Is PandaDoc HIPAA compliant?
Yes, but only as an optional capability on annual Enterprise plans with a minimum contract value: PandaDoc will sign a business associate agreement, and nothing below Enterprise has a route to one.
Applies to PandaDoc. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Buy an annual Enterprise plan. PandaDoc's pricing page states it 'can support HIPAA compliance with a signed BAA for Annual Enterprise plans (minimum contract value required)': the row is marked unavailable on Starter and Business.
- Ask for the agreement explicitly; it is listed as optional even on Enterprise. PandaDoc's HIPAA page directs customers to contact its support team to sign.
- Execute before the first patient document. PandaDoc's own line is that customers transmitting electronic protected health information 'should sign a Business Associate Agreement (BAA) with PandaDoc' to maintain compliance.
- Get the minimum contract value quoted in writing: PandaDoc publishes the requirement but not the number.
Does PandaDoc sign a business associate agreement?
Yes. PandaDoc offers one. Annual Enterprise with a minimum contract value; HIPAA support is optional even there. Contact the PandaDoc support team to sign the agreement: the HIPAA page links the request route directly.
What this means in practice
PandaDoc gates HIPAA behind three stacked requirements that are easy to misread as one: the Enterprise tier, annual billing, and a minimum contract value PandaDoc does not publish. Even then the capability is marked optional: an annual Enterprise customer who never asked for the agreement has nothing in place. The tiers a small practice would naturally buy, Starter and Business, have no route to coverage at any price.
That shape makes PandaDoc a fit for organizations already spending at Enterprise level that want proposals, payment collection and signatures in one tool, and a poor fit for a practice that only needs consent forms signed. The signature-only vendors reach coverage at lower commitment.
What PandaDoc publishes is the gate, not the scope: no feature-level exclusion list exists on any public page, so which parts of the product (payments, forms, the AI features) sit inside the executed agreement is a question to settle with sales in writing. Ask for the minimum contract number at the same time, since the pricing page only tells you one exists.
How organizations get this wrong
- Buying Business, the most expensive self-serve tier, on the assumption the business tier is the compliant one: coverage starts at annual Enterprise.
- Reaching Enterprise and never asking for the agreement, because the capability is optional rather than automatic even there.
- Discovering the minimum contract value in the sales call after the practice has already committed to the migration.
- Routing patient intake through PandaDoc forms and payments without confirming those features sit inside the executed agreement.
What the agreement does not cover
- Starter and Business plans, and monthly Enterprise billing: the published gating is annual Enterprise.
- Enterprise accounts that never asked: the capability is marked optional, so an Enterprise subscription alone puts nothing in place.
- Feature-level scope, which PandaDoc does not publish: settle it in the executed agreement.
Alternatives
The same corporate-tier gate at a lower price point, from the same document-automation market
Where you want the plan requirement and covered features stated publicly
Keep a record of your PandaDoc agreement
Sources
- PandaDoc HIPAA Compliant Software: Secure HIPAA Docs & eSignatures: PandaDoc. Read August 30, 2026.
- PandaDoc Pricing: PandaDoc. Read August 30, 2026.
PandaDoc can change these terms at any time. If something here no longer matches what PandaDoc tells you, tell us.