HIPAA Electronic Signature & BAA Checklist for Clinics

Choosing a HIPAA electronic signature platform starts with the workflow, not the signature box. A practice needs to know which documents it can send, who can access them, what evidence it retains, and whether the exact service is approved for protected health information, or PHI.

This checklist helps you evaluate a vendor during a demo. PhiClaw offers a Docunvex-powered e-sign package for $10/month, with unlimited users and unlimited documents per month, added to a PhiClaw subscription. It is separately provisioned, and patient-data use requires completed activation. The same questions below should be answered before any real patient document enters the workflow.

1. Identify the document before choosing the tool

Bring a blank or fictional example of the agreement to your demo. Describe who signs it, why they sign it, whether a representative can sign, and which institution receives the completed copy. A business service agreement, a patient authorization, and a notarized document are different use cases.

HHS says HIPAA authorizations may be obtained electronically when the electronic signature is valid under applicable law. That does not establish that every signing tool supports every authorization or consent workflow. Read HHS’s electronic authorization guidance. Docunvex currently supports approved ordinary business agreements; additional categories need explicit review.

2. Ask which service the BAA covers

A Business Associate Agreement is a contract describing a vendor’s obligations for PHI. Ask for the agreement that applies to your organization and the exact workflow you intend to use. Identify the organization responsible for the signing service, rather than assuming its infrastructure provider’s contract is your own BAA.

HHS explains that a cloud provider handling electronic PHI can be a business associate even if the information is encrypted and the provider lacks the key. Cloud use requires an appropriate agreement and compliance with the HIPAA Rules. Source: HHS cloud guidance.

3. Walk through the full document journey

Ask the demo presenter to show preparation, recipient selection, delivery, signing, completion, and retrieval. Write down each place a document or recipient detail travels. Include notifications, downloads, and any automated connection, not only the screen where the signature is drawn.

For Docunvex, the platform describes link-based notifications, protected document access, completed PDFs, and signing evidence. Verify the current workspace configuration rather than treating a product description as confirmation that your own account is activated.

4. Review staff and recipient access separately

Ask how an owner adds a colleague, limits their access, and removes them later. Then ask how a recipient gains access to a particular document. Those are different permissions. A departing employee should not retain access just because the practice has an unlimited-user subscription.

During the fictional test, have a second staff account try to access something outside its role. Record the result. Ask who can download the final copy and where the practice will keep its own record. This is a practical evaluation exercise, not a substitute for a security review.

5. Inspect the completed evidence

Download the finished agreement and its evidence package. Check that your team can identify the document version, signer actions, and completion status. Try finding the record again from another authorized staff account. Make sure the office manager can explain what the timestamps do and do not show.

Docunvex retains completed PDFs and a Certificate of Completion with document fingerprints and an event history. These support an evidence record; they do not establish that a human read every word or guarantee acceptance by a particular recipient institution.

6. Check activation and the complete commercial terms

Before patient information is introduced, confirm provider approval, operating readiness, your applicable BAA, and workspace activation. Docunvex’s current activation status is linked below. Paying for a subscription alone does not complete those steps.

Ask for the base cost, sender limits, monthly volume, setup, and any extra charges. PhiClaw’s subsidized e-sign package is an incremental $10/month with unlimited users and monthly documents; a PhiClaw subscription is required. Its terms are separate from Docunvex’s direct plans.

Keep a short record of the answers and unresolved items. Then review PhiClaw’s e-sign offer or compare it with DocuSign’s published HIPAA terms.

Frequently asked questions

Does a cloud provider’s BAA automatically cover my practice?

Your practice needs the appropriate agreement with its service provider for its intended workflow. An infrastructure agreement alone does not establish that the complete application or your workspace is approved.

Is an electronic HIPAA authorization possible?

HHS permits electronic HIPAA authorizations when the electronic signature is valid under applicable law. The document and platform must still be suitable for the intended use.

What must be complete before patient information is used?

For this service, confirm provider approval, operating readiness, the applicable signed BAA, and activation of the workspace. Until then, use approved agreements without PHI.