No e-signature tool is HIPAA compliant on its own. You can use DocuSign, Adobe Acrobat Sign or any other signing tool for documents that contain protected health information (PHI) only after three things are true. The vendor has signed a Business Associate Agreement (BAA) that covers the exact product and plan you use. The vendor provides the safeguards your risk analysis requires. Your practice has configured access, retention and signer verification correctly. This guide answers the DocuSign and Adobe questions vendor by vendor and gives you a checklist for any tool. It also states plainly that Chanty's own e-signature tool is planned and not available today.
- Short answer: what makes an e-signature tool HIPAA compliant
- What HIPAA expects from an e-signature vendor
- Is DocuSign HIPAA compliant?
- Is Adobe Acrobat Sign or Adobe Document Cloud HIPAA compliant?
- Is there a free HIPAA-compliant electronic signature tool?
- Checklist: choosing a HIPAA e-signature tool for your practice
- Where Chanty fits, and the status of our e-signature tool
- Related templates and guides
- FAQ
Short answer: what makes an e-signature tool HIPAA compliant
Compliance is shared between the vendor and your practice. A vendor can offer a BAA and strong controls. Your practice still decides who can create templates, who receives signed copies, how long records are kept, and what staff are trained to do.
HIPAA matters when the signed document contains PHI. Common examples in an outpatient practice:
- New-patient intake packets with history, medications or insurance details
- Treatment consents and financial responsibility forms tied to a patient
- HIPAA authorizations to release records to a third party
- Records requests from other providers or attorneys
Many HR documents, such as offer letters, handbook acknowledgments and tax forms, usually raise different questions. Employee files held in your role as employer may fall outside HIPAA's PHI definition. Other privacy and employment laws can still apply, so confirm with counsel.
Legal validity is a separate question from HIPAA. Whether an electronic signature is enforceable comes from laws such as the federal ESIGN Act and state laws based on the Uniform Electronic Transactions Act (UETA). Some states and document types have their own rules or exceptions. A tool can be acceptable under HIPAA and still need legal review for a specific form type.
Quick answers (details in the sections below):
| Tool | BAA offered? | Eligible plans or add-ons | Source and date checked |
|---|---|---|---|
| DocuSign eSignature | Ask DocuSign and get the answer in writing | Confirm which plan or add-on the BAA covers | DocuSign's current trust or compliance page; record the date you checked |
| Adobe Acrobat Sign | Ask Adobe and get the answer in writing | Confirm which Acrobat Sign plans are eligible | Adobe's current trust or compliance page; record the date you checked |
| Adobe Document Cloud / Acrobat | Confirm which products Adobe's BAA covers | Confirm individual vs. business vs. enterprise eligibility | Adobe's current trust or compliance page; record the date you checked |
What HIPAA expects from an e-signature vendor
A signed BAA before any PHI enters the tool. That includes PHI in documents, envelopes, templates, signer fields, email subject lines and attachments. A BAA is required when a vendor creates, receives, maintains or transmits PHI on your behalf. Signing the BAA after staff have already sent intake packets through a trial account does not cover those earlier envelopes.
Technical safeguards that matter for signing workflows:
| Safeguard | What to look for in a signing tool |
|---|---|
| Access control | Unique user accounts, role-based permissions, restricted template editing, SSO or 2FA |
| Audit controls | A record of who sent, viewed, signed, declined or downloaded each document, with timestamps |
| Integrity | Tamper evidence on the completed document, such as a certificate of completion or a seal |
| Transmission security | Encryption in transit for signer links, uploads and downloads |
| Encryption at rest | Encrypted storage of completed documents and attachments |
Retention and deletion. Find out how long the vendor keeps completed documents and audit logs, whether you can set your own retention period, and who can bulk-export records if you switch vendors. HIPAA has its own documentation retention requirement. Medical record retention is often set by state law.
Signer identity checks. Each method changes your PHI exposure:
- Email link only. This is the simplest option. A typo in the patient's email address sends their intake packet to a stranger.
- SMS or access code. This adds a second factor. The vendor then also processes phone numbers, and SMS delivery may involve sub-processors, so confirm the vendor's BAA covers SMS authentication.
- ID verification. This gives stronger assurance, but it often runs through a third-party verification provider. Confirm that provider is covered by the BAA or a downstream agreement.
Move staff chat off personal phones
Chats, calls, announcements and assigned tasks for clinic staff in one workspace. HIPAA-compliant with a signed BAA on the Business and Enterprise plans.
The Free plan has no BAA: do not use it for protected health information.
Is DocuSign HIPAA compliant?
