Can this be signed electronically?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, electronic signatures are legally valid provided intent, consent, attribution, and record retention requirements are met.

When is a notary required?

Notarization depends on state or contracting party requirements. Some jurisdictions or counterparties may request notarization or witness attestations to strengthen evidentiary value.

Do I need a separate BAA for PHI?

If the undertaking involves protected health information, include a Business Associate Agreement as required by HIPAA and ensure the platform supports HIPAA compliance.

How long should records be kept?

Follow applicable retention rules: at minimum IRS and contract needs, plus HIPAA's six-year requirement for health records where relevant.

What if a third party subpoenas the data?

The undertaking should include a process for handling subpoenas and carve-outs for lawful disclosure while requiring prompt notice to affected parties where permitted.

Who can sign on behalf of a company?

An authorized officer or agent with signing authority. Confirm delegation of authority in corporate resolutions or power-of-attorney documents when necessary.

Electronic Signature
Templates
Insurance
Insurance Confidentiality Undertaking

Insurance Confidentiality Undertaking

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

INSURANCE CONFIDENTIALITY UNDERTAKING

This Insurance Confidentiality Undertaking (the "Undertaking") is made by the undersigned Applicant and applies to all Confidential Information (as defined below) disclosed by or on behalf of the Insurer identified below in connection with the policy referenced herein.

Identification

Applicant Name:

Applicant Address Date of Birth

Policy Details

Insurer: Policy Number:

Policy Type

Coverage Amount

Deductible

Premium

Policy Period From: to

Confidential Information and Coverage

For the purpose of this Undertaking, "Confidential Information" includes, without limitation, underwriting files, claims files, policy terms and endorsements, pricing and rating information, actuarial models, loss runs, risk assessments, personal data of insureds or claimants, business plans and other non-public information disclosed in any form.

Confidential Information includes (check all that apply):

Policy terms and endorsements

Claims data and claim history

Underwriting files and risk assessments

Pricing, rating and actuarial models

Personal data of insureds or claimants

Other (describe)

Exclusions

Confidential Information does not include information that: (a) is or becomes publicly known through no breach of this Undertaking by the Applicant; (b) is rightfully received by Applicant from a third party without restriction on disclosure; or (c) is independently developed by Applicant without reference to or use of Confidential Information.

Acknowledged exclusions (initials)

Permitted Use and Disclosures

The Applicant shall: (i) use Confidential Information solely for the purpose of evaluating, negotiating, administering or performing obligations in respect of the Policy; (ii) restrict access to Confidential Information to those of its employees, agents or professional advisers who have a need to know and who are bound by confidentiality obligations at least as protective as those set out in this Undertaking; and (iii) not disclose Confidential Information to any third party except as expressly permitted herein.

Permitted disclosures include disclosures required by law, regulation or order of a court or regulatory authority, provided that, to the extent legally permissible, the Applicant gives the Insurer prompt written notice of such requirement and cooperates with the Insurer in seeking a protective order or other appropriate remedy.

Security, Return and Destruction

The Applicant shall implement and maintain reasonable administrative, technical and physical safeguards to protect Confidential Information against unauthorized access, disclosure, alteration or destruction. Upon Insurer's written request, the Applicant shall promptly return or destroy, at the Insurer's election, all Confidential Information in the Applicant's possession and certify in writing that such return or destruction has been completed.

Remedies and Indemnity

The Applicant acknowledges that monetary damages may be an inadequate remedy for breach of this Undertaking and that the Insurer shall be entitled to seek injunctive relief, specific performance and any other equitable remedies in addition to damages. The Applicant shall indemnify, defend and hold harmless the Insurer from and against any losses, liabilities, costs and expenses (including reasonable legal fees) arising from the Applicant's breach of this Undertaking.

Duration and Survival

The obligations of confidentiality set forth in this Undertaking shall continue for a period of five (5) years from the date of disclosure of the Confidential Information, except with respect to trade secrets and personal data for which obligations shall survive for as long as such information remains a trade secret or as required by applicable data protection laws.

