For healthcare patients, filling out consent forms, insurance forms, privacy releases and other paperwork by hand can be one of the most tedious, frustrating parts of visiting a healthcare provider. Patients expect and want a digital experience.
Manual, paper-based processes negatively impact healthcare providers, too, because it takes their time and attention away from higher value activities, including interacting with patients.
Driven by patient expectations and a desire to improve productivity and cost-efficiency, many healthcare organizations are exploring technologies like electronic signature for patient forms. Providers also typically want and need a solution that complies with the Health Insurance Portability and Accountability Act (HIPAA).
This blog provides guidance and answers to common questions regarding HIPAA and other regulations governing the use of electronic documents and signatures in healthcare organizations.
What information does HIPAA cover?
The U.S. Department of Health and Human Services (HHS) established two directives following the passage of HIPAA: the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule outlines standards for Protected Health Information (PHI) which includes information such as demographic data, medical history, insurance details and lab results.
The Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of electronic protected health information.
Healthcare organizations are ultimately responsible for implementing technologies, policies and procedures to ensure that these solutions are deployed in a way that is secure and protects PHI.
Is electronic signature allowed under HIPAA?
Yes. HIPAA does not mandate that documents be signed in a particular way. Instead, the law is focused on ensuring PHI is handled properly.
How can e-signature help healthcare providers manage HIPAA compliance?
HIPAA doesn’t mandate the way documents are signed, so an electronic signature doesn’t conflict with the law, but it doesn’t constitute compliance on its own. HIPAA governs the use and transmission of PHI, which may or may not be contained in e-signed documents. When considering e-signature for HIPAA covered documents, there are specific features to look for to support HIPAA compliance efforts.
Modern e-signature solutions that are interoperable with Electronic Health Records (EHRs) make it easy for patients to electronically sign forms on a device, in a medical office or inpatient at a facility. Electronic signatures have many layers of security and authentication built into them, ensuring information remains private and secure.
Unlike wet signatures, e-signatures include an electronic record that serves as an audit trail and proof of the transaction. The audit trail details the actions taken with the document, including a record of when it was opened, viewed and signed. DocuSign eSignature offers a certificate of completion that includes specific details about each signer on the document, including the consumer disclosure indicating the signer agreed to use e-signature, the signature image, key event timestamps and the signer's IP address and other identifying information.
Once the signing process is complete, all documents are digitally sealed using Public Key Infrastructure (PKI), an industry-standard technology. This seal indicates the electronic signature is valid and that the document hasn’t been tampered with or altered since the date of signing.
What level of authentication is required to maintain compliance under HIPAA?
The level of authentication that’s right for your organization depends on your business practices and needs. E-signature technology offers multiple options for verifying a signer’s identity before they can access the document and sign, including:
- Email address: signers enter their own email address, which is compared to the email address used in the invitation
- Access code: the sender supplies a one-time passcode that signers must enter
- Phone call: signers must call a phone number and enter their name and access code
- SMS: signers must enter a one-time passcode sent via SMS text message
- Knowledge-based: signers are asked questions about information, such as past addresses or vehicles owned
- ID verification: signers are verified using their government-issued photo IDs or European eID schemes
For situations where additional levels of signature validity are necessary, some providers offer two additional levels of e-signature that comply with the EU’s eIDAS requirements:
- Advanced: Requires a higher level of security, and identity verification. Signatures must be uniquely linked to, and capable of identifying the signer.
- Qualified: An even more secure version of an advanced e-signature that requires face-to-face identity verification. The face-to-face identification can be live, in person or via an audio/video connection.
What to look for in an e-signature solution to ensure it supports HIPAA compliance
Not all e-signature solutions are alike. When evaluating potential technologies, it’s important to consider how the vendor manages security, data privacy and data storage.
Information storage and encryption (in transit and at rest)
Appetite for risk security varies from organization to organization and is dependent on both how the industry operates and the corresponding legal and regulatory requirements. But no matter the industry, security is a central concern for all HIPAA-covered entities, and how data is handled is central to maximizing protection.
What should you look for?
- A minimum of 256-bit encryption
- The security protocols they employ, e.g., HTTPS, SSL, SSH, IPsec, SFTP
- What data/documents they encrypt
- What cipher suites they support
- Whether or not they provide non-repudiation for all generated and signed documents
- If they have a data disposal and reuse policy
- What processes they have in place for equipment management and secure media disposal
Data privacy
As with classification, storage and encryption, it’s all about protecting users’ data. Does the e-signature solution provider have a privacy program in place, and will it pass the scrutiny necessary to meet the most highly regulated industries, like healthcare? And if you have patients who are California residents, then you need to ensure that the vendor is compliant with the California Consumer Privacy Act (CCPA).
