Conditional A BAA is available on request for eSignature customers on sales-negotiated Enhanced plans, while the self-serve Personal, Standard and Business Pro plans list HIPAA support through BAA as not included (last verified 2026-10-19).
Short answer
Docusign says a Business Associate Addendum is available for Docusign eSignature on Enhanced plans. To get it, contact Customer Support or Sales to review and sign. Because the service is only available with certain plans, a buyer on a standard self-serve plan may be directed to Sales.
Signing the BAA is a precondition for handling PHI. It does not by itself make your use of the service compliant. For other tools, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Personal | Does Not Include | Not available | Not published by the vendor |
| Standard | Does Not Include | Not available | Not published by the vendor |
| Business Pro | Does Not Include | Not available | Not published by the vendor |
| Enhanced plans | Available | Contact Sales or Customer Support to review and sign the Business Associate Addendum | Not published by the vendor |
Minimum seats and Enhanced plan pricing: Not published by the vendor.
A practical consequence for a clinic: if your front desk already sends intake forms or consent documents from a Standard account, that account has no BAA behind it. The account has to move to an eligible plan, with the BAA signed, before PHI goes into envelopes.
What the BAA covers and what it excludes
Covered service
- Docusign eSignature
Excluded features
- None are published by the vendor on the pages reviewed. That is not a statement that everything else is covered.
Other Docusign products are not named in the sources. Do not assume the BAA extends to them. If your workflow uses anything beyond eSignature, ask Docusign in writing whether the BAA applies.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the reviewed sources are silent, not that the control is absent.
How to use DocuSign with PHI
Docusign is a Business Associate for HIPAA purposes when a healthcare provider uses Docusign eSignature. The definitions of that term and of the BAA are in the HIPAA glossary: BAA and business associate, and the wider program steps are in the HIPAA guides.
- Get the BAA signed first. Do this on an eligible plan before anyone sends PHI.
- Confirm scope in writing. Check that the BAA covers the Docusign eSignature account you actually use.
- Configure SSO and use the audit log. Both are published as available. Review the log when a document is sent to the wrong recipient.
- Restrict who can send and access envelopes. Limit senders to the staff who handle intake or consent paperwork.
- Train staff on what may go into documents and messages. Cover envelope names, subject lines and message text, not only the attached form.
- Manage offboarding and retention. Remove departed staff promptly and decide how long completed documents stay in the account.
Compliance depends on the signed BAA, your configuration and your organization's own policies.
Alternatives with a BAA
These e-signature options list a BAA under a specific plan or add-on. The plan named is the one the BAA is tied to.
- Adobe Acrobat: conditional, Acrobat Sign Solutions for enterprise
- Adobe Acrobat Sign: conditional, same plan
- DocHub: conditional, Site License
- Dropbox Sign: conditional, Standard annual
- Formstack: conditional, Forms HIPAA add-on
For a side-by-side view, see HIPAA-compliant e-signature tools.
Sources
- Docusign Legal FAQ — Help article, checked 2026-10-19. "Docusign will sign a Business Associate Addendum with customers who are required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates. Contact Customer Support. Note: This service is only available with certain plans. You may be directed to contact Sales to sign up for an appropriate plan."
- Docusign Pricing | eSignature Plans for Personal & Business — Pricing page, checked 2026-10-19. "HIPAA support through BAA — Personal: Does Not Include; Standard: Does Not Include; Business Pro: Does Not Include; Enhanced plans: Contact sales"
- Is Docusign eSignature HIPAA Compliant? — Vendor page, checked 2026-10-19. "Docusign is a Business Associate for HIPAA purposes when a healthcare provider uses Docusign eSignature"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-19. Earlier updates are listed on Recent changes in vendor HIPAA status.
Does DocuSign sign a BAA?
Yes, for Docusign eSignature customers on Enhanced plans. Contact Customer Support or Sales to review and sign the Business Associate Addendum. The service is only available with certain plans.
Can I use DocuSign Personal, Standard or Business Pro with PHI?
No BAA is available on these plans. Docusign's pricing page lists HIPAA support through BAA as "Does Not Include" for each of them. Without a BAA, these plans should not be used for PHI.
Which DocuSign service does the BAA cover?
The sources name Docusign eSignature. They name no other Docusign product, so do not extend coverage to anything else without written confirmation.
How do I request a DocuSign BAA?
Contact Docusign Customer Support or Sales and ask to review and sign the Business Associate Addendum for Docusign eSignature. Pricing and minimum seats for Enhanced plans are not published by the vendor, so ask for them in the same conversation.