Governing Law and Notices

This Undertaking shall be governed by and construed in accordance with the laws of the jurisdiction set forth below. Any notice required or permitted under this Undertaking shall be in writing and delivered to the addresses provided in this document.

Governing Law (State/Jurisdiction) Insurer Notice Address Applicant Notice Address

Beneficiary Information (If Applicable)

Beneficiary Name:

Relationship

Percentage

Declarations and Certification

By signing below, the Applicant certifies that the information provided in this Undertaking is true and correct, that the Applicant has the authority to enter into this Undertaking, and that the Applicant agrees to be bound by the terms and conditions set forth herein. The Applicant acknowledges that breach of this Undertaking may result in injunctive relief, damages and other remedies available at law or in equity.

Additional Comments (optional)

Applicant Printed Name:

Signature:

Date:

Title/Capacity (if signing for an entity):

Contact Phone:

What the Insurance Confidentiality Undertaking Is

An Insurance Confidentiality Undertaking is a written promise used between insurers, brokers, claimants, or third parties to protect nonpublic information exchanged during underwriting, claims handling, or investigations. It defines what information is confidential, who may access it, permitted uses, and consequences for unauthorized disclosure. The undertaking can be standalone or included as a clause in related agreements and is used to ensure compliance with privacy obligations, contractual duties, and regulatory expectations. In many cases it documents consent for limited information sharing while preserving privileges and data protection requirements.

Why an Undertaking Matters for Insurance Transactions

A confidentiality undertaking preserves sensitive policyholder and claim information, clarifies permitted disclosures, and reduces litigation or regulatory exposure by documenting expectations between parties.

Who Typically Completes an Insurance Confidentiality Undertaking

Common participants include insurers, brokers, claimants, defense counsel, third-party administrators, and medical providers involved in underwriting or claims.

Insurance carriers and underwriters — use to protect underwriting files, actuarial analysis, and proprietary models when sharing with partners.
Claims professionals and third-party administrators — document limits on sharing medical or financial claim details with vendors.
Medical providers and counsel — ensure patient information and privileged communications remain restricted in claim-related disclosures.

The undertaking clarifies roles and responsibilities for every signer, helping avoid accidental disclosures and supporting regulatory recordkeeping.

Core Elements to Include in a Professional Undertaking

A complete Insurance Confidentiality Undertaking organizes obligations and remedies clearly so all parties can rely on the document when exchanging sensitive information.

Parties

Identify each party by full legal name and role to avoid ambiguity.

Definition of Confidential Information

Define types of protected data, including claims, medical records, financials, and underwriting materials.

Permitted Uses

Specify authorized uses such as claim adjudication, defense, or regulatory reporting.

Access Controls

Describe who may receive information and any required authentication.

Duration

State how long confidentiality obligations survive termination or case closure.

Remedies

Set out injunctive relief, indemnity, or other consequences for breach.

Essential Information Required on the Form

Full Party Names: Exact legal names

Contact Details: Address, email, phone

Effective Date: MM/DD/YYYY

Scope: Data categories listed

Duration: Term length stated

Signature Block: Authorized signer and date

Step-by-Step: How to Complete the Undertaking

Follow these steps in order to prepare a clear, enforceable confidentiality undertaking.

01

Gather parties: Confirm official names and contact details for every signatory.
02

Define scope: Describe what data is confidential and any exclusions.
03

Set duration: Choose effective and termination dates or trigger events.
04

Sign and date: Collect authorized signatures and record signing method.

Where to Send or File the Completed Undertaking

Routing depends on the parties and whether the document is part of a claim file, underwriting folder, or legal matter.

To insurer: Attach to the claim or underwriting record.
To broker: Retain in broker file and share with relevant teams.
To counsel: Include in legal matter docket or e-discovery repository.
To third parties: Provide when required by permitted use language.

Typical Digital Workflow Settings for eSubmission

Configure a consistent digital workflow to ensure authentication, audit trails, and secure delivery.

