Is DocuSign HIPAA Compliant? E-Signatures for Clinics (2027)

Is DocuSign HIPAA compliant? DocuSign says that "with the correct configuration" its eSignature product can be HIPAA compliant for healthcare organisations, and that it acts as a Business Associate when a provider uses it for documents that contain PHI. The catch for small clinics is on DocuSign's pricing page: the "HIPAA support through BAA" row reads "Does Not Include" for the Personal, Standard and Business Pro plans, and "Contact sales" for Enhanced plans. In short, you can use DocuSign with patient information, but not on the plans you can buy online. This guide sets out what each vendor says on its own pages (checked September 2026) and how a clinic should choose.

Quick Answer

• DocuSign: HIPAA use needs a BAA, which the pricing page lists only on Enhanced plans (contact sales). The self-serve plans run from $11/month (Personal) to $45/user/month (Business Pro), on an annual commitment, and don't include it.
• Jotform: HIPAA features are on Gold ($129/month, or $99/month billed yearly) and Enterprise. Covered entities that enable them get a signed BAA.
• Dropbox Sign: HIPAA is supported on an annual Standard or Premium plan with a signed BAA and a minimum contract value.
• ClinikForms (ClinikEHR): forms and e-signatures run inside the EHR under the same BAA as the chart, with the signed copy filed on the patient record.

If all you need is patient consents and intake, a signing tool bought separately is often the most expensive way to get them.

Note: Vendor terms change. Every figure below comes from the vendor's own page on the date shown. Check each vendor's current terms before you sign. This article isn't legal advice.

Why a BAA Decides the Question

"HIPAA compliant" isn't a certificate a product holds. It describes how a covered entity and its vendors handle protected health information. HHS explains that a covered entity may disclose PHI to a business associate only after getting "satisfactory assurances, in the form of a contract or other written arrangement" (the Business Associate Agreement) that the information will be safeguarded (HHS: Business Associates, checked September 2026).

So the practical question for any e-signature tool is: will this vendor sign a BAA with my practice, on the plan I'm paying for? Security features matter too, but without a BAA the rest doesn't settle it.

What DocuSign Says

On its blog, DocuSign states: "With the correct configuration, Docusign eSignature can be HIPAA compliant for healthcare and life sciences organizations." It also says DocuSign is a Business Associate for HIPAA purposes when a healthcare provider uses eSignature for documents that contain PHI (docusign.com, checked September 2026).

DocuSign's eSignature pricing page lists these plans (ecom.docusign.com, checked September 2026):

What this means for a clinic: if you'll send documents containing PHI, plan for a sales conversation and an Enhanced plan. The prices above won't include the BAA. DocuSign doesn't publish Enhanced pricing, so ask for a quote.

How Jotform and Dropbox Sign Compare

Jotform

Jotform's pricing page says the Gold plan "provides optional HIPAA compliance features", describes those features as including encryption, auditing and PHI segmentation, and says they are available on Gold and Enterprise. The free Starter plan excludes them. Gold is $129/month, or $1,188/year ($99/month billed yearly), with 10,000 monthly submissions (jotform.com/pricing, checked September 2026). Jotform's HIPAA page adds that covered-entity customers who enable the HIPAA compliance features in their account also receive a signed Business Associate Agreement (jotform.com/hipaa, checked September 2026).

Jotform is a form builder first. You get strong forms and signatures, but answers live in Jotform, not on your patient chart, unless you connect the two.

Dropbox Sign

Dropbox's help centre says Dropbox Sign supports HIPAA compliance for customers on an annual Standard or Premium plan who have a signed BAA and meet the minimum contract value (help.dropbox.com, checked September 2026). The minimum contract value isn't published on that page. On the pricing page, Standard is $25/user/month, or $17.50/user/month billed yearly, and Premium is by custom quote (sign.dropbox.com, checked September 2026).

Side by side

ClinikEHR's Essential plan includes 3 staff (extra clinicians $40/month each, up to 5) and Team includes 5 (extra clinicians $35/month each).

What Clinics Actually Need From E-Signatures

Most clinics sign the same handful of documents over and over: new-patient consents, treatment consents, financial policies, telehealth consent, and release-of-information forms. For those, the useful features are:

1. Send from the patient record, so you don't retype names and emails.
2. Signers in order, such as patient, then clinician, then witness.
3. Identity checks that fit the document: an access code, a texted code or in-person confirmation.
4. A certificate of completion filed with the patient, not in a separate account.
5. Automatic sending at booking, so nobody forgets.

A general-purpose signing tool does 2, 3 and 4 very well. Items 1 and 5 depend on how well it connects to your EHR. For the legal basics (ESIGN, UETA, audit trails), see our guide to digital intake forms with e-signature.

When DocuSign Still Makes Sense

Be fair to DocuSign: it's a strong choice when a clinic signs many non-clinical agreements (leases, vendor contracts, employment paperwork), which usually contain no PHI and so don't need a BAA. Larger groups that already have an enterprise DocuSign agreement with a BAA may also want to keep it for everything. The trouble starts when a small practice buys a self-serve plan online and sends patient consents through it.

Worked Examples: Which Route Fits Your Practice

The examples below use each vendor's published prices (checked September 2026) with made-up volumes. Swap in your own numbers.

A solo therapist sending a consent to every new client. At 15 new clients a month, that's 180 consents a year. DocuSign's Personal plan allows 5 envelopes a month and Standard allows 100 per user per year, and neither lists a BAA. Jotform Gold, at $1,188 a year billed yearly, includes HIPAA features and a signed BAA once a covered entity enables them. In ClinikEHR, a signature question in an intake form is on the Free plan, and sending an uploaded consent as a document for signature starts on Essential.