DocuSign, like any vendor, is not HIPAA compliant by itself. The questions are whether DocuSign will sign a BAA for your account, on which plan, and what you must configure.
BAA availability and process. Ask DocuSign directly whether it will sign a BAA for your eSignature account, which plans or add-ons qualify, and whether the request goes through sales, an account admin or an online form. Get the answer in writing and keep the source and the date you checked.
What DocuSign states about HIPAA, PCI DSS and other attestations. Review DocuSign's current trust center wording on HIPAA, PCI DSS and other attestations, and note the date you checked. Read the exact wording. Some vendors say they "support" or "enable" HIPAA compliance. Attestations such as PCI DSS cover payment card data and are not a substitute for a BAA.
Pricing for HIPAA-eligible plans. This is a common question, so record what you find with a date:
| DocuSign plan | Price per user/month | Envelope limits | BAA eligible? |
|---|---|---|---|
| Entry-level plan | Record current price | Record limit | Confirm with DocuSign |
| Mid-tier plan | Record current price | Record limit | Confirm with DocuSign |
| Enterprise or custom tier | Record price or whether sales contact is required | Record limit | Confirm with DocuSign |
Write down the date you checked prices. Also ask whether the BAA requires a specific tier, an add-on fee or a sales contract.
Configuration your practice still owns (confirm the exact setting names in DocuSign's admin documentation):
- Who can create and edit templates. A front desk lead editing the consent template without review is a common source of errors.
- Which users can see completed envelopes from other senders
- Signer authentication defaults for patient-facing documents
- Retention and purge settings for completed envelopes
- Whether email notifications include document names or field content that reveal PHI
Is Adobe Acrobat Sign or Adobe Document Cloud HIPAA compliant?
Naming first. Adobe Sign is now called Adobe Acrobat Sign. It sits within Adobe Document Cloud, alongside Acrobat. Searches for "Adobe Sign," "Acrobat Sign" and "Adobe Cloud" often refer to different products with different terms. Confirm which one your practice actually licenses.
BAA scope. Ask Adobe whether it offers a BAA, which products it covers (Acrobat Sign, Acrobat, other Document Cloud services), which plans are eligible and how to request it. Keep the source and the date you checked.
Individual vs. business plans. Many practices start with an individual Acrobat subscription bought by one staff member. Check whether individual or small-team plans are eligible for a BAA, or only business and enterprise agreements. If the plan in use is not eligible, keep PHI out of it until you move to an eligible plan.
Compliance documentation to review. Review Adobe's current trust center or compliance page, note its wording on HIPAA, and record the date you checked. Pay attention to whether the documentation lists specific services as in scope. A BAA that covers Acrobat Sign may not cover every Adobe cloud service your staff use.
Is there a free HIPAA-compliant electronic signature tool?
Free tiers usually exclude a BAA. Without a BAA, PHI should not go into the tool, regardless of the tool's security features.
Free or low-cost options with a BAA. We have not confirmed a free plan that includes a BAA. If a vendor says its free or low-cost plan includes one, get the BAA terms and plan name in writing.
Hidden costs on paid tiers (limits vary by vendor):
- Monthly envelope caps that a busy front desk can exceed in the first week of intake season
- Signer authentication by SMS or ID check charged per use
- Admin controls, audit exports and retention settings that are available only on higher tiers
- API access for connecting to your EHR or storage, often priced separately
Keep non-PHI documents on a separate decision path. An internal acknowledgment that staff read the updated phone policy may not need a BAA-covered tool. Decide this deliberately and write it down. Staff should not guess which tool to use for which document.
Checklist: choosing a HIPAA e-signature tool for your practice
Use this checklist for any vendor. You can also review other popular tools checked for HIPAA that often sit next to e-signature in a practice's stack.
| Item to confirm | Why it matters | Suggested owner |
|---|---|---|
| BAA signed, covering the exact product and plan, including mobile apps and API if used | A BAA for one product may not extend to another | Privacy officer |
| Audit trail, access roles, encryption, retention and export confirmed in writing | Sales calls are not documentation | IT manager |
| Integrations checked separately (EHR, cloud storage, automation tools) | A vendor's BAA may not cover third-party connections | IT manager |
| Signer verification method chosen per document type | Intake packets and HR forms need different handling | Practice administrator |
| Template ownership assigned, with a review step for consent and authorization forms | Stops unreviewed edits to legal language | Clinic manager |
| Offboarding steps documented (remove access, reassign templates and pending envelopes) | Former staff should not keep access to signed PHI | HR and IT |
| Periodic access review scheduled | Roles drift as staff change | Privacy officer |
| Tool added to the risk analysis and staff training before go-live | HIPAA requires a risk analysis | Privacy officer |
Where Chanty fits, and the status of our e-signature tool
Chanty's e-signature tool is planned. It is not available today. This page is a guide, not a product listing. There is no public timeline for the e-signature tool.
