DocuSign HIPAA Compliance for Telehealth Consent Forms

DocuSign explains in its HIPAA and electronic signature guidance that its eSignature service can support HIPAA compliance when configured appropriately. It also emphasizes that electronic signing alone does not establish compliance. For telehealth businesses, that distinction connects to broader HIPAA compliance requirements governing how patient information is collected, transmitted, stored, and accessed.

Which Envelopes Hold PHI?

In DocuSign, an envelope is the package used to send documents for electronic signing. The privacy requirements depend partly on what the envelope contains.

Some documents used by a telehealth organization typically do not include PHI:

• Vendor agreements covering ordinary business services
• Contracts between the company and clinicians
• Business associate agreements between organizations
• General administrative or employment documents without patient information

For example, a business associate agreement establishes obligations regarding patient information, but the agreement itself does not necessarily contain any patient's medical details.

Other documents may contain PHI because they identify a patient and relate to healthcare:

• Telehealth consent forms completed by identified patients
• HIPAA authorizations identifying individuals or their health information
• Intake forms containing symptoms, diagnoses, or medications
• Medical records release requests with patient details
• Clinical documents attached to a signature request

The document's title alone does not determine the distinction. A contract that ordinarily contains no PHI could include it if someone attaches identifiable patient records. Conversely, an unsigned blank consent template may contain no PHI until patient information is entered.

Understanding which documents contain PHI helps operators decide whether the electronic signature vendor handles information subject to HIPAA.

The organization should examine not only the document being signed but also the envelope's supporting information, such as subject lines, attachments, recipient details, and completed copies. Those fields may reveal patient healthcare information even when the main document is relatively brief.

The Agreement: Is DocuSign HIPAA Compliant Without One?

When a healthcare provider uses an outside service to maintain or transmit electronic protected health information (ePHI), the vendor may qualify as a business associate under HIPAA.

According to HHS business associate guidance, covered entities generally need appropriate contractual assurances from business associates that handle PHI on their behalf.

Those assurances are documented through a business associate agreement (BAA).

DocuSign acknowledges that it may qualify as a business associate when a healthcare organization uses eSignature for documents containing PHI. It states that its systems may hold encrypted PHI even though DocuSign personnel do not have access to the underlying information in the manner described in its published guidance.

The company also reports having entered into agreements with numerous HIPAA-covered organizations.

What the Telehealth Company Needs to Confirm

Before sending patient information, a telehealth operator should confirm directly with DocuSign that the intended account and services are eligible for the appropriate agreement and that it has been executed.

The company should also identify what services the agreement covers, particularly if its workflow involves additional products or integrations.

A signature vendor's general security commitments and an executed BAA are different things. Both may matter, but one does not substitute for the other.

The same principle applies when a telehealth business uses several systems to collect patient information. Each outside service that handles PHI on the organization's behalf requires an assessment of its responsibilities and the contractual relationship.

Support and CRM tools count too. Bask Health's integrations page lists connections such as Zendesk and Intercom, and if signed forms or patient questions pass through tools like these, they belong in the same review.

The Account Settings

An appropriate BAA establishes contractual responsibilities, but the organization's configuration determines how employees and patients interact with the signing service.

A telehealth company might allow several departments to prepare envelopes, invite signers, view completed agreements, or manage account settings. Those permissions should reflect what employees actually need to perform their jobs.

The HIPAA Security Rule requires access controls designed to limit access to ePHI to authorized people.

For DocuSign, this means reviewing which employees can send patient documents, open completed envelopes, and administer the account.

Access to Completed Documents

Consider a practice where the operations team sends consent requests but only authorized clinical and records personnel need access to certain completed patient forms.

Allowing every employee to view every envelope could unnecessarily expose information.

The organization should assign access according to responsibilities and review permissions when employees move into new roles or leave the company.

Employee access is also relevant when documents are shared outside the original recipient list. A completed medical authorization may contain information that should not be distributed through ordinary administrative channels.

Teams designing intake forms should decide which documents actually require an external signature workflow and who needs access to the results.

Retention and Storage

DocuSign states that eSignature customers determine the retention policies for their accounts.

This makes retention an operational decision rather than something the telehealth brand should leave to default assumptions.

The organization needs to establish how long documents must remain available, which records belong in its clinical system, and what happens when a document is no longer needed in the signing account.

Those decisions should reflect applicable recordkeeping requirements and the organization's privacy and security procedures.

