Is Docusign HIPAA compliant?
Yes, if you buy an Enhanced plan through Docusign sales and sign their business associate addendum first — the self-serve Personal, Standard and Business Pro plans do not include it.
Applies to Docusign eSignature. Last reviewed against Docusign's own documentation. Next review December 7, 2026.
Reviewed by David Kim — Billing and RCM Operations Director.
What you must do
- Buy an Enhanced eSignature plan through Docusign sales. The published plan comparison marks HIPAA support through a BAA as not included on Personal, Standard and Business Pro, and 'contact sales' on Enhanced.
- Request and execute the addendum before sending any envelope containing patient information.
- Apply it to each account you use — the addendum applies separately to each Docusign Signature account.
- Configure signer authentication, access codes and document retention yourself. Docusign states the healthcare organization remains responsible for its own policies and procedures.
Does Docusign sign a business associate agreement?
Yes. Docusign offers one. Enhanced plans, sales-quoted. Not available on Personal, Standard or Business Pro. Contact Docusign Sales or open a support case, state that you are a covered entity or business associate, and request the Business Associate Addendum. You may need to move to an Enhanced plan first.
What this means in practice
Docusign draws the line at its Enhanced plans, which are sales-quoted. Its own published plan comparison marks HIPAA support through an agreement as not included on Personal, Standard and Business Pro, and as a contact-sales item on Enhanced. Business Pro is the reliable trap: it is the most expensive self-serve tier, it has the word business in it, and it is explicitly not the one.
The scoping detail that catches larger practices is that the addendum applies separately to each Docusign Signature account. Organizations accumulate accounts without noticing, a satellite site here, a clinician who expensed their own subscription there, and covering the head-office account does nothing for the rest.
Be careful about product creep too. What is confirmed is eSignature. Docusign does not publish confirmation that its contract management, Navigator or newer platform features fall under the same addendum, so get that in writing from sales before routing patient documents through them. And the ordinary controls remain yours: signer authentication, access codes and how long completed envelopes stay in the account.
How organizations get this wrong
The specific mistakes we see with Docusign, not generic advice.
- Sending patient consent forms from a Business Pro account on the assumption the business tier includes it, when the plan comparison says otherwise.
- Covering the main practice account while a satellite location or a clinician's personal subscription keeps sending patient envelopes uncovered.
- Assuming the addendum stretches to Docusign's contract management or newer platform products, which Docusign does not confirm are in scope.
- Sending envelopes with no signer authentication or access code and relying on the addendum to compensate for the missing controls.
What the agreement does not cover
- Personal, Standard and Business Pro self-serve plans.
- Other Docusign accounts you own that are not individually covered.
- Docusign products beyond eSignature — CLM, Navigator and newer IAM features. Docusign does not publish confirmation that these are in scope.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Named among the Dropbox products eligible for an agreement
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Docusign, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Docusign’s own published documentation, read on the date shown.
- Docusign Pricing — eSignature Plans — Docusign. No publication date given. Read July 29, 2026.
- Service Attachment of Docusign Business Associate Addendum for Docusign Signature — Docusign. No publication date given. Read July 29, 2026.
- Is Docusign eSignature HIPAA Compliant? — Docusign. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Docusign’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.