Conditional A BAA is available on the Site License plan for DocHub; the Free, Basic and Pro plans list HIPAA (BAA Available) as not included (verified 2026-10-20). Without a signed BAA on an eligible plan, DocHub should not hold PHI.
Short answer
DocHub offers a business associate agreement (see BAA in the HIPAA glossary) on the Site License plan. You request it through DocHub's HIPAA request form. DocHub then confirms the plan setup and shares the agreement for signature.
The covered service is DocHub. The vendor lists no excluded features on the pages checked.
For a clinic, this means a consent form, intake PDF or referral letter that contains PHI should not be edited or signed in DocHub until the BAA is signed and the account is on the Site License plan.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Site License | Yes | Submit the HIPAA request form; the BAA is then shared for signature | Not published by the vendor |
| Free | No | Not applicable | Not applicable |
| Basic | No | Not applicable | Not applicable |
| Pro | No | Not applicable | Not applicable |
The pricing page lists "HIPAA (BAA Available)" as not included on Free, Basic and Pro. Minimum seats and any extra cost for the Site License are not published by the vendor.
What the BAA covers and what it excludes
Covered:
- DocHub
Excluded: The vendor publishes no excluded features on the pages checked. This page does not infer any.
The facts on this page do not extend to third-party integrations or to tools outside DocHub that handle the same documents, such as the email account that receives a signed PDF or the cloud drive where it is saved. Each of those needs its own BAA and review.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The DocHub trust center states the encryption in transit and at rest:. This page does not describe it as end-to-end encryption and does not add algorithm or key-management details, because the vendor's wording does not include them.
How to use DocHub with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. A checklist for a practice or its MSP:
- Submit the HIPAA request form and sign the BAA before any PHI enters DocHub.
- Confirm in writing that the account is on the Site License plan. A Free, Basic or Pro account is not covered, even under the same company name.
- Limit who can open and edit documents to staff who need them, for example front-desk staff for intake forms but not every employee.
- Review audit logs on a set schedule and record who reviewed them.
- Write document-handling rules: where signed PDFs are stored, who may download them, and when they are deleted.
- Train staff not to open PHI documents from personal DocHub accounts on the free tier.
- Map every other tool that touches these documents (email, cloud storage, fax, scanners) and confirm each has its own BAA.
Alternatives with a BAA
These are listed alphabetically, with the plan the vendor ties its BAA to. All are conditional on plan and contract. The full list is in Is it HIPAA compliant? All vendors.
- Adobe Acrobat: conditional; Acrobat Sign Solutions for enterprise.
- Adobe Acrobat Sign: conditional; Acrobat Sign Solutions for enterprise.
- Is Box HIPAA compliant?: conditional; Enterprise.
- DocuSign: conditional; Enhanced plans via contact sales.
- Dropbox Sign: conditional; Standard annual.
For wider comparisons, see HIPAA-compliant electronic signature software and HIPAA-compliant document management software.
Sources
- Manage documents with HIPAA compliance — Trust center, checked 2026-10-20. "We’ll confirm your plan setup and share a Business Associate Agreement (BAA) for signature."
- Manage documents with HIPAA compliance — Trust center, checked 2026-10-20. "Data stored, transmitted, and received between DocHub visitors and users is encrypted at transit and at rest."
- DocHub Pricing — Pricing page, checked 2026-10-20. "HIPAA (BAA Available)"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.