DocuSign also describes encrypted storage of PHI within its systems. Encryption is an important safeguard, but it does not eliminate the need for appropriate permissions, account management, and retention practices.

A telehealth business should therefore review how the account is used throughout a document's lifecycle, including preparation, delivery, completion, access, and eventual removal when permitted.

The Signed Copy

A completed signature is only one part of the record the organization may need to maintain.

For consent forms and authorizations, the practice must be able to identify which document was signed, who signed it, and how the completed record relates to the patient's care.

DocuSign eSignature provides a certificate of completion containing details about the signing process. Its published documentation describes signers and records actions such as opening, viewing, and signing the document.

That evidence can help establish the history of the electronic transaction.

Keep the Record With the Patient's Care

The signed form should be available through the organization's appropriate patient-record process rather than existing only inside an external e-signature account.

For example, a completed telehealth consent should be linked to the correct patient and available to authorized personnel who need to confirm the applicable consent was obtained.

In Bask Health, the patient record lives in its EMR, which stores medical history, prescriptions, and test results, so the practical question for a brand is how a consent signed in DocuSign attaches to that same record instead of staying only in the signing account.

Where a consent form changes over time, the organization should also be able to identify which version the patient completed.

A certificate of completion can support documentation of the signing process, but it does not independently determine whether the form's content satisfies applicable medical consent requirements.

Clinical and operational teams still need to determine whether consent was properly obtained and whether additional records are required.

A Completed Envelope Is Not the Entire Medical Record

A signing platform can document agreement to a form, but the healthcare organization remains responsible for managing that information within its clinical and administrative recordkeeping processes.

For a telehealth consent, the signed record may need to be considered alongside the patient's encounter documentation, relevant notices, and applicable state consent requirements.

Similarly, a HIPAA authorization may require the organization to preserve the authorization and use the information only within its permitted scope.

A practical workflow therefore connects the signed document to its purpose. The signing event should produce a usable record for the people responsible for the patient's care, privacy rights, or administrative request.

Is an E-Signature Legally Valid?

Federal law generally recognizes electronic signatures and records.

Under the Electronic Signatures in Global and National Commerce Act (ESIGN Act), a signature or record generally cannot be denied legal effect solely because it exists electronically.

The Act also provides that a contract cannot lose legal effect solely because it was formed using an electronic signature or electronic record.

These principles appear in 15 U.S.C. §7001.

For healthcare organizations, this means that electronic signing is not inherently invalid merely because the patient does not put pen to paper.

However, ESIGN does not eliminate other legal obligations attached to particular documents or transactions. A valid electronic signature does not automatically mean a patient received every required disclosure, that medical consent was informed, or that the organization complied with HIPAA.

Some documents may also have additional requirements under state law or applicable healthcare regulations. Organizations should have qualified counsel review forms governed by specific signature or consent rules.

The federal statute defines an electronic signature in 15 U.S.C. §7006(5) as "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."

FAQs

Does DocuSign Sign a BAA?

Yes, on its Enhanced plans. DocuSign's eSignature pricing lists HIPAA support through a BAA only for Enhanced plans, which are arranged through sales, and not for its Personal, Standard, or Business Pro plans. DocuSign also states that it has entered into agreements with numerous HIPAA-covered entities.

Before sending PHI, a healthcare organization should still confirm that the agreement has been executed and covers the services it intends to use.

Are Electronic Signatures HIPAA Compliant?

HIPAA does not categorically prohibit electronic signatures. Key compliance questions focus on the information handled, the vendor's contractual relationship, and the safeguards around the signing process.

The ESIGN Act recognizes electronic signatures, while HIPAA governs applicable privacy and security obligations. Satisfying one does not automatically satisfy the other.

Do Telehealth Consent Forms Have to Be Signed in a Tool Like DocuSign?

No particular electronic signature product is universally required for telehealth consent.

Consent requirements vary by state, service, and applicable program rules. Some circumstances permit documented verbal consent, while others may require written or electronic documentation.

The practice should determine what form of consent is required and select a documentation process that meets those obligations.

References

1. DocuSign. (n.d.). Is DocuSign eSignature HIPAA compliant? https://www.docusign.com/blog/electronic-signature-hipaa-forms
2. DocuSign. (n.d.). eSignature plans and pricing. https://ecom.docusign.com/plans-and-pricing/esignature
3. U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
4. U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
5. U.S. Government Publishing Office. (2024). 15 U.S.C. chapter 96: Electronic signatures in global and national commerce. https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap96.htm