Is DocuSign HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Docusign may enter a BAA with a HIPAA covered entity. Its plans page offers HIPAA support through a BAA on Enhanced plans, and lists HIPAA (BAA) as contact sales on every IAM tier. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| eSignature Personal | Not covered |
| eSignature Standard | Not covered |
| eSignature Business Pro | Not covered |
| eSignature Enhanced and IAM for Enterprise, through sales | Covered |
| IAM Starter, Standard and Professional show HIPAA (BAA) as contact sales, so confirm with Docusign | Covered |
How to get the BAA
Contact Docusign sales; its plans page lists HIPAA (BAA) as contact sales, though no specific BAA request process is documented on the pages read.
What we couldn’t confirm
The plan information comes from a Docusign blog post rather than contract terms, and we couldn’t read the BAA terms. Confirm the details with Docusign.
Proof from the vendor
- Docusign Plans & Pricing (2026)HIPAA (BAA) on Enhanced and IAM tiers via sales; none shown on Personal, Standard, Business Pro
- eSignature and Contract Management for HealthcareMay enter a BAA with a covered entity; products support customers’ compliance rather than being compliant themselves
- Is Docusign eSignature HIPAA Compliant?Docusign acts as a business associate when eSignature holds PHI; depends on correct configuration
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.