E-signature

DocuSign appears to fall into the category of a business associate when healthcare providers use its services for protected health information (PHI). DocuSign offers AES 256-bit encryption for data in transit and at rest. This encrypted information is stored on DocuSign’s servers, and the company states that it doesn’t have access to the information.DocuSign seems to meet Health and Human Services (HHS) standards for digital signatures.This service enables HIPAA features through its digital tracking system. Each e-signature has an audit trail that’s fully traceable. DocuSign data centers are SOC 2 audited and ISO 27001 certified.When signing a document, the service captures names, email addresses, time stamps, signing location, public IP addresses, and document completion status.While DocuSign offers essential encryption, auditing, and security standards, it’s the responsibility of each customer to ensure that they share and access PHI in a manner that follows HIPAA regulations.

PandaDoc appears to have all the necessary safeguards in place to help healthcare organizations comply with HIPAA regulations while using its e-signature features.The platform touts document encryption, user-level permissions, dedicated monitoring and alerts, and secure architecture to protect electronic patient health information (e-PHI).According to the PandaDoc website, the platform complies with SOC 2 Type II, GDPR, and eIDAS. The company states that it will provide customers with a signed Business Associate Agreement (BAA). 

When using e-signatures for protected health information (PHI), you must institute security and privacy protections for electronic transmission and storage of data to meet HIPAA requirements. Adobe Sign offers configuration options to comply with HIPAA standards and allow organizations to meet industry-specific compliance requirements for e-signatures. Each client must configure features such as account time-out, password length, and accessibility settings.Covered entities can use authentication to manage user identities, certify each document’s integrity, maintain audit trails, and track document delivery. This tool is helpful for healthcare providers because the e-signature features can be integrated with other HIPAA-compliant software services.Adobe Sign offers a business associate agreement (BAA) for customers on an Enterprise plan.

According to the Dubsado Help Center, Dubsado does not enable HIPAA compliance. Additional safeguards would have to be put in place in order for the platform to comply with HIPAA rules. The website states that Dubsado has no immediate plans to make the changes necessary to enable HIPAA compliance. A look at its roadmap portal confirms no plans have been published. There is also no mention of Business Associate Agreements (BAA) on the website.

Dropbox Sign appears to provide HIPAA-friendly solutions for covered entities, ensuring security and privacy for all documents that contain protected health information (PHI). The service uses Transport Layer Security (TLS) encryption for all communications in transit and AES 256-bit encryption for stored files.Enterprise-level security controls include two levels of encryption for each document: a unique document encryption key (DEK) for each file and a master key that protects the DEK, which is regularly rotated for additional security. This configuration offers an extra layer of security in the event that someone bypasses physical security measures to access a hard drive.Dropbox Sign also offers audit reports that track activity and changes made to each document, giving covered entities the ability to view the audit trail as needed. Dropbox Sign conducts regular user access reviews and provides extensive training for employees on HIPAA’s security and privacy rules.Customers must have a Dropbox Sign Enterprise account to access features that enable HIPAA compliance and Service Organization Control (SOC) 2.