Is DocuSign HIPAA Compliant?E-Signatures for Patient Forms

Only if your practice buys a Docusign Enhanced plan, signs a Business Associate Agreement (BAA) with Docusign, and configures the account for patient forms. The self-serve plans do not include HIPAA support. We read Docusign's own pricing, healthcare and HIPAA pages on October 14, 2026. Several third-party sites say otherwise, so check the vendor's page before you buy.

DocuSign and HIPAA at a glance

• Docusign says it may sign a BAA with a HIPAA covered entity.
• Docusign's pricing page lists HIPAA support through a BAA only on Enhanced plans.
• Personal, Standard and Business Pro do not include it.
• Enhanced plans are priced by quote through Docusign sales.
• E-signatures are allowed. The BAA and your settings are what make patient forms safe.

Does Docusign sign a BAA?

Yes, on the right plan. Docusign's healthcare page says: "Docusign may enter into a Business Associate Agreement (BAA) with a HIPAA Covered Entity." The word "may" matters. A BAA is not automatic. Your practice has to ask for it and sign it.

Docusign also accepts the business associate role. Its HIPAA article says: "Docusign is a Business Associate for HIPAA purposes when a healthcare provider uses Docusign eSignature for documents that contain PHI."

Which Docusign plan includes HIPAA support?

Only Enhanced plans. Docusign's eSignature pricing page lists "HIPAA support through BAA" as a feature. On October 14, 2026, it was not included in the three self-serve plans. The table shows what the page listed that day. Prices are per month on an annual commitment.

Are e-signatures allowed under HIPAA?

Yes. Docusign's HIPAA article puts it plainly: "HIPAA does not mandate that documents be signed in a particular way." The same article adds that an e-signature "doesn't constitute compliance on its own." The signature is fine. The patient data inside the form is what HIPAA protects.

Is encryption enough without a BAA?

No. Docusign says it "doesn't have access to the PHI, but it may hold PHI in encrypted form on its servers." HHS still treats that vendor as a business associate. Its cloud computing guidance says this "is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." A cheaper plan without a BAA is not a safe shortcut.

What must you configure in Docusign?

Docusign says: "With the correct configuration, Docusign eSignature can be HIPAA compliant for healthcare and life sciences organizations." It names two settings the customer controls: the authentication level for signers and the account's retention policy. It also says "Healthcare organizations are ultimately responsible for implementing technologies, policies and procedures" to protect PHI.

1. 1

   Get the right plan and the BAA

   Ask Docusign sales for an Enhanced plan that includes HIPAA support. Sign the BAA before you send any form with patient data.

2. 2

   Set signer authentication

   Choose a signer authentication level that confirms the patient is the person signing. Docusign says customers choose the level that fits their needs.

3. 3

   Set retention

   Decide how long completed envelopes stay in Docusign, and where the signed copy is stored for the medical record.

4. 4

   Limit who can send

   Give sending rights only to staff who need them. Remove access when someone leaves.

5. 5

   Check connected apps

   Any app that pulls completed forms out of Docusign needs its own BAA.

What happens if you use Docusign for patient forms without a BAA?

Your practice carries the risk, not Docusign. HHS's cloud guidance says that without a BAA, "the covered entity (or business associate) is in violation of the HIPAA Rules." A signed consent form with a diagnosis, an insurance ID or a date of birth is patient information. If it sits on a plan with no BAA, the gap is yours to fix.

Check your current account today. If staff send patient forms from a Standard or Business Pro plan, stop sending patient data from it. Then ask Docusign sales about an Enhanced plan, or move those forms to a tool whose vendor has already signed a BAA with you.

Should patient intake run through Docusign at all?

Sometimes not. Docusign is built for agreements: consent forms, financial policies and contracts. Long intake questionnaires often fit a form builder better. An Enhanced plan is a sales-quoted product, so a small practice may pay more than it needs. Compare it with the options in Which Online Forms Are HIPAA Compliant? before you choose.

How Webpatch helps

Webpatch manages HIPAA compliance and security for healthcare practices. We review your patient form flow from the website to the signed record, confirm each vendor has signed a BAA, and set up forms that send data only to tools covered by one. We are not a law firm. Contact Webpatch to review your e-signature and intake setup.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.