Considerations:
- How personal data is used
- Whether users are given the option to opt-in or out of receiving information
- How private information, such as personally identifiable information (PII) and (PHI), is handled
Ask what data management and privacy practices do they have in place around:
- Data subject rights
- Data deletion and retention
- Data access
- Data residency
- Subprocessors
- Privacy notices
- Training and awareness
- Governance and accountability
- GDPR and other privacy regulations
DocuSign eSignature customers determine their accounts’ retention policies. To learn more about how customers can purge eDocuments, read DocuSign’s data management and privacy practices for eSignature.
Learn more about DocuSign’s industry-leading security and privacy practices and view the latest information on system performance and availability on the DocuSign Trust Center.
What is a Business Associate and what is a Business Associate Agreement?
A Business Associate is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity. A member of the covered entity’s workforce is not a business associate.
DocuSign is a Business Associate for HIPAA purposes when a healthcare provider uses DocuSign eSignature for documents that contain PHI. DocuSign doesn’t have access to the PHI, but it may hold PHI in encrypted form on its servers.
A Business Associate Agreement (BAA) is a contract between a healthcare provider, health plan or other HIPAA-covered entity and a vendor. The vendor is considered a business associate in cases where, as part of the vendor’s services, electronic PHI passes through their systems. A signed BAA must be completed by the vendor prior to providing services.
DocuSign has entered into agreements with numerous HIPAA-covered entities.
Are electronic signatures on medical forms legally admissible in court?
Electronic signatures are legally enforceable in the United States. There are two primary Acts that establish this legality of electronic signatures: the US Electronic Signatures in Global and National Commerce Act (ESIGN, 2000) and the Uniform Electronic Transactions Act (UETA, 1999), which has been adopted by most state legislatures. Both ESIGN and UETA establish that electronic records and signatures carry the same weight and legal effect as traditional paper documents and handwritten signatures. The ESIGN Act states, “A document or signature cannot be denied legal effect or enforceability solely because it is in electronic form.”
What are common HIPAA forms that can be used with e-signature?
Electronic signature enables healthcare organizations to transform how patient intake forms get signed—and how patients experience their healthcare journey. Here are some common HIPAA forms that can be used with e-signature:
- New patient intake forms with HIPAA releases
- Patient information and policies
- Health information release authorization
- HIPAA disclosure form
- Medical records release form
- Notice of privacy practices
- Patient rights and responsibilities
Can I connect e-signature into my existing EHR system?
Yes, there are a variety of technologies that make it possible to send patient forms from within an Electronic Health Record (EHR) system and automatically upload electronically signed forms back into the system. By implementing e-signature technology beyond the EHR, organizations can take strategic steps toward improving the patient intake and consent process while managing HIPAA compliance.
In today’s digital and remote world, healthcare organizations need to make it easy for patients to sign intake and consent forms anywhere. With DocuSign eSignature for Certified EHRs, patients can digitally fill out intake paperwork anywhere. Once completed electronically, these documents will be automatically uploaded into the EHR or your document management solution, either with or without a manual review.
Learn more about the DocuSign Agreement Cloud for Healthcare.
FAQs
Is electronic signature valid for HIPAA? ›
Is electronic signature allowed under HIPAA? Yes. HIPAA does not mandate that documents be signed in a particular way. Instead, the law is focused on ensuring PHI is handled properly.
What form of signature is allowed by HIPAA? ›The healthcare sector is legally allowed to use e-signatures; however, they must comply with the Health Insurance Portability and Accountability Act (HIPAA), a federal law that stipulates national standards for the protection, security, and privacy of patient information.
Do HIPAA forms need to be signed by the patient? ›Why do I have to sign a form? The law requires your doctor, hospital, or other health care provider to ask you to state in writing that you received the notice. The law does not require you to sign the “acknowledgement of receipt of the notice.”
What is the purpose of signing HIPAA privacy form? ›The HIPAA privacy form is a document that outlines the manner in which a patient's PHI (protected health information) may be disclosed to third parties (e.g. health clearinghouses). Patients who sign one of these forms legally acknowledge that they have understood the provider's privacy practices.
What are three HIPAA concerns with electronic information? ›The three main aspects of HIPAA that continue to be a challenge for organizations are privacy, security and breach notification. Providers should ensure compliance in those areas to avoid the financial penalties and hassle of a HIPAA-related complaint.
Is an electronic signature an enforceable signature? ›Yes, electronic signatures are valid in all U.S. states and are granted the same legal status as handwritten signatures under state laws.
Do no standards exist under HIPAA for electronic signatures? ›“No standards exist under HIPAA for electronic signatures. In the absence of specific standards, covered entities must ensure any electronic signature used will result in a legally binding contract under applicable State or other law.”
