PandaDoc will sign a BAA only on its Enterprise plan, and only for its eSignature and document platform. Free, Starter and Business do not include one, so PHI should stay off those plans. This page lists the plan, the process, the controls PandaDoc publishes and the ones it does not. Browse other vendors in Is it HIPAA compliant? All vendors.
Verdict: conditional
Conditional A BAA is available on the Enterprise plan only, for the PandaDoc eSignature and document platform; the Free, Starter and Business plans do not include it. Last verified 2026-10-20.
Short answer
PandaDoc makes a BAA available on request through its account/support team for eSignature and document workflows. HIPAA compliance appears on the pricing page as an optional item on Enterprise, and the price is not published. The BAA must be signed before any ePHI workflow starts. Until then, treat the account as non-PHI.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not offered | Not applicable |
| Starter | No | Not offered | Not applicable |
| Business | No | Not offered | Not applicable |
| Enterprise | Yes | Through the PandaDoc account/support team (request a demo) | HIPAA compliance listed as "optional"; price not published by the vendor |
Enterprise pricing is per seat or per document, and you contact sales for a quote. If a practice is on Business today and wants to send patient paperwork, the plan has to change first. A BAA cannot be added to the lower tiers.
What the BAA covers and what it excludes
Covered:
- The PandaDoc eSignature and document platform.
Excluded:
- No excluded features are published by the vendor on the pages checked. That is an absence of published detail, not confirmation that everything on the platform is in scope. Ask for the BAA's service definition in writing during the demo.
- Every plan other than Enterprise is outside the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | US or EU (Enterprise) |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Data residency: US or EU (Enterprise).
The missing encryption entries matter for a security review. Add them to your vendor questionnaire and get the answers in writing before approving PHI workflows.
How to use PandaDoc with PHI
If a clinic wants to send consent forms, financial agreements or release-of-information requests for signature, work through this list in order:
- Sign the BAA before any ePHI workflow. Do not upload a test document containing real patient data first.
- Confirm the account is on Enterprise. Check the plan in the billing settings, not the sales email.
- Configure access controls and SSO so that only staff who handle patient paperwork can open those documents.
- Use the audit log for periodic review of who opened, sent or changed documents.
- Choose US or EU data residency to match your organization's policy.
- Set staff policies and training: which document types may carry PHI, and what may go in a document title or email subject.
- Handle offboarding: remove departing staff and revoke their access the same day.
Compliance depends on the signed BAA, your configuration and your policies, not on the vendor name. For definitions, see the HIPAA glossary entries on BAA and PHI.
Alternatives with a BAA
These tools also make a BAA available under conditions, per our vendor checks:
- Adobe Acrobat: conditional (Acrobat Sign Solutions for enterprise)
- Adobe Acrobat Sign: conditional (Acrobat Sign Solutions for enterprise)
- Box: conditional (Enterprise)
- DocHub: conditional (Site License)
- DocuSign: conditional (Enhanced plans via contact sales)
For side-by-side comparisons, see HIPAA-compliant electronic signature software and HIPAA-compliant document management software. Entries are listed in the order shown and placement never depends on payment.
Sources
- PandaDoc HIPAA Compliant Software: Secure HIPAA Docs & eSignatures — Vendor page, checked 2026-10-20. "In order to transmit electronic Protected Health Information (ePHI) using PandaDoc and maintain it with HIPAA compliance, customers should sign a Business Associate Agreement (BAA) with PandaDoc."
- PandaDoc eSignature Compliance — Help article, checked 2026-10-20. "Execute a Business Associate Agreement (BAA) with PandaDoc before using the platform for any ePHI workflows."
- Official PandaDoc Pricing – Affordable Plans for Every Team — Pricing page, checked 2026-10-20. "HIPAA compliance"
- Official PandaDoc Pricing – Affordable Plans for Every Team — Pricing page, checked 2026-10-20. "Enterprise For end-to-end document workflows and advanced automations. Let’s talk Per‑seat or per‑document pricing"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. See Recent changes in vendor HIPAA status for other vendors.
Is PandaDoc HIPAA compliant for healthcare?
Conditionally. A BAA is available on the Enterprise plan for the PandaDoc eSignature and document platform. Whether your use is compliant depends on the signed BAA, your configuration and your staff policies.
Which PandaDoc plan includes a BAA?
Enterprise only. HIPAA compliance is listed as optional on that plan, and the price is not published by the vendor.
How do I get a BAA from PandaDoc?
Request it through the PandaDoc account/support team by asking for a demo. Enterprise pricing is per seat or per document, and sales provides the quote.
Can I send PHI through the Free, Starter or Business plan?
No. None of those plans includes a BAA, so they are outside the scope of any agreement. Move to Enterprise and sign the BAA before sending PHI.