A five-clinician group practice. Per-user pricing adds up. At DocuSign's Business Pro price of $45 per user per month, five users come to $2,700 a year, still without the BAA, which the pricing page lists only on Enhanced plans. Dropbox Sign's Standard plan billed yearly is $17.50 per user per month, or $1,050 a year for five users, and HIPAA support also needs a signed BAA and the minimum contract value, which isn't published. ClinikEHR prices the clinic, not the user: Essential is $99.90 a month with 3 staff included.

A multi-site organisation with legal and HR paperwork. This is where an Enhanced DocuSign agreement can make sense: one signing platform for contracts, HR and, with a BAA in place, patient documents. Ask whether the BAA covers every team and account that might handle PHI.

Questions to Ask DocuSign Sales, or Any Signing Vendor

1. Which plan includes the BAA, and what's the price for my number of users?
2. Does the BAA cover every product we'll use, or only eSignature?
3. Which settings do you require for HIPAA use? DocuSign's own blog ties compliance to "the correct configuration".
4. How are envelopes counted, and what happens if we run out before the year ends?
5. Where do completed documents live, and how do they reach our patient records?
6. What happens to our signed documents if we cancel?

Get the answers in writing, and keep them with your BAA.

Moving Patient Consents Into the Chart

If you decide to sign patient documents inside ClinikEHR instead, the move is mostly administrative:

1. Gather your consent templates as PDF or Word files.
2. Upload each one to ClinikForms as a document for signature, and name the recipients by role (Patient, Clinician, Witness).
3. Choose an identity method for each document: link only, an access code, a texted code, or in-person confirmation by staff.
4. Scope and auto-send each consent under Sharable Documents, so it goes out when the matching service is booked.
5. Keep your old signed copies where your records policy says they belong. Changing tools doesn't change your retention duties.
6. Retire the old templates once the new consents are going out, so staff don't send from two systems.

Product Insight: ClinikForms

ClinikForms is the forms and e-signature module in ClinikEHR. It runs inside the EHR under the same BAA as the chart, and our HIPAA page explains that a BAA applies to every account. Our legal entity, Bettar Platforms, Inc., is the party to the BAA. What it includes:

• Upload your own PDF or Word consent, place fields, add several signers in order, and send it from the patient's chart.
• Certificate of completion on every finished document, plus a page where the copy can be checked.
• Access codes you give the signer yourself, and signing codes by text on Essential (50 a month) and Team (500).
• Auto-send at booking, scoped to the services each consent covers.
• Plans: forms with signature questions on Free. 100 eSignature envelopes a month on Essential ($99.90/month) and 500 on Team ($250/month). Enterprise has no envelope limit. A 30-day Essential trial costs $29.90.

The honest limit: ClinikForms is built for clinical paperwork inside ClinikEHR. If you need a signing platform for company-wide contracts, a dedicated tool may suit that job better. See ClinikForms & eSignatures, client privacy and our pricing page.

Frequently Asked Questions (FAQs)

1. Is DocuSign HIPAA compliant?

DocuSign says its eSignature product can be HIPAA compliant with the correct configuration, and that it acts as a Business Associate for documents containing PHI. Its pricing page lists "HIPAA support through BAA" only on Enhanced plans, through sales.

2. Does DocuSign sign a BAA on the Standard plan?

According to DocuSign's pricing page (checked September 2026), the Personal, Standard and Business Pro plans show "Does Not Include" for HIPAA support through BAA. Contact DocuSign sales about Enhanced plans.

3. Which Jotform plan is HIPAA compliant?

Jotform lists HIPAA compliance features on its Gold and Enterprise plans. Covered entities that enable them receive a signed BAA. Gold is $129/month, or $99/month billed yearly.

4. Is Dropbox Sign HIPAA compliant?

Dropbox says Dropbox Sign supports HIPAA compliance on an annual Standard or Premium plan with a signed BAA and a minimum contract value.

5. Do I need a separate e-signature tool if my EHR has one?

Usually not. An e-signature feature inside your EHR, covered by the same BAA, files signed consents on the patient record and avoids a second subscription.

6. Can I use DocuSign for non-patient documents without a BAA?

Documents that contain no protected health information, such as leases or vendor contracts, generally don't need a BAA. Check with your compliance adviser for your own situation.

Conclusion

DocuSign can be used in a HIPAA-compliant way, but its self-serve plans don't include the BAA that makes that possible. Jotform and Dropbox Sign both offer BAAs on specific higher tiers. For most clinics the simpler answer is e-signature inside the EHR, where consents go out at booking, come back with a certificate of completion and sit on the chart under one BAA.

Key takeaways:

• A BAA, not a badge, is what makes an e-signature tool usable for PHI
• DocuSign lists HIPAA support through BAA only on Enhanced plans (contact sales)
• Jotform: Gold or Enterprise. Dropbox Sign: annual Standard or Premium with a minimum contract value
• Signed consents are most useful on the patient chart
• ClinikForms runs under the same BAA as ClinikEHR, with forms free to start

Ready to sign consents inside the chart? Try ClinikEHR free, explore our pricing, or book a free demo.

Disclaimer: Vendor details were taken from each vendor's own pages in September 2026 and can change. This article is educational and not legal advice; confirm HIPAA obligations with a qualified adviser.

Related Articles

• Digital Intake Forms With E-Signature: A HIPAA Guide
• 7 Best Patient Intake & Digital Forms Software in 2027
• How to Automate Missing Patient Documents & Signatures
• Consent & Intake Form Templates for Private Practice