Can digital signature provide confidentiality? ›Digital signatures provide authenticity protection, integrity protection, and non-repudiation, but not confidentiality protection. The result of a cryptographic transformation of data that, when properly implemented, provides origin authentication, assurance of data integrity and signatory non-repudiation.
Can you use DocuSign for HIPAA? ›DocuSign is a Business Associate for HIPAA purposes when a healthcare provider uses DocuSign eSignature for documents that contain PHI. DocuSign doesn't have access to the PHI, but it may hold PHI in encrypted form on its servers.
How often should HIPAA forms be signed? ›No. The HIPAA privacy rule requires covered entities to obtain an acknowledgment when they first give their notice of privacy practices to patients.
How long is a HIPAA signature good for? ›
A HIPAA authorization remains valid until it expires or is revoked by the individual.
How do I make a form HIPAA compliant? ›- Using a HIPAA compliant form builder. ...
- Collect HIPAA compliant electronic signatures. ...
- Collecting all patient information in one intake form. ...
- Restricting form field entry. ...
- Making form fields required. ...
- Using conditional logic in forms. ...
- Autocomplete forms.
INSTRUCTIONS FOR SIGNATURE AUTHORIZATION FORM
This form identifies the persons who have the authority to sign contracts, amendments, and requests for reimbursement.
To Ensure Continuity of Care
Once you've signed a medical records release form, they can easily review your medical history. Then they can determine what kinds of tests they need to perform before giving a diagnosis and deciding on a course of treatment.
- The Privacy Rule.
- The Security Rule.
- The Breach Notification Rule.
The HIPAA Security Rule requires physicians to protect patients' electronically stored, protected health information (known as “ePHI”) by using appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of this information.
What are three potential security risks of electronic health records? ›Top threats against EHRs include phishing attacks, malware, overlooked gaps in encryption, cloud threats and employees.
What are the 5 most common violations to the HIPAA privacy Rule? ›- Losing Devices. ...
- Getting Hacked. ...
- Employees Dishonestly Accessing Files. ...
- Improper Filing and Disposing of Documents. ...
- Releasing Patient Information After the Authorization Period Expires. ...
- Protect Patients and Your Organization With the Right Tools.
- Intent to sign. Like traditional signatures, electronic signatures are valid only if each party intends to sign.
- Consent to do business electronically. All parties involved must consent to do business electronically. ...
- Association of signature with the record. ...
- Record retention.
Section 66C of the Act punishes for identity theft. This Act punishes fraudulent use of electronic signature of any other person and such person shall be punished with imprisonment of up to three years and will also liable to pay fines which may extend up to one lakh.
When can you not use electronic signature? ›
If a company is only authorised to execute deeds by affixing a seal, then the directors cannot validly execute documents using an electronic signature.
What is required for electronic signature compliance? ›- The printed name of the signer.
- The date and time the signature was executed.
- A unique user ID.
- Digital adopted signature.
- The meaning of the signature (labeled “signing reason”)
Detailed Solution. The correct answer is Redundancy.
Why digital signature does not provide confidentiality? ›If both digests are the same, the receiver can be sure that the signed message has not been changed. A digital signature does not provide confidentiality. In other words, data that is not encrypted data can bear a digital signature.
How do you ensure confidentiality with a digital signature? ›Ensure confidentiality by encrypting the entire message with the recipient's public key. This means that only the recipient, who is in possession of the corresponding private key, can read the message. Verify the user's identity using the public key and checking it against a certificate authority.
What are the two things that a digital signature allows us to do? ›Digital signatures can provide evidence of origin, identity and status of electronic documents, transactions or digital messages. Signers can also use them to acknowledge informed consent.
Is DocuSign eSignature HIPAA compliant? ›DocuSign states that its security and privacy features are compliant with HIPAA standards. DocuSign appears to fall the category of a business associate when healthcare providers use its services for protected health information (PHI).
Can you use DocuSign for medical documents? ›Patient intake & consents
Use DocuSign to easily transform patient paperwork into simple, guided e-forms via email, text and/or an online portal with accessibility features.
And the answer is YES! Google Docs (with a paid Google Workspace subscription, signed BAA and appropriately configured settings) can be HIPAA compliant.
Do HIPAA authorization forms expire? ›A stand alone Medical Records Release and Authorization to Use and Disclose Health Information Form will state that this authorization does not have an expiration date (unless superceded by state or local laws).
How many identifiers must be verified for HIPAA? ›
Request full name and at least two other identifiers such as date of birth, address, emergency contact name, phone number, last 4 digits of their social security number. Request most recent date of service or invoice number for billing questions.
Should I decline HIPAA authorization form? ›Should I sign this “HIPAA Authorization” for release of my medical records? No, you should not sign the HIPAA authorization for the release of your medical records. Often, the insurance company will act as though they cannot begin to decide how much money to offer you until they have all of your medical records.