Field	Configuration
Authentication Method	Email link, SMS code, or stronger ID verification
Signature Order	Specify sequential or parallel signing
Audit Trail	Enable timestamping and IP capture
Storage Location	Designate secure repository with access controls

Technical Considerations for Digital Signing

Ensure the chosen eSignature platform supports secure authentication and preserves a complete audit trail.

Document Formats: PDF and DOCX supported
Integrations: Connects to CRM or DMS
Compliance: Supports HIPAA and ESIGN

Use a platform that stores signed copies, offers tamper-evident seals, and meets applicable regulatory requirements for your industry.

Timelines and Typical Deadlines to Track

Track response, retention, and disclosure timelines to meet legal and contractual obligations.

Provide upon request:

Respond to authorized information requests within 30 days where HIPAA or similar rules apply.

Effective date:

Obligations begin on the Effective Date entered on the form.

Retention start:

Retention typically begins on creation or Effective Date.

Survival period:

Confidentiality often survives termination for specified years.

Audit access:

Maintain access logs for the duration of retention.

Common Mistakes to Avoid When Preparing the Undertaking

Vague scope language — leaving out specific data categories causes disputes and weakens protection.
Incorrect signatory — having someone without authority sign can render the undertaking unenforceable against the organization.
Missing effective date or inconsistent dates — conflicting dates create ambiguity about the obligation period.
Failing to specify permitted recipients — allows broader sharing than intended and defeats confidentiality aims.

Potential Risks and Legal Consequences of an Incorrect Undertaking

Breach Liability: Damages and injunctions

Regulatory Penalties: HIPAA fines possible

Contractual Loss: Indemnity claims

Privacy Violations: State consumer protection risk

Evidence Issues: Privilege loss concerns

Reputational Harm: Loss of trust and clients

Real-World Examples of Use Cases

These short case arcs show common scenarios where an Insurance Confidentiality Undertaking is applied.

Claim File Sharing

An insurer shares medical records with an independent reviewer

reviewer access limited to listed providers
the undertaking documents permitted use, mandates secure transfer, and requires destruction after review to protect PHI.

Underwriting Collaboration

A reinsurer receives proprietary underwriting models

sharing restricted to underwriting analysts
the undertaking prevents redistribution and sets injunctive remedies for misuse to protect trade secrets.

Selected eSignature Vendor Comparison for Executing the Undertaking

Compare basic pricing and capabilities for eSignature tools that support legal signing and secure storage; signNow is listed first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Practical Tips for Accurate and Efficient Completion

Apply consistent practices to reduce errors and speed execution across transactions.

Use precise party identifiers

Verify legal names against formation documents and government IDs to prevent enforceability issues.

Limit scope clearly

Define data categories and exclusions to reduce disputes over what is covered.

Document consent for eSigning

Ensure consumer disclosures are provided when required under ESIGN and obtain explicit consent.

Keep an audit trail

Record timestamps, IP addresses, and signer authentication to support attribution and compliance.

Frequently Asked Questions About the Undertaking

Answers to common questions about execution, enforceability, and digital signing of an Insurance Confidentiality Undertaking.

Need help? Contact support

Can this be signed electronically?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA in most states, electronic signatures are legally valid provided intent, consent, attribution, and record retention requirements are met.
When is a notary required?
Notarization depends on state or contracting party requirements. Some jurisdictions or counterparties may request notarization or witness attestations to strengthen evidentiary value.
Do I need a separate BAA for PHI?
If the undertaking involves protected health information, include a Business Associate Agreement as required by HIPAA and ensure the platform supports HIPAA compliance.
How long should records be kept?
Follow applicable retention rules: at minimum IRS and contract needs, plus HIPAA's six-year requirement for health records where relevant.
What if a third party subpoenas the data?
The undertaking should include a process for handling subpoenas and carve-outs for lawful disclosure while requiring prompt notice to affected parties where permitted.
Who can sign on behalf of a company?
An authorized officer or agent with signing authority. Confirm delegation of authority in corporate resolutions or power-of-attorney documents when necessary.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now