Can the HR WISP Form be signed electronically?

Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided the transaction meets intent, consent, attribution, and record retention tests.

Do I need a separate HIPAA addendum?

If the WISP covers protected health information handled by a business associate, add a Business Associate Addendum and ensure the platform supports a BAA for HIPAA compliance.

What happens if a signatory's name differs from their ID?

Name mismatches can create chain-of-custody challenges; use legal names that match government-issued ID and include role and title to reduce ambiguity.

Is notarization required for WISP forms?

Not typically. Notarization is uncommon for internal HR policies, but specific contracts or local rules may require notarized attestations in limited circumstances.

How long must I retain signed WISP forms?

Keep executed WISP records for the active term plus at least three years; follow industry-specific rules such as HIPAA six-year retention where applicable.

How to update the WISP after an incident?

Document the incident, implement corrective actions, revise the WISP to reflect changes, and obtain updated sign-offs with a new effective date to preserve auditability.

HR WISP Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HR WISP Form

Personal Information

Full Name Address Primary Phone Email

Position Information

Job Title Department Reporting Manager

Start Date:

Salary / Pay Rate

Employment Status: Full-time Part-time Contractor/Temporary

Employment History

Employer 1

Company Title / Position

Dates Employed: From to

Primary Responsibilities Reason for Leaving

Employer 2

Company Title / Position

Dates Employed: From to

Primary Responsibilities Reason for Leaving

Education

Highest Degree Institution

Graduation Date:

Additional Certifications / Training

References

Reference 1

Reference 2

Reference 3

WISP Policy Acknowledgement and Responsibilities

The Written Information Security Program (WISP) establishes administrative, technical, and physical safeguards to protect Confidential Information, personal data of employees, clients, and business information. Confidential Information includes, but is not limited to, personal identifiers, payroll data, personnel records, client records, proprietary business information, and any information designated confidential by policy or law. By signing below, the employee acknowledges receipt of and responsibility to comply with the WISP.

Employees must protect access credentials and must not permit unauthorized access to systems or data. Use of employer systems is monitored for security and compliance. Unauthorized access, distribution, alteration, destruction, or disclosure of Confidential Information is prohibited and may result in disciplinary action up to and including termination, restitution, and legal action.

I understand that access to specific categories of data is granted only as required to perform my duties. I will not attempt to access data beyond my authorization. If given remote or vendor access, I will follow multi-factor authentication, device-control, and encryption requirements.

I agree to promptly report any known or suspected security incidents, data loss, or unauthorized disclosures to the designated security contact. I acknowledge that failure to report incidents or to follow prescribed incident response procedures may subject me to disciplinary measures.

Access Level (check all that apply)

Personal / Employee Data Financial Data Client Data Administrative / System Configuration

Data Handling and Storage

I confirm that I have received WISP training on: and the training provider was .

By checking the box below I acknowledge that I have read, understand, and will comply with the Written Information Security Program and associated procedures. I understand that access privileges may be suspended or revoked for noncompliance.

I acknowledge and agree to comply with the WISP.

Legal Disclosures and Authorizations

At-Will Employment: Employment with the organization, if any, is at-will and may be terminated by either party at any time with or without cause, subject to applicable law.

Equal Opportunity: The organization provides equal employment opportunity and does not unlawfully discriminate on the basis of race, color, religion, sex, national origin, age, disability, or other protected characteristics under applicable law.

Authorization to Verify: I authorize the organization and its designated agents to contact my previous employers, educational institutions, and references to verify the information I have provided and to conduct background checks, including criminal history and credit checks where job-related and permitted by law. I further authorize those parties to disclose such information.

I authorize employment verification, reference checks, and background screening as described above.

Applicant Certification

I certify that all information provided in this WISP Form and in any attachments is true, accurate, and complete to the best of my knowledge. I understand that any false statements, omissions, or misrepresentations may result in denial of access, rescission of an offer, or disciplinary action up to and including termination.

I understand that compliance with the WISP is a condition of my continued access to organizational systems and data. I agree to comply with all policies and procedures referenced herein.

Employee Name:

Signature:

Date:

What the HR WISP Form Is and When It Applies

The HR WISP Form documents an employer's Written Information Security Program specific to human resources records and processes. It defines administrative, technical, and physical safeguards for employee personal data, access controls, and incident response responsibilities. Organizations use the form to show compliance with state and sector privacy rules, to communicate internal controls to managers and vendors, and to create an auditable record of policy, training, and monitoring tied to employee records and HR systems.

Why a Dedicated HR WISP Form Matters

A focused HR WISP Form centralizes rules that protect employee personally identifiable information, reduces breach risk, and documents controls for audits and regulators such as state data security laws and sector rules like HIPAA where applicable.

Who Prepares and Who Signs the HR WISP Form

Typical stewards draft and maintain the form, while HR leaders, IT security, and legal approve and sign off before deployment.

HR leaders and privacy officers who own employee data inventories and consent processes.
Information security teams responsible for technical controls and incident response.
In-house counsel or external counsel reviewing legal and regulatory language.

Final signatories should include an authorized company representative and the HR lead; distribution follows the organization's policy and training schedule.

Step-by-Step: Completing the HR WISP Form

Follow these sequential steps to populate, review, and finalize the HR WISP Form for your organization.

01

Prepare: Gather inventory, policies, and access lists before starting the form.
02

Populate: Fill each field exactly per the Fillable Fields Guide.
03

Review: Route to IT and legal for technical and regulatory checks.
04

Sign: Collect authorized signatures and record the effective date.

Core Sections to Include in a Professional HR WISP Form

A complete HR WISP Form groups essential controls into clear sections so reviewers and auditors can rapidly verify compliance and operational readiness.