What document must be signed to release medical information? ›The medical record information release (HIPAA) form allows a patient to give authorization to a 3rd party and access their health records. The release also allows the added option for healthcare providers to share information. A medical release form can be revoked or reassigned at any time by the patient.
How must HIPAA documents be stored? ›Medical Records and PHI should be stored out of sight of unauthorized individuals, and should be locked in a cabinet, room or building when not supervised or in use. Provide physical access control for offices/labs/classrooms through the following: Locked file cabinets, desks, closets or offices.
What is the difference between consent and authorization? ›A: “Consent” is a general term under the Privacy Rule, but “authorization” has much more specific requirements. The Privacy Rule permits, but does not require, a CE to obtain patient “consent” for uses and disclosures of PHI for treatment, payment, and healthcare operations.
What makes an online form HIPAA compliant? ›The form must be secured by proper controls as defined by HIPAA's Security Rule. This states that reasonable, proper encryption and security software must be in place to protect any data at rest and in transit. So, your form must secure data at the device and when it traverses myriad applications within a network.
Can a HIPAA form be emailed? ›Emailing Your Online Form
You can include the link to your online form directly in your email, if you are using a FormDr HIPAA compliant online form you can also track the progress as your patients complete your forms.
Signature verification is a type of software that compares signatures and checks for authenticity. This saves time and energy and helps to prevent human error during the signature process and lowers chances of fraud in the process of authentication.
Why is signature a very important requirement in filling out these forms? ›The signature is the most common way to indicate that you have read and agreed to a contract, even if one's signature is so unique and stylized as to be virtually illegible.
What is the importance of authorized signatory? ›Having an authorised signatory is important for businesses, as it allows them to sign contracts and other legal documents without having to go through the board of directors for every single decision.
Why it is so important to have a signed written consent on file for allowing e mail and fax communications? ›
Consent is an integral part of privacy. You can ensure you have the correct contact information and protect yourself from lawsuits by getting permission in writing from your patient before you correspond through email.
What must the patient understand before signing the informed consent form? ›Valid informed consent for research must include three major elements: (1) disclosure of information, (2) competency of the patient (or surrogate) to make a decision, and (3) voluntary nature of the decision. US federal regulations require a full, detailed explanation of the study and its potential risks.
What is the golden rule of HIPAA? ›The Health Insurance Portability and Accountability Act (HIPAA) is the golden rule when it comes to health data confidentiality. Any company that deals with Protected Health Information (PHI) must have the proper network, physical storage, and security measures in place to ensure they are in compliance with HIPAA.
What is the most important rule in HIPAA? ›The most important part of the HIPAA Act states that you must keep personally identifiable patient information secure and private. This provision has made electronic health records safer for patients. However, it's also imposed several sometimes burdensome rules on health care providers.
Is digital signature valid evidence? ›Section 85C of the Indian Evidence Act, 1872 provides that if a digital signature is affixed to a particular document then the court shall presume that such document is true and correct.
Does the HIPAA security Rule apply to electronic formats? ›The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities") and to their business associates.
How much is HIPAA compliant DocuSign? ›Now, on to the downsides. As we already discussed, pricing is expensive. Just the Business Pro plan is $65/month per user, which is $780 a year for your e-signatures. If you pay annually, it's a little better at $45/month per user, or $540 a year.
What is the difference between DocuSign and electronic signature? ›A digital signature is a specific type of electronic signature that uses a specific technical implementation to meet the needs of highly regulated industries. DocuSign, for example, has range of digital signature solutions where Digital certificates can be issued to signers in real time.
What is the difference between digital signature and eSignature in DocuSign? ›The e-signature is the legally binding record while the digital signature is the underlying technology that helps verify the authenticity of the transaction.
Is DocuSign the same as electronic or digital signature? ›A digital signature is a type of e-signature that uses a specific technical implementation. Digital signature providers like DocuSign follow the PKI (Public Key Infrastructure) protocol. Both digital signatures and other e-signature solutions enable you to sign documents and authenticate the signer.
Can a document with digital signature be trusted justify your answer? ›
Digital signatures on PDF documents don't necessarily guarantee their contents are valid, as new research shows viewer implementations don't always detect incomplete signatures. The PDF file format has the capability to embed digital signatures in documents.
Which thing Cannot be validated by a digital signature? ›The correct answer is Redundancy.
What does a digital signature not ensure? ›A digital signature does not provide confidentiality. In other words, data that is not encrypted data can bear a digital signature.
Is protected health information always maintained in electronic form? ›PHI Information Technology
The HIPAA Security Rule requires safeguards to be implemented by HIPAA-covered entities and their business associates to protect PHI that is created, used, received, stored, or transmitted in electronic format.
Under HIPAA, HHS adopted certain standard transactions for the electronic exchange of health care data. These transactions include: Payment and remittance advice. Claims status.