Is Docusign HIPAA compliant?
Yes, if you buy an Enhanced plan through Docusign sales and sign their business associate addendum first: the self-serve Personal, Standard and Business Pro plans do not include it.
Applies to Docusign eSignature. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Buy an Enhanced eSignature plan through Docusign sales. The published plan comparison marks HIPAA support through a BAA as not included on Personal, Standard and Business Pro, and 'contact sales' on Enhanced.
- Request and execute the addendum before sending any envelope containing patient information.
- Apply it to each account you use: the addendum applies separately to each Docusign Signature account.
- Configure signer authentication, access codes and document retention yourself. Docusign states the healthcare organization remains responsible for its own policies and procedures.
Does Docusign sign a business associate agreement?
Yes. Docusign offers one. Enhanced plans, sales-quoted. Not available on Personal, Standard or Business Pro. Contact Docusign Sales or open a support case, state that you are a covered entity or business associate, and request the Business Associate Addendum. You may need to move to an Enhanced plan first.
What this means in practice
Docusign draws the line at its Enhanced plans, which are sales-quoted. Its own published plan comparison marks HIPAA support through an agreement as not included on Personal, Standard and Business Pro, and as a contact-sales item on Enhanced. Business Pro is the reliable trap: it is the most expensive self-serve tier, it has the word business in it, and it is explicitly not the one.
The scoping detail that catches larger practices is that the addendum applies separately to each Docusign Signature account. Organizations accumulate accounts without noticing, a satellite site here, a clinician who expensed their own subscription there, and covering the head-office account does nothing for the rest.
Be careful about product creep too. What is confirmed is eSignature. Docusign does not publish confirmation that its contract management, Navigator or newer platform features fall under the same addendum, so get that in writing from sales before routing patient documents through them. And the ordinary controls remain yours: signer authentication, access codes and how long completed envelopes stay in the account.
How organizations get this wrong
- Sending patient consent forms from a Business Pro account on the assumption the business tier includes it, when the plan comparison says otherwise.
- Covering the main practice account while a satellite location or a clinician's personal subscription keeps sending patient envelopes uncovered.
- Assuming the addendum stretches to Docusign's contract management or newer platform products, which Docusign does not confirm are in scope.
- Sending envelopes with no signer authentication or access code and relying on the addendum to compensate for the missing controls.
What the agreement does not cover
- Personal, Standard and Business Pro self-serve plans.
- Other Docusign accounts you own that are not individually covered.
- Docusign products beyond eSignature: CLM, Navigator and newer IAM features. Docusign does not publish confirmation that these are in scope.
Alternatives
Named among the Dropbox products eligible for an agreement
Keep a record of your Docusign agreement
Sources
- Docusign Pricing: eSignature Plans: Docusign. Read July 29, 2026.
- Service Attachment of Docusign Business Associate Addendum for Docusign Signature: Docusign. Read July 29, 2026.
- Is Docusign eSignature HIPAA Compliant?: Docusign. Read July 29, 2026.
Docusign can change these terms at any time. If something here no longer matches what Docusign tells you, tell us.