SignWren isn’t set up to handle HIPAA-covered health information, and we don’t sign business associate agreements (BAAs). If your practice is a HIPAA covered entity, don’t use SignWren for forms that contain patient health information. Use a tool that will sign a BAA with you.
Why does a BAA matter?
HHS describes a business associate as a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity. A covered entity that uses one needs a written agreement, the BAA, that limits how the vendor uses that information and requires it to protect it. An e-signature tool collecting signed patient forms would be a business associate, so without a BAA it isn’t the right tool for those forms.
Who counts as a covered entity?
HHS lists three kinds: health plans, health care clearinghouses, and health care providers that send health information electronically in connection with certain standard transactions, which in practice usually means electronic insurance claims. Not every business that touches health details is covered. A yoga studio’s waiver, for instance, may not be. Our guide for health and wellness practices goes into this, and it’s a question to settle with a compliance advisor, not a help article.
Will SignWren warn me?
Yes. When you start from one of SignWren’s health-form templates, such as a patient intake form, a note appears in the editor saying SignWren isn’t set up for HIPAA-covered data. Signers never see it; it’s for you.
Can I still use the templates?
Yes. The templates on signwren.com are free to download as Word or PDF files, and you can use them with whichever tool fits your situation, including one that signs a BAA.
Will this change?
We’d rather not promise a date. If SignWren ever supports HIPAA-covered data, this article will say so plainly, and until it does, it says no.