HIPAA-compliant e-signatures: what healthcare teams actually need
HIPAA allows e-signatures, but your vendor must sign a BAA and protect PHI. What the Security Rule expects, what to ask vendors, and how HIPAA mode works.
Clinics, therapists, dental offices and health-tech startups all run on paperwork: intake forms, consent to treat, release-of-information authorizations, financial policies and staff agreements. Moving that paperwork to e-signatures saves hours a week, but patient forms contain protected health information (PHI), which brings HIPAA into play. Here's what that actually requires.
Can you use e-signatures under HIPAA?
Yes. HIPAA doesn't prohibit electronic signatures and doesn't specify a signature technology. Electronic signatures on health forms are generally valid under the same laws that cover other e-signatures (in the US, the ESIGN Act and UETA). HIPAA's concern is the information: who can see it, how it's protected, and who is accountable for it.
The Business Associate Agreement
Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity (a healthcare provider, health plan or clearinghouse) is a business associate. Before you share PHI with one, you need a Business Associate Agreement. Among other things, a BAA commits the vendor to:
- Use and disclose PHI only as the agreement permits
- Implement Security Rule safeguards for electronic PHI
- Report security incidents and breaches of unsecured PHI to you
- Make sure its own subcontractors that handle PHI agree to the same restrictions
- Return or destroy PHI when the relationship ends, where feasible
An e-signature platform that stores your patient forms is a business associate. No BAA means no PHI, however good the security looks.
What the Security Rule expects from the software
The HIPAA Security Rule groups technical safeguards into a few areas. Here's how they map to an e-signature tool:
| Safeguard | What it means for e-signatures |
|---|---|
| Access control | Unique user accounts, strong authentication, and automatic logoff after inactivity |
| Audit controls | A record of who opened, downloaded or deleted each document |
| Integrity | Protection against documents being altered or destroyed improperly |
| Authentication | Confidence that the person signing or viewing is who they claim to be |
| Transmission security | Encryption in transit, and care with what goes into email |
Note that the Security Rule is risk-based. Your own risk analysis, policies, workforce training and incident response plan are your responsibility, whatever software you choose.
Questions to ask any e-signature vendor
- Will you sign a BAA, and on which plan?
- What goes into notification emails? Document titles like "Oncology consent – Jane Doe" are PHI.
- Is there an audit log of every view, download and deletion, and can it be edited?
- Do sessions log out automatically when idle?
- Is two-factor authentication required, or just available?
- Can your own staff see our documents?
- How long do links in emails keep working?
- Where is data stored, and is it encrypted at rest?
How Parapho's HIPAA mode works
On the Team plan, a workspace owner opens Settings & API → HIPAA & BAA, enters the covered entity's legal name and their title, agrees to the Business Associate Agreement and confirms with an authenticator code. HIPAA mode turns on immediately, and owners and admins can download the executed BAA at any time. Here's what changes:
- No PHI in email. Invitations, reminders, completion, void and decline emails leave out the document title, your message and any decline reason.
- BAA-covered email only. Email for HIPAA workspaces goes only through a BAA-covered sending service, never a general marketing email provider.
- Expiring links. Download links in "completed" emails stop working after 7 days.
- Automatic logoff. Sessions end after 15 idle minutes, and the screen is cleared.
- Append-only access log. Every open, download and deletion by a team member, API key or signer is recorded. The application itself can't edit or delete log entries, and they outlive deleted documents. Owners and admins can view and export them as CSV.
- Private verification. The public verify page confirms a sealed file is authentic without revealing its title or signers.
- Restricted operator access. Parapho staff tools can't list a HIPAA workspace's documents or templates.
- No accidental downgrade. Changing plans never turns HIPAA mode off.
Those sit on top of protections every Parapho workspace gets: mandatory two-factor authentication, database-level isolation between workspaces, AES-256 encryption at rest with AWS KMS, digitally signed and fingerprinted PDFs, and a full audit trail on every document. The security page has the details.
Getting started
Team costs $15 a month or $150 a year for your whole practice, with unlimited users. Nonprofits and education get it free. Create a workspace, upgrade to Team, sign the BAA in the app, then build your intake and consent forms as reusable templates or public form links.
Frequently asked questions
Does HIPAA allow electronic signatures?
Yes. HIPAA doesn't prohibit electronic signatures or mandate a particular signature technology. Patient consent forms, authorizations and intake paperwork can be signed electronically, as long as the PHI involved is protected as the Privacy and Security Rules require.
Do I need a BAA with my e-signature provider?
If the provider creates, receives, maintains or transmits protected health information on your behalf, it's a business associate, and HIPAA requires a Business Associate Agreement before you use it with PHI. Patient forms almost always contain PHI.
Is there such a thing as HIPAA certification?
No. The US Department of Health and Human Services doesn't certify products as HIPAA compliant. Vendors can support your compliance with safeguards and a BAA, but the covered entity remains responsible for its own policies, training and risk analysis.
Can email notifications include patient information?
It's best to avoid it. Ordinary email passes through systems you don't control. Parapho's HIPAA mode sends invitations, reminders and completion notices with no document title, message or decline reason, and sends them only through a BAA-covered email service.
How much does HIPAA mode cost in Parapho?
It's included in the Team plan, which costs $15 a month or $150 a year for the whole workspace with unlimited users.
This article is general information, not legal advice. Rules differ by country, state and document type; check with a lawyer for anything high-stakes.