Is PandaDoc HIPAA compliant?
Yes, but only as an optional capability on annual Enterprise plans with a minimum contract value — PandaDoc will sign a business associate agreement, and nothing below Enterprise has a route to one.
Applies to PandaDoc. Last reviewed against PandaDoc's own documentation. Next review January 30, 2027.
Reviewed by David Kim — Billing and RCM Operations Director.
What you must do
- Buy an annual Enterprise plan. PandaDoc's pricing page states it 'can support HIPAA compliance with a signed BAA for Annual Enterprise plans (minimum contract value required)' — the row is marked unavailable on Starter and Business.
- Ask for the agreement explicitly; it is listed as optional even on Enterprise. PandaDoc's HIPAA page directs customers to contact its support team to sign.
- Execute before the first patient document. PandaDoc's own line is that customers transmitting electronic protected health information 'should sign a Business Associate Agreement (BAA) with PandaDoc' to maintain compliance.
- Get the minimum contract value quoted in writing — PandaDoc publishes the requirement but not the number.
Does PandaDoc sign a business associate agreement?
Yes. PandaDoc offers one. Annual Enterprise with a minimum contract value; HIPAA support is optional even there. Contact the PandaDoc support team to sign the agreement — the HIPAA page links the request route directly.
What this means in practice
PandaDoc gates HIPAA behind three stacked requirements that are easy to misread as one: the Enterprise tier, annual billing, and a minimum contract value PandaDoc does not publish. Even then the capability is marked optional — an annual Enterprise customer who never asked for the agreement has nothing in place. The tiers a small practice would naturally buy, Starter and Business, have no route to coverage at any price.
That shape makes PandaDoc a fit for organizations already spending at Enterprise level that want proposals, payment collection and signatures in one tool, and a poor fit for a practice that only needs consent forms signed. The signature-only vendors reach coverage at lower commitment.
What PandaDoc publishes is the gate, not the scope: no feature-level exclusion list exists on any public page, so which parts of the product — payments, forms, the AI features — sit inside the executed agreement is a question to settle with sales in writing. Ask for the minimum contract number at the same time, since the pricing page only tells you one exists.
How organizations get this wrong
The specific mistakes we see with PandaDoc, not generic advice.
- Buying Business, the most expensive self-serve tier, on the assumption the business tier is the compliant one — coverage starts at annual Enterprise.
- Reaching Enterprise and never asking for the agreement, because the capability is optional rather than automatic even there.
- Discovering the minimum contract value in the sales call after the practice has already committed to the migration.
- Routing patient intake through PandaDoc forms and payments without confirming those features sit inside the executed agreement.
What the agreement does not cover
- Starter and Business plans, and monthly Enterprise billing — the published gating is annual Enterprise.
- Enterprise accounts that never asked: the capability is marked optional, so an Enterprise subscription alone puts nothing in place.
- Feature-level scope, which PandaDoc does not publish — settle it in the executed agreement.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
The same corporate-tier gate at a lower price point, from the same document-automation market
Where you want the plan requirement and covered features stated publicly
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with PandaDoc, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from PandaDoc’s own published documentation, read on the date shown.
- PandaDoc HIPAA Compliant Software: Secure HIPAA Docs & eSignatures — PandaDoc. No publication date given. Read August 30, 2026.
- PandaDoc Pricing — PandaDoc. No publication date given. Read August 30, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects PandaDoc’s published documentation as read on August 30, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.