Considerations
Digital intake is straightforward technically and awkward legally — not because signatures are hard, but because the vendor becomes part of your compliance posture the moment PHI touches their servers.
There’s a useful way to think about it. OCR doesn’t audit your signature method. It asks for your risk analysis, and whether your vendor arrangements are documented in it. Choose your platform with that conversation in mind and the rest follows.
Key takeaways
Any vendor handling PHI is a business associate and needs a signed BAA. Hard gate.
Inadequate risk analysis is the most commonly cited Security Rule failure in OCR enforcement. It’s the first document investigators request.
Notice of Privacy Practices acknowledgment, consent to treat, and HIPAA authorization are three different documents.
The Security Rule overhaul is still proposed, not final — but encryption and MFA are where enforcement already points.
Breach notification runs to 60 days, and a vendor breach is your notification obligation.
Section 1557 means digital forms must stay accessible and language-accessible.
Start with the BAA
A vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. A signed BAA must exist before you send anything.
Three failure modes:
Treating a compliance badge as sufficient. There is no HIPAA certification. A vendor can describe controls; the enforceable commitment is the BAA.
Not checking plan eligibility. Many platforms restrict BAAs to higher tiers. A department that signed up on a card may be using a product the vendor never agreed to handle PHI on.
Ignoring subprocessors. Your business associate’s vendors touch your PHI too. Request the list and review storage and processing locations.
Ask directly: will you sign a BAA, on which plan, what are your breach notification timelines, and can I see your subprocessor list? The fourth question tells you more about a vendor’s maturity than the first three.
NevTan Sign’s security, trust and subprocessor pages set out its stated position.
What OCR actually enforces
This is the part worth internalising before evaluating any product.
The risk analysis requirement at 45 CFR §164.308(a)(1) is the first document OCR investigators request, and OCR’s existing enforcement actions cite inadequate risk analysis as the single most common Security Rule failure. Recent settlements follow the pattern: BayCare Medical Group at $800,000, Assured Imaging at $375,000, Axia Women’s Health at $320,000 — in each case OCR found the underlying problem was not a one-time technical failure but an inability to produce a current, accurate risk analysis identifying the vulnerability and tracking its remediation. In September 2026 OCR announced a $700,000 settlement with Ambry Genetics citing an inaccurate or incomplete risk analysis, alongside failures to terminate ePHI access when a workforce member’s arrangement ended and to assign unique user identifiers, with a two-year corrective action plan. The HIPAA Security Rule Overhaul: Where Things Stand in Mid-2026 +3
What this means practically: adding a new system that handles PHI is a risk analysis event. Document the vendor, what data flows to them, the safeguards, and the residual risk. A platform you can’t describe in those terms is a finding waiting to happen.
Note the access termination point in the Ambry settlement. Staff leave; their access to your signing platform needs to leave with them. Offboarding is a Security Rule control, not an IT courtesy.
Where the Security Rule stands
Still proposed. HHS published the Notice of Proposed Rulemaking on 6 January 2025, the comment period closed on 7 March 2025, and no final rule has been issued; the regulatory timetable for final action has slipped into 2027. OCR is still reviewing more than 4,700 comments, the original spring-2026 target passed without a final rule, and the Unified Agenda under RIN 0945-AA22 now points to July 2027 — a date that is not legally binding. complianceofficermedcurity
The current rule applies throughout. HHS has stated that the existing Security Rule remains in effect while rulemaking proceeds, so current requirements including risk analysis still apply. cyberuptive
What would change. The core dispute is the proposal’s removal of the “addressable” flexibility that lets organizations tailor certain safeguards to their size and risk, making most implementation specifications mandatory. Note that addressable has never meant optional — it means implement, or document why not and implement an equivalent. medcurity
Should you wait? No — though there’s no need to implement proposed requirements wholesale, since HIPAA rules carry a minimum 180-day compliance period after a final rule publishes. OCR enforcement has already moved toward the controls the proposal would require, emphasising risk analysis, asset inventory deficiencies and missing MFA. clearwatersecuritycompliancy-group
Choose a platform with encryption and MFA now. You’re avoiding a rushed migration, not getting ahead of a rule. [VERIFY — recheck status before publishing]
Three documents people routinely conflate
Document | What it does | Required content |
|---|---|---|
NPP acknowledgment | Records that the patient received your Notice of Privacy Practices | Good faith effort to obtain written acknowledgment |
Consent to treat | Clinical and contractual consent to care | Set by state law and specialty |
HIPAA authorization | Permits disclosure of PHI to a specified recipient | Prescribed elements — see below |
The third has specific statutory content requirements: a description of the information, who may disclose and receive it, the purpose, an expiration date or event, the right to revoke and how, a statement on conditioning treatment, a note on potential redisclosure, and signature with date. A generic release form usually misses several. [LEGAL REVIEW]
Keep them separate. Bundling an authorization into intake paperwork is a common finding and can invalidate the authorization.
