valid under HIPAA?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; the document must show intent, consent, attribution, and retention capability.

Do I need a BAA for cloud vendors?

Yes. Any vendor storing, processing, or transmitting PHI on behalf of a covered entity should execute a Business Associate Agreement that describes safeguards and breach notification obligations.

How long must I keep the agreement?

HIPAA-related records must be retained for six years from creation or last effective date (45 CFR §164.530(j)). Other regulatory or contractual retention periods may be longer.

Can I use a basic eSignature service for PHI documents?

Only if the provider supports required safeguards, a BAA is offered, and the service preserves an auditable record. Verify platform certifications and execute a BAA before transmitting PHI.

What if a vendor subcontracts PHI processing?

The business associate must contractually require subprocessors to meet equivalent HIPAA obligations and remain responsible for their compliance; include flow-down language and approval processes.

How quickly must I report a breach to the covered entity?

Report unauthorized PHI access promptly per the agreement; many organizations set an internal SLA such as 72 hours for initial notification, with full investigation and remediation timelines defined in contract.

Electronic Signature
Templates
Other
HIPAA Compliance Agreement

HIPAA Compliance Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

What a HIPAA Compliance Agreement Covers

A HIPAA Compliance Agreement is a written contract that defines how a business associate or vendor will handle protected health information (PHI) on behalf of a covered entity. The agreement documents permitted uses and disclosures, required safeguards, breach notification procedures, and reporting obligations. It typically includes obligations to implement administrative, physical, and technical safeguards consistent with the HIPAA Security Rule and to permit audits or access necessary to verify compliance. The agreement supports the covered entity's statutory duties under HIPAA and demonstrates contractual controls over third-party PHI handling.

Why a Clear Agreement Matters for PHI Protection

A precise HIPAA Compliance Agreement allocates responsibility for PHI safeguards, reduces legal exposure, and documents breach response responsibilities. It also establishes operational expectations and supports regulatory compliance for both covered entities and business associates.

Typical parties who prepare and sign this agreement

Covered entities and business associates, including hospitals, clinics, billing companies, IT vendors, and cloud providers, use HIPAA Compliance Agreements to set PHI handling rules.

Healthcare providers and clinics that share PHI with vendors for billing, analytics, or patient communications.
Health plans and payers when outsourcing claims processing or data analysis.
Technology and cloud vendors that store, process, or transmit PHI on behalf of a covered entity.

The agreement framework scales for vendors of all sizes; organizations should match obligations to the sensitivity of the PHI and the services performed.

Common signatories and their roles

Privacy Officer

Chief privacy or compliance officers typically review and approve HIPAA Compliance Agreements, ensuring contractual language meets regulatory requirements, documents administrative controls, and aligns with internal policies and incident response plans.

Vendor Executive

An authorized vendor representative or general counsel signs on behalf of the business associate and confirms operational controls, employee training commitments, and the vendor's ability to meet breach notification and mitigation obligations.

Essential clauses to include in the agreement

A professional HIPAA Compliance Agreement explicitly assigns responsibilities, limits data uses, and sets security and reporting standards so both parties understand obligations and remedies.

Permitted Uses

Specifies exactly which PHI uses and disclosures the business associate may perform and prohibits uses outside those purposes.

Safeguards

Requires implementation of administrative, physical, and technical safeguards consistent with HIPAA Security Rule standards.

Breach Notification

Defines timing and process for notifying the covered entity of unauthorized PHI access or disclosure.

Subcontractors

Requires the business associate to flow down equivalent obligations to subcontractors or agents handling PHI.

Term and Termination

Describes the agreement term, termination rights for material breaches, and return or destruction of PHI on termination.

Audit and Inspection

Grants rights to inspect, audit, or require evidence of compliance, including documentation and access to policies.

Technical and compliance assurances often included

Encryption: TLS 1.2/1.3 transit; AES-256 at rest

Certifications: SOC 2 Type II; ISO 27001 available

HIPAA BAA: Business associate agreement required

Audit Trail: Timestamps, IP, action logs retained

Access Controls: Role-based access and least privilege

Authentication: Multi-factor options for sensitive actions

Step-by-step: completing a HIPAA Compliance Agreement

Follow these steps to draft, review, and finalize a HIPAA Compliance Agreement so responsibilities are clear and the contract supports compliance obligations.

01

Identify Parties: Record full legal names and addresses.
02

Define Scope: Specify PHI categories and permitted uses.
03

Set Safeguards: Detail administrative, physical, technical controls.
04

Review and Sign: Obtain authorized signatures and dates.

Configuring an online signing workflow

Set up an eSignature workflow that enforces signer order, authentication, and audit trail capture for HIPAA agreements.

Field	Configuration
Signer Order	Sequential or parallel as required
Authentication	Email link, SMS code, or stronger
Audit Options	Capture IP, timestamp, and event log
Document Retention	Automate archival and secure access

Typical eSubmission flow for the agreement

A standard online signing flow ensures the document is delivered, authenticated, signed, and stored with an auditable record of events.

