Is DocuSign HIPAA Compliant for Medical Clinics?

Short answer

DocuSign offers a HIPAA BAA on Business Pro and higher plans for the eSignature product. That coverage makes DocuSign a viable option for patient consent forms, release authorizations, and other documents requiring patient signature — provided the clinic configures the account correctly and handles the resulting signed documents within a covered storage environment.

BAA availability and plan requirements

DocuSign makes its HIPAA BAA available on the following plans:

• Business Pro (lowest qualifying tier)
• Enhanced Plans (enterprise-tier options)

The following plans do not qualify for a BAA:

• Personal
• Standard

Clinics must contact DocuSign to execute the BAA. It is not automatically accepted on upgrade — the clinic must request and sign the agreement as a separate step.

Configuring DocuSign for HIPAA use

After executing the BAA, the admin should:

• Review envelope notification settings. By default, DocuSign sends email notifications to signers that may include document content or a direct-access link. Configure notifications to limit what information is included in those emails, particularly for documents containing PHI.
• Enable access code or authentication. For sensitive documents, require signers to enter an access code before viewing the envelope. This limits exposure if the recipient’s email is compromised.
• Restrict envelope forwarding. Disable forwarding controls so recipients cannot route PHI-containing documents to other parties without the clinic’s knowledge.
• Configure storage retention. Decide how long completed envelopes are retained in DocuSign’s cloud and align this with the clinic’s document retention policy.
• Audit admin access. Limit which staff members can view completed envelopes in the account and review access regularly.

Documents covered and not covered

The DocuSign BAA covers eSignature envelopes created and stored within the covered account. Signed documents that are:

• Downloaded and saved to a non-covered system require that system to be under its own BAA or equivalent protection
• Shared via link with third parties place responsibility on the clinic to ensure those parties are authorized to receive the PHI

Known limitations

DocuSign’s e-signature audit trail is valuable and serves as evidence of informed consent and signed authorization. It does not substitute for:

• HIPAA access logs covering who touched the underlying clinical record
• A record of which staff member sent the envelope, reviewed the signed document, or incorporated it into the patient’s designated record set
• The clinic’s broader policies governing how signed authorizations are retained and used

When to look beyond DocuSign