Patient right of access
Worth building into the workflow rather than treating as an exception, because it has been an active enforcement area.
Patients have a right to access their records in the designated record set, generally within 30 days, with fees limited to a reasonable cost-based amount. A digital signing platform helps here — authorizations and access requests are themselves forms that can be signed and tracked rather than arriving as paper and getting lost on someone’s desk.
Two practical points: verify identity before releasing, using a method you’ve documented; and don’t let your request-handling clock start when someone notices the form rather than when it arrived. [LEGAL REVIEW]
Breach notification runs on your clock
If your e-signature vendor has a breach affecting your PHI, the notification obligation to individuals is generally yours.
Broad shape: notification to affected individuals without unreasonable delay and no later than 60 days from discovery; breaches affecting 500 or more residents of a state or jurisdiction also require notice to HHS and prominent media within that window; smaller breaches are logged and reported to HHS annually.
Negotiate the vendor’s notification timeline in the BAA. If they have 60 days to tell you and you have 60 days to tell patients, you’ve already missed your deadline. Push for something materially shorter. [LEGAL REVIEW]
Building the intake workflow
Sequence the documents. Registration and demographics, then NPP acknowledgment, then consent to treat, then any authorizations. Separate signatures on separate records.
Design for phones. Most patients complete intake on a mobile device, often in a waiting room. Minimise required fields — abandonment sends people back to the clipboard. Forms and fields that get signed and signature field placement cover the specifics.
Section 1557 applies. Digital forms must remain accessible to patients with disabilities and available to patients with limited English proficiency. An English-only form with poor screen reader support can create an access problem your paper process didn’t have. Build this in rather than retrofitting. [LEGAL REVIEW]
EHR integration decides whether this is worth doing. If intake data doesn’t flow into the record automatically, you’ve moved the typing from the patient to your staff. Check integrations against what you actually run before committing.
Minimum necessary in practice. Reception doesn’t need clinical histories. Role-based access on the signing platform is a Security Rule control.
Telehealth consent. Note that the pandemic-era enforcement discretion for telehealth platforms ended, so remote care runs under ordinary HIPAA rules. Many states also require specific telehealth consent with particular disclosures.
Use links, not attachments. A signing link keeps the document on a controlled platform with an audit trail, rather than leaving copies in two mailboxes indefinitely. Where you must send something, use encrypted attachments with the password through a separate channel. PDF attachments vs secure signing links covers the comparison.
Train on phishing and tell patients what to expect. Healthcare is a priority target, and a signing request is the easiest thing in the world to impersonate — see spotting fake signature requests and phishing protection.
Evaluating a platform
BAA on your plan. Gate.
Breach notification timeline in the BAA. Hours or days, not sixty.
Encryption at rest and in transit, with MFA.
Audit logging sufficient for an OCR request: how audit trails work.
Role-based access and prompt deprovisioning.
EHR or practice management integration.
Accessibility and multi-language support.
Export and retention controls matching your state’s record retention rules.
Subprocessor transparency.
How to choose an e-signature tool covers general evaluation. Free tiers almost always exclude BAAs, which rules them out for PHI.
Common mistakes
No BAA, or one that doesn’t cover the plan in use.
No current risk analysis reflecting the platform.
A sixty-day vendor notification clause.
Bundling authorizations into intake.
Reading “addressable” as optional.
No access termination process.
Inaccessible digital forms.
Emailing PHI attachments by default.
FAQ
Are e-signatures HIPAA compliant?
Electronic signatures are legally valid. HIPAA compliance depends on the arrangement around them — a BAA, encryption, access controls, audit logs and inclusion in your risk analysis.
What does OCR look at in an investigation?
Risk analysis first. It is the most commonly cited Security Rule deficiency and the document investigators request before anything else.
Is the new Security Rule in effect?
No. The NPRM published January 2025, comments closed March 2025, and final action is now targeted for 2027. The current rule applies and is being actively enforced.
Do I need a BAA with my e-signature vendor?
Yes, if they handle PHI, and before any PHI is sent. Confirm it’s available on your specific plan.
Who notifies patients if the vendor has a breach?
Generally you do, under the Breach Notification Rule. Negotiate a short vendor notification window so you can meet your own deadline.
Can patients sign intake on a phone?
Yes, and most will. Keep forms short — abandonment is the main failure mode.
Is an NPP acknowledgment the same as consent to treat?
No. Three separate documents: NPP acknowledgment, consent to treat, and HIPAA authorization for disclosure. Each has a different purpose and different requirements.
Do digital forms need to be accessible?
Yes. Section 1557 nondiscrimination requirements cover accessibility and language access, and moving to digital doesn’t relax them.
