Is DocuSign HIPAA compliant? E-signatures for patient forms

Is DocuSign HIPAA compliant? Short answer from its documentation

So the practical answer: DocuSign can be used for PHI on an Enhanced plan with a signed BAA. On the plans you can buy online, it shouldn't touch patient forms.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Plans, BAAs and account settings

DocuSign's HIPAA blog post (opens in a new tab) adds the timing: "A signed BAA must be completed by the vendor prior to providing services." Ask sales which Enhanced plan your practice needs, get the BAA signed, and file it with your other business associate agreements.

With no published HIPAA configuration list to follow, set your own baseline:

• Signer authentication. DocuSign's blog lists email, access code, phone, SMS, knowledge-based and ID verification options. For forms with health details, an access code given by phone is a sensible minimum.
• Templates owned by one admin. Keep consent and authorization templates under one admin's control, so staff always send approved wording.
• Named users only. No shared logins at the front desk; each sender is accountable in the audit trail.
• Retention rule. DocuSign says customers "determine their accounts' retention policies." Decide yours before the first envelope (see the last section).

If your practice already pays for a covered Dropbox team plan, Dropbox's HIPAA article (opens in a new tab) lists Dropbox Sign among the products it applies to. Compare the two in Dropbox and Box.

Are e-signatures valid for HIPAA authorizations?

Yes, with conditions. HHS says "the Privacy Rule allows HIPAA authorizations to be obtained electronically from individuals," "provided any electronic signature is valid under applicable law" (HHS FAQ 554 (opens in a new tab)).

The federal E-SIGN Act supplies much of that "applicable law." For transactions "in or affecting interstate or foreign commerce," a signature or record "may not be denied legal effect" "solely because it is in electronic form" (15 U.S.C. 7001 (opens in a new tab)). It also doesn't require anyone "to agree to use or accept electronic records or electronic signatures," so keep a paper path for patients who prefer one. DocuSign notes its Electronic Record and Signature Disclosure can help get consent to electronic notices "as may be required under the US ESIGN Act" (DocuSign customer compliance (opens in a new tab)).

What E-SIGN doesn't do is fix the form. Under 45 CFR 164.508 (opens in a new tab), a valid authorization still needs its required elements, including "Signature of the individual and date," and the practice "must provide the individual with a copy of the signed authorization." Our guide to HIPAA authorization forms covers the wording.

What envelopes, attachments and emails reveal

The signed PDF is protected inside your account. The emails around it are not. DocuSign's blog describes signers being checked against "the email address used in the invitation," which means every envelope starts with an email that lands in the patient's ordinary inbox, on a shared family laptop or a work computer.

Write that email as if a stranger will read it:

Illustrative example; Lakeside Family Medicine is fictional.

Two more leaks to close:

• Attachments. Don't attach lab results or referral letters "for context." Send only the form being signed.
• Completion copies. Decide who on your team receives the completed copy by email. A completed authorization forwarded to a personal inbox is PHI outside your control.

Storing signed forms

HIPAA sets the floor. Under 45 CFR 164.508(b)(6), a covered entity "must document and retain any signed authorization," and 45 CFR 164.530(j) (opens in a new tab) sets the retention period at "six years from the date of its creation or the date when it last was in effect, whichever is later." State medical-records laws may require longer.

Pick one home for the signed copy, usually the patient's chart, and treat DocuSign as the delivery tool rather than the archive. Then set DocuSign's retention to match: keep envelopes only as long as you need them for follow-up, and purge after export if your compliance officer agrees.

For forms patients fill in before a visit, a form builder may suit better than an e-signature tool. Compare approaches in HIPAA-compliant forms and HIPAA-compliant intake forms. For the email side, see HIPAA-compliant email and messaging.

Medfy doesn't provide e-signatures. Its base plan includes HIPAA-compliant forms on your own website that feed a patient CRM and inbox, and Medfy signs a BAA with each practice. See how Medfy handles patient data. A free marketing audit also flags privacy risks such as tracking pixels on pages with patient forms.

Frequently asked questions

Does DocuSign sign a BAA?

Yes, but not on every plan. As of October 2026, DocuSign's healthcare page says it may enter into a BAA with a HIPAA covered entity, and its eSignature pricing table shows "HIPAA support through BAA" as not included in Personal, Standard or Business Pro, with Enhanced plans marked "Contact sales." Get the signed BAA before any patient form goes out, and confirm the plan with your compliance officer or attorney.

Can a HIPAA authorization be signed electronically?

Yes. HHS says the Privacy Rule allows HIPAA authorizations to be obtained electronically, provided any electronic signature is valid under applicable law. The federal E-SIGN Act keeps a signature from being denied legal effect solely because it's electronic. The form still needs every element HIPAA requires, including the signature and date, and the patient gets a copy. Have your compliance officer or attorney review the template.

Is DocuSign safe for patient consent forms?

It can be, on a plan covered by a signed BAA, with neutral email wording, signer authentication such as an access code, and a clear rule for where completed forms are filed. On a plan without a BAA, keep patient forms out of it. DocuSign itself says no company's product can be HIPAA compliant on its own. Confirm your setup with your compliance officer or attorney.

Where should signed patient forms be stored?

In the patient's chart or another system covered by a BAA, with access limited to staff who need it. HIPAA requires a signed authorization to be kept for six years from its creation or the date it was last in effect, whichever is later. Decide whether DocuSign keeps a copy or purges it after export, and write that rule down with your compliance officer.