Upload Document: Sender uploads final agreement PDF or DOCX.
Place Fields: Add signature, date, and initial fields.
Set Authentication: Choose email, SMS, or MFA methods.
Sign and Archive: Signers complete signatures and the platform stores audit trail.

What to require from an eSignature platform

Ensure the chosen eSignature provider supports HIPAA controls, audit trails, and a BAA before using it for PHI agreements.

Security Certifications: SOC 2 Type II, ISO 27001, PCI if payments involved
Technical Controls: AES-256 at rest, TLS 1.2/1.3 in transit
Integrations: Connectors for EHRs, cloud storage, and SSO

Document these platform requirements in procurement records and include them in the agreement to align operational and contractual controls.

Timing and deadlines to track during execution

Monitor key dates such as effective date, periodic reviews, termination notice windows, and incident reporting timeframes to maintain compliance.

Effective Date:

Date obligations begin; enter as MM/DD/YYYY

Breach Notice Window:

Notify covered entity promptly; internal SLA typically 72 hours

Review Cadence:

Annual security and policy reviews recommended

Termination Notice:

Follow contract-specified cure and notice periods

Record Retention Start:

Retention calculated from creation or last effective date

Common mistakes to avoid when preparing the agreement

Leaving permitted uses too broad, which can allow PHI handling beyond intended services and increase regulatory risk.
Failing to require a written subcontractor flow-down clause so downstream vendors are not contractually bound to safeguard PHI.
Omitting precise breach notification timelines and contact points, delaying incident response and regulatory reporting obligations.
Relying on verbal assurances about security controls instead of documenting technical and administrative safeguards in the agreement.

Regulatory and contractual risks from inadequate agreements

HIPAA Fines: Civil monetary penalties and corrective actions

Breach Costs: Notification, remediation, and forensic expenses

Contract Termination: Loss of business or vendor replacement costs

State Fines: Additional penalties under state privacy laws

Reputational Harm: Patient trust damage and brand impact

Liability Claims: Potential private suits and indemnity exposure

Practical provisions that strengthen compliance

Include clear, measurable obligations and testable controls so compliance is demonstrable during audits or investigations.

Specify Controls

List encryption, logging, access review, and data disposal requirements with measurable thresholds and review frequency.

Define Subprocessors

Require prior notice or approval for new subprocessors and ensure flow-down of obligations to maintain PHI protections.

Detail Breach Response

Include investigative steps, timelines for notification, and responsibilities for remediation and communication to affected individuals.

Require Evidence

Allow periodic audits, attestations, and access to security reports to verify ongoing compliance.

How a HIPAA Compliance Agreement differs from similar contracts

Compare this agreement to related documents to ensure you choose the right instrument for PHI protections and operational needs.

Document	HIPAA Agreement	Data Processing Agreement
Primary Purpose	phi protection	general personal data processing
Regulatory Basis	hipaa rules	gdpr/state privacy laws
Required Clauses	baa, breach notice	dpa, data subject rights
Typical Industries	healthcare	tech, marketing, cloud

Vendor pricing and capability snapshot for eSignature and HIPAA workflows

A vendor comparison helps assess cost and compliance capabilities for executing HIPAA Compliance Agreements; signNow is listed first per table convention.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about HIPAA Compliance Agreements

These answers address common execution, retention, and eSignature concerns when using a HIPAA Compliance Agreement.

Need help? Contact support

Is an electronic signature valid under HIPAA?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; the document must show intent, consent, attribution, and retention capability.
Do I need a BAA for cloud vendors?
Yes. Any vendor storing, processing, or transmitting PHI on behalf of a covered entity should execute a Business Associate Agreement that describes safeguards and breach notification obligations.
How long must I keep the agreement?
HIPAA-related records must be retained for six years from creation or last effective date (45 CFR §164.530(j)). Other regulatory or contractual retention periods may be longer.
Can I use a basic eSignature service for PHI documents?
Only if the provider supports required safeguards, a BAA is offered, and the service preserves an auditable record. Verify platform certifications and execute a BAA before transmitting PHI.
What if a vendor subcontracts PHI processing?
The business associate must contractually require subprocessors to meet equivalent HIPAA obligations and remain responsible for their compliance; include flow-down language and approval processes.
How quickly must I report a breach to the covered entity?
Report unauthorized PHI access promptly per the agreement; many organizations set an internal SLA such as 72 hours for initial notification, with full investigation and remediation timelines defined in contract.

Explore Templates

California Workers' Compensation Health Information New Mexico Workers Response to Complaint Materialman's Request Individual New Mexico Minor Name Change Uniform Power of Attorney Act New Mexico Notice of Appearance as Attorney Counsel for Child by Guardian ad Litem

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now