On this page
Only on plans sold through sales. As of November 12, 2026, DocuSign's pricing guide lists "HIPAA support through a BAA" on its Enhanced plans and shows none for Personal, Standard or Business Pro. So the plans a solo practice can buy online don't come with a BAA, and consent forms that carry health details shouldn't go through them.
Checked November 12, 2026 on DocuSign's plans and pricing guide (last updated October 2026) and its healthcare providers page. Confirm the plan with DocuSign sales before you send patient forms.
What does DocuSign say?
DocuSign does sign BAAs. Its healthcare page says "Docusign may enter into a Business Associate Agreement (BAA) with a HIPAA Covered Entity." The same page is careful about the word compliant: "A company's products, including Docusign's, cannot be HIPAA compliant." Compliance is something your practice does, with the BAA as one piece.
Which plan gets the BAA is in its pricing guide:
- "SSO, advanced authentication, and HIPAA support through a BAA come with Enhanced plans."
- In the feature table, the HIPAA (BAA) row shows a dash for eSignature Personal, Standard and Business Pro, and "Contact sales" for Enhanced and the IAM plans.
- For healthcare, the guide says to start with "Enhanced plans or IAM for Enterprise (talk to sales)."
Neither page explains how to request the BAA beyond contacting sales. Treat a BAA as belonging to the account it was arranged for: a second account you opened earlier on a cheaper plan is a different account, so ask DocuSign before you assume it is covered.
How do you get the BAA?
- Contact DocuSign sales and say you are a healthcare provider who needs a BAA.
- Ask which Enhanced or IAM plan fits, and confirm in writing that it includes the BAA.
- Have the BAA in place on that account before any document with health details is sent.
- Close or empty any older DocuSign account so nobody sends patient forms from it by habit.
What may go through DocuSign, and what to keep out
What matters is what the document says, not that it needs a signature.
- Fine on any plan: your lease, vendor contracts, a VA's contractor agreement, a collaborating physician agreement, your own BAAs with vendors.
- Needs the BAA: treatment consents, telehealth consent with the patient's details, financial agreements that name the program or treatment, release of records forms, anything with a diagnosis, medication or lab on it.
A patient's name and signature on a document from your practice, about their care, is health information. That holds even when the form is "only" a consent.
Watch the edges too. The email subject and message that carry the signing link are sent in plain email, so keep them general: "A form to sign before your visit," not the name of the treatment. Completed PDFs get downloaded and attached to emails; save them to the chart, not a personal laptop.
Where do practices slip up?
A practice starts with DocuSign Personal or Standard to sign its own contracts. It works well, so the consent packet for new patients gets added as a template. Within a month, every new patient's name, date of birth and treatment consent sits in an account that DocuSign's own table shows has no BAA.
The other slip is the generic template. A consent that reads "I consent to treatment as discussed" carries less than one that lists the therapy and the risks. But it is still a signed record that this person is your patient, and it still belongs under a BAA.
What to use instead on a solo budget
Most solo practices don't need a separate e-signature tool for patients. Consent can be signed where intake already happens.
| Option | BAA | Plan |
|---|---|---|
| DocuSign | Yes, through sales | eSignature Enhanced or an IAM plan |
| Your EHR's consent forms | Covered by the EHR's BAA | Depends on the EHR |
| Jotform with a signature field | Yes | Gold or Enterprise, with HIPAA turned on |
| IntakeQ | Yes | Listed on its paid Forms plans |
| Dropbox Sign | Listed among the products Dropbox's BAA page applies to | Confirm the plan with Dropbox |
Signing inside the EHR has one more advantage: the signed consent is filed in the chart without anyone moving a PDF. If you use Jotform, see Is Jotform HIPAA compliant? for the setup. Our intake form guide covers where consent fits in the sequence.
To check your other tools, use the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does DocuSign sign a BAA?
Yes, on its Enhanced plans and IAM plans, arranged through sales. Its pricing guide shows no BAA for eSignature Personal, Standard or Business Pro (as of November 2026).
Is DocuSign Personal or Standard HIPAA compliant?
No. DocuSign's feature table shows a dash for HIPAA (BAA) on Personal, Standard and Business Pro. Use those plans only for documents with no patient information.
Can I send patient consent forms through DocuSign?
Only from an account that has a BAA in place. A signed consent ties a named person to your practice and their care, so it counts as health information.
What is a HIPAA-compliant alternative to DocuSign for a small practice?
Consent forms inside your EHR are covered by the EHR's BAA. Jotform on Gold or Enterprise with HIPAA turned on, and IntakeQ, also collect signatures under a BAA.