Chanty today is internal team chat for clinic and practice staff. It includes chats, calls, announcements, files and assigned tasks in one workspace. HIPAA compliance with a signed BAA is available on the Business and Enterprise plans. The Free plan does not include a BAA, so PHI should not be shared on it. Messages are encrypted in transit with TLS 1.2+, and file storage is encrypted. See Chanty security, HIPAA and BAA details for current plan terms.
Use Chanty to coordinate the work around signatures, and keep the documents themselves in your signing system. Examples:
- A new hire's onboarding packet has been unsigned for three days. The HR coordinator turns the message into a task with an owner and a Friday deadline. The task shows up on the team's Kanban board.
- Counsel approves new consent language. The practice administrator posts an announcement to all locations and assigns each clinic manager a task to confirm their front desk is using the updated template.
- A front desk lead asks the billing team which financial responsibility form version is current. The answer is pinned in the channel so the next person can find it in searchable history.
When a thread concerns a specific patient's paperwork, refer to the envelope or document ID rather than copying clinical details into chat. This follows the minimum necessary principle even when a BAA is in place.
Chanty is not a patient messaging, EHR, document management or document-signing platform. It does not integrate with DocuSign, Adobe Acrobat Sign or EHR systems. Third-party integrations you connect fall outside Chanty's BAA scope. Learn more about HIPAA-compliant chat for staff.
Try Chanty for staff coordination: sign up at chanty.com. A BAA requires the Business plan or higher.
Related templates and guides
- HIPAA release form template: a document that commonly needs a patient signature.
- HIPAA-compliant form builder guide: Chanty's form builder is a planned tool. The guide covers what to check in form tools today. We also answer whether Google Forms, Microsoft Forms, Wix and WordPress forms are HIPAA compliant. See also our patient intake form templates.
- HIPAA-compliant online fax: Chanty's fax tool is also planned. This guide is for practices that still receive signed forms by fax.
- Browse all free HIPAA tools and templates.
Move staff chat off personal phones
Chats, calls, announcements and assigned tasks for clinic staff in one workspace. HIPAA-compliant with a signed BAA on the Business and Enterprise plans.
The Free plan has no BAA: do not use it for protected health information.
FAQ
Is DocuSign HIPAA compliant?
No software is HIPAA compliant on its own. DocuSign can be used with PHI only if a BAA is in place for your account and plan, and your practice configures it correctly. Confirm BAA availability and eligible plans directly with DocuSign, and keep the source and the date you checked.
Does DocuSign sign a BAA, and how much does a HIPAA-eligible plan cost?
Ask DocuSign whether it will sign a BAA for your account, how to request it, which plans are eligible, what they currently cost per user per month, and whether an add-on or sales contract is required. Record the date you checked. Factor in envelope limits and signer authentication fees, which can add to the base price.
Is Adobe Acrobat Sign HIPAA compliant?
Acrobat Sign can support HIPAA compliance only under a BAA that covers it, on an eligible plan, with your own configuration and policies in place. Confirm Adobe's BAA scope for Acrobat Sign and the eligible plans with Adobe, and record the source and date checked.
Is Adobe Document Cloud HIPAA compliant?
Document Cloud includes several products, and a BAA may not cover all of them. Ask Adobe which Document Cloud products its BAA covers and which plans are eligible. Confirm coverage for each product your staff use, including Acrobat on desktop and mobile.
Are electronic signatures legally valid on HIPAA authorizations and consent forms?
Electronic signature validity is governed by laws such as the federal ESIGN Act and state versions of UETA. HIPAA authorizations have their own content requirements. State rules may add exceptions. Have counsel review your authorization and consent forms before moving them to e-signature.
Is there a free HIPAA-compliant e-signature tool?
Most free plans do not include a BAA, and without a BAA PHI should not go into the tool. We have not confirmed a free plan that includes a BAA. Check the envelope limits and admin controls on any low-cost plan before you commit.
Does a BAA alone make an e-signature tool HIPAA compliant?
No. A BAA sets out the vendor's obligations. Your practice still has to configure access and retention, choose signer verification, train staff, review access regularly and include the tool in your risk analysis.
Does Chanty have an e-signature feature?
No. Chanty's e-signature tool is planned and not available today. Chanty currently offers internal staff chat, calls, announcements, files and assigned tasks. A signed BAA is available on the Business and Enterprise plans.