E-signatures and HIPAA for healthcare and wellness practices

Most paperwork in a small health or wellness practice can be signed electronically: intake forms, consent forms, policy acknowledgments, liability waivers. The signature is rarely the hard part. The hard part is that many of these forms carry health information, and if your practice is a HIPAA covered entity, the tool that collects and stores them has to be one that will sign a business associate agreement with you.

We’ll be straight about SignWren here: it is not yet set up to handle HIPAA-covered data and doesn’t sign BAAs. So this page explains how to think about e-signatures in healthcare generally, and the templates below are free to download and use with whichever tool fits your situation.

Which healthcare and wellness documents are commonly e-signed?

The everyday ones are new patient or client intake forms, informed consent for a specific treatment or service, acknowledgment of your notice of privacy practices, cancellation and payment policies, and liability waivers for classes or physical activities. Physical therapy, chiropractic, massage, counseling, fitness studios and med spas all run on some mix of these.

Picture a Pilates studio that also offers physical therapy on Tuesdays and Thursdays. Class members sign a waiver. PT patients fill in an intake form, sign a consent for dry needling if they get it, and acknowledge the privacy notice. Same building, two different sets of rules, because the PT side may be a covered entity and the class side generally isn’t handling patient records at all.

When does HIPAA apply to your forms?

HIPAA applies to covered entities and their business associates, not to every business that touches health information. HHS lists three kinds of covered entity: health plans, health care clearinghouses, and health care providers. Providers (doctors, clinics, psychologists, dentists, chiropractors and others) count “only if they transmit any information in an electronic form in connection with a transaction” for which HHS has adopted a standard, which in practice usually means electronic claims and similar insurance transactions.

So a PT clinic billing insurers electronically is almost certainly covered. A cash-only massage therapist or personal trainer may not be. Don’t guess; read the HHS covered entity guidance or ask a compliance advisor.

What does “HIPAA compliant e-signature” actually mean?

It means the vendor will act as your business associate under a written agreement. HHS describes a business associate as a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity, and it lists cloud providers and IT vendors among the examples. A covered entity that uses one must have a business associate agreement (BAA) that spells out how the vendor may use and disclose the information and requires it to follow HIPAA’s security rules, including reporting breaches.

That’s the practical test. If an e-signature vendor won’t sign a BAA with you, it isn’t a fit for covered patient forms, however good its encryption page looks. A “HIPAA compliant” label on a pricing page doesn’t tell you much until the vendor puts a BAA in front of you.

SignWren doesn’t sign BAAs today. If you’re a covered entity, use a tool that does for anything containing patient health information.

Are there other rules to check?

A few come up often. If you’re covered, HHS says a provider with a direct treatment relationship must make a good faith effort to get the patient’s written acknowledgment that they received your notice of privacy practices; for services delivered electronically, it describes sending the notice electronically and seeking an electronic return receipt. That acknowledgment is a natural thing to fold into your intake form.

Liability waivers have their own limits. Cornell’s Legal Information Institute notes that courts may refuse to enforce a waiver that is overly broad, unclear, against public policy, or that tries to excuse gross negligence or intentional misconduct, and some states go much further: New York’s General Obligations Law section 5-326 voids negligence waivers for paid pools, gyms and recreation facilities. Research consent is its own category too, governed by federal rules and your IRB rather than a generic template.

The signature itself is usually the easy part. Electronic signatures are valid for most documents under federal and state law, as we cover in are electronic signatures legally binding. A handful of document types have extra requirements, listed in documents you can’t sign electronically.

What does a sensible signing workflow look like?

Keep it boring and consistent. Send forms when the appointment is booked, so people read them at home instead of in the waiting room. Use one form per purpose rather than a twelve-page packet nobody reads. Have providers sign consent forms too, since their signature records that the explanation happened. Store signed copies with the patient or client record, limit who can open them, and give people a copy when they ask.

If you’re a covered entity, all of that runs through a vendor with a BAA. If you’re not, any reputable e-signature tool with an audit trail will do; we’re building SignWren for that second group, and the waitlist is open.

The templates below are free in Word and PDF. Each one comes with a short guide explaining what the sections mean before you send it.

This page is general information, not legal advice. For your specific practice, talk to a lawyer or compliance professional licensed where you are.