Does DocuSign Sign a HIPAA Business Associate Agreement?
By BAA Generator Research Team · Published Apr 19, 2026 · Last reviewed Apr 28, 2026 · 2 min read
Key Takeaways
- ✓ Yes — DocuSign offers a HIPAA BAA on Business Pro and Enterprise plans
- ⚠ DocuSign Personal and Standard plans are not eligible — do not use for PHI documents
- ✓ Must request the BAA from DocuSign — not self-service
- ✓ Dropbox Sign (formerly HelloSign) is a less expensive alternative with a BAA on Business plans
- ✓ The BAA covers DocuSign's platform — you still need BAAs with other vendors
DocuSign is ubiquitous in healthcare for patient consent forms, intake packets, authorization forms, and provider agreements. If any of those documents contain patient names, dates of birth, diagnoses, or other PHI, your DocuSign account must be covered by a BAA.
Which DocuSign Plans Qualify for a HIPAA BAA?
DocuSign's HIPAA BAA is available on:
- DocuSign Business Pro — the mid-tier business plan
- DocuSign Enterprise — full enterprise plan with advanced features
Not eligible: DocuSign Personal ($15/mo), DocuSign Standard ($25/mo). These plans do not qualify for HIPAA BAA coverage. If you're currently using a Personal or Standard plan for patient-facing documents that contain PHI, you must upgrade before those documents can be sent compliantly.
How to Get DocuSign's HIPAA BAA
Unlike Google Workspace's self-service Admin console acceptance, DocuSign requires a manual request:
- Ensure your organization is on DocuSign Business Pro or Enterprise
- Contact DocuSign's support or your account representative and request the HIPAA BAA
- DocuSign will provide their standard BAA for review and signature
- Once executed, retain a copy in your compliance records
Do not use DocuSign for PHI-containing documents until the BAA is fully executed and on file.
What a DocuSign BAA Covers
DocuSign's HIPAA BAA covers DocuSign's obligations for PHI transmitted through or stored within the DocuSign platform, including:
- Encryption of documents at rest and in transit
- Access controls and audit trails for all document activity
- Breach notification requirements
- Data retention and deletion practices
Cost-Effective Alternative: Dropbox Sign
For small practices and startups where DocuSign Business Pro pricing is prohibitive, Dropbox Sign (formerly HelloSign) is a commonly used alternative. Dropbox Sign's Business plan offers a HIPAA BAA at a lower price point than DocuSign's qualifying plans. Both platforms support HIPAA-compliant e-signature workflows when the BAA is in place.
More vendor BAA guides
Generate a compliant BAA in 5 minutes
HHS model BAA provisions · 45 CFR § 164.504(e) compliant · clean PDF + editable Word
No subscription · PDF + Word · Free watermarked preview