Policy Scope

Defines which HR records and systems are covered, lists excluded data types, and links to underlying vendor agreements for personnel data processing.

Data Inventory

Maps data categories, storage locations, and retention classes to show where employee PII lives and who is responsible for it.

Access Management

Describes account provisioning, least privilege, periodic access reviews, and multi-factor authentication requirements for HR systems.

Technical Safeguards

Specifies encryption at rest and in transit, endpoint protection, logging, and backup procedures applied to HR environments.

Incident Handling

Outlines detection, containment, internal notification, external notification timing, and responsibilities during a suspected data event.

Training & Oversight

Records training cadence, attendance tracking, and the schedule for policy reviews and updates to maintain currency.

Required Information Elements on the HR WISP Form

Program Owner: Name and title

Scope Statement: Systems and record types

Access Controls: Authentication and role rules

Data Inventory: PII categories and locations

Incident Procedures: Response steps and contacts

Review Schedule: Policy update cadence

Common Errors to Avoid When Preparing the HR WISP Form

Leaving scope vague so important HR systems are omitted and not subject to controls or reviews.
Using inconsistent names or titles for signatories, which can create signature mismatches during audits.
Failing to map third-party processors in the data inventory, exposing contractual and compliance gaps.
Not updating the effective date or retention fields after policy revisions, causing version control confusion.

Risks and Penalties from Incomplete or Incorrect HR WISP Forms

Regulatory fines: State penalties for noncompliance

HIPAA risk: Potential violations if PHI is mishandled

Breach costs: Incident response and remediation expenses

Reputational harm: Loss of trust and employee concern

Contract exposure: Vendor indemnity and liability claims

Operational disruption: Access outages and HR service delays

Configuring an Online HR WISP Workflow

Set up fields, routing, and authentication to reflect approval order and security needs before sending the form for signature.

Field	Configuration
Program Owner Field	Required text field, validated name
Effective Date Field	Date selector, MM/DD/YYYY enforced
Signature Field	Inline signer block with timestamp
Approval Routing	Sequential signers: HR → IT → Legal

Digital Signing and Distribution Requirements

Choose a platform that provides tamper-evident PDFs, a complete audit trail, and role-based access for sensitive HR records.

Supported Formats: PDF, DOCX accepted
Integrations: Connectors for HRIS and cloud storage
Authentication: Email, SMS code, or stronger

Platforms with secure storage, encryption, and audit logging simplify retention and prove chain-of-custody for audits and incident investigations.

Where to Send or File the Completed HR WISP Form

Determine the destination for signed copies and the authoritative repository that will hold the executed WISP for retention and audit purposes.

HRIS Archive: Store the signed form in the HR information system
Secure Cloud Storage: Retain an encrypted master copy in a controlled bucket
Legal Repository: Keep a copy with legal for compliance records
Vendor Records: Supply processor copies when contractually required

Timelines and Review Deadlines for an HR WISP Form

Set clear deadlines for review, training, and versioning so the WISP remains current and defensible during regulatory review.

Initial Completion:

Complete and sign before commencing covered HR operations

Annual Review:

Review at least once every 12 months

Training Cadence:

Employee training at least annually

Incident Update:

Update WISP within 30 days after material incident

Policy Versioning:

Retain version history for audits

Key Milestones in the HR WISP Lifecycle

Track milestones from drafting through post-incident updates to maintain compliance and continuous improvement.

01

Drafting

Compile data inventories and draft controls

02

Stakeholder Review

Obtain input from IT, legal, and HR

03

Sign-off

Authorized representative signs and dates

04

Ongoing Review

Schedule recurring policy reviews and training

Real-world Examples of Using a WISP with HR Workflows

These brief examples illustrate how organizations adapt a WISP to HR processes and enforceability needs.

Tim Martin, Founder — Martin Properties

Tim Martin adopted a formal HR WISP to handle tenant screening data and payroll records.

He highlighted mobile and offline execution benefits.
The policy allowed remote agents to complete secure forms while preserving an auditable chain of custody and maintaining consistent compliance across multiple properties.

John Butler, Founder — Fertility Centers of Illinois

John Butler integrated a WISP into patient-facing HR processes for clinical staff.

The organization tied training records to policy sign-offs.
This approach centralized control, demonstrated HIPAA-conscious handling of staff records, and preserved proof of training and acceptance for regulatory review.

eSignature Vendor Comparison Relevant to HR WISP Workflows

A concise comparison of common vendor features and starting prices to help evaluate eSignature platforms for HR WISP execution and recordkeeping.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (premium tier)	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

FAQs: Common Questions About the HR WISP Form

Answers to frequently asked operational and compliance questions about preparing, signing, and storing the HR WISP Form.

Need help? Contact support

Can the HR WISP Form be signed electronically?
Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided the transaction meets intent, consent, attribution, and record retention tests.
Do I need a separate HIPAA addendum?
If the WISP covers protected health information handled by a business associate, add a Business Associate Addendum and ensure the platform supports a BAA for HIPAA compliance.
What happens if a signatory's name differs from their ID?
Name mismatches can create chain-of-custody challenges; use legal names that match government-issued ID and include role and title to reduce ambiguity.
Is notarization required for WISP forms?
Not typically. Notarization is uncommon for internal HR policies, but specific contracts or local rules may require notarized attestations in limited circumstances.
How long must I retain signed WISP forms?
Keep executed WISP records for the active term plus at least three years; follow industry-specific rules such as HIPAA six-year retention where applicable.
How to update the WISP after an incident?
Document the incident, implement corrective actions, revise the WISP to reflect changes, and obtain updated sign-offs with a new effective date to preserve auditability.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now