Seven e-signature vendors listed here will sign a BAA, but only on specific plans. Only Formstack publishes a starting price: $83/month for Forms, billed annually, plus a HIPAA add-on. For the other six, the BAA tier is sold through sales and no price is published. This page shows which plan gates the BAA, how to request it and what pricing is public.
- Short answer: BAA availability and cost across seven e-signature vendors
- Comparison table: BAA plan, how to get it, pricing from, last verified
- What the API question really depends on: plan gating, not the endpoint
- Pricing: what is public and what is quote-only
- Why individual and standard plans are usually excluded
- Security controls to check beyond the BAA
- How to get the BAA signed: a short checklist
- Related categories and how this table is maintained
- FAQ
Short answer: BAA availability and cost across seven e-signature vendors
All seven vendors have the verdict conditional: a BAA is available, but it depends on the plan and on an executed agreement. None is a clean "yes" for every plan. That is why this page says "BAA available on plan X" and never calls a vendor "HIPAA certified" or "HIPAA compliant" as a product property. For the reasoning, see what 'HIPAA compliant' means for software. Other categories are listed under HIPAA-compliant software by category.
- Signed consents and authorizations are PHI, so the vendor must sign a BAA on the plan you actually buy. This follows from the definitions of "protected health information" and "individually identifiable health information" in 45 CFR 160.103, not from a provision that names consents.
- Formstack is the only vendor with a published starting price: $83/month for Forms, billed annually, plus a HIPAA add-on.
- Adobe Acrobat, Adobe Acrobat Sign, DocHub, DocuSign, Dropbox Sign and PandaDoc do not publish a price for the BAA tier.
Comparison table: BAA plan, how to get it, pricing from, last verified
Rows are alphabetical. Placement never depends on payment or on Chanty's interest. "Not published by the vendor" means the vendor makes no public statement. It does not mean the control is absent. The last verified date is given once, in the Sources list at the end of this page. For vendors beyond these seven, see is it HIPAA compliant? all vendors.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Data residency |
|---|---|---|---|---|---|---|---|---|---|
| Adobe Acrobat | Conditional | Acrobat Sign Solutions for enterprise | Contact an Adobe sales representative; requires the correct license and a signed BAA | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| Adobe Acrobat Sign | Conditional | Acrobat Sign Solutions for enterprise | Contact Adobe sales or a channel representative with the Acrobat Sign Account ID; after the BAA is executed, Adobe enables the Linked Business Associate Agreement setting | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| DocHub | Conditional | Site License | Submit the HIPAA request form; DocHub confirms plan setup and shares the BAA for signature | Not published by the vendor | Yes | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| DocuSign | Conditional | Enhanced plans (contact sales) | Contact Customer Support to review and sign the Business Associate Addendum; only certain plans qualify, so you may be sent to Sales | Not published by the vendor | Not published by the vendor | Yes | Yes | Not published by the vendor | Not published by the vendor |
| Dropbox Sign | Conditional | Standard (annual) | Contact the account manager or sales form; signed BAA and a minimum contract value required | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| Formstack | Conditional | Forms (HIPAA add-on) | Standard BAA provided by Formstack; custom BAA requests evaluated case by case; HIPAA compliance is an add-on on Forms and Suite plans | $83/month (Forms, billed annually) + HIPAA add-on | Yes | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| PandaDoc | Conditional | Enterprise | Contact the account or support team (request a demo) to sign the BAA before any ePHI workflows | Not published by the vendor | Not published by the vendor | Yes | Yes | Yes | US or EU (Enterprise) |
Adobe Acrobat and Adobe Acrobat Sign point to the same gating plan. Adobe's HIPAA page covers Acrobat Sign and describes no separate BAA path for Acrobat (PDF).
What the API question really depends on: plan gating, not the endpoint
A BAA attaches to an account and a plan. Before a developer sends a test envelope with real patient data, confirm that the API or sandbox tier is covered by the signed agreement. None of the vendors on this page states in its published BAA terms whether API usage is covered. Ask the vendor to name the API in the BAA before you build on it.
How each vendor gates the BAA:
- Dropbox Sign: Standard (annual) plan, a signed BAA and a minimum contract value. No figure is published; the Dropbox Sign features page says only "minimum contract value required" at additional cost.
- DocuSign: enhanced plans only, arranged through sales. Customer Support reviews the Business Associate Addendum.
- PandaDoc: Enterprise plan. The BAA is signed before any ePHI workflow.
- Adobe Acrobat Sign: sales checks eligibility using the Account ID. After execution, Adobe enables the Linked Business Associate Agreement setting on that account.
A sandbox, test or developer account should not receive real PHI unless the BAA explicitly covers it. Use synthetic patients in test flows, such as a fake consent form with a made-up name and date of birth. If you are choosing hosting and APIs for the surrounding product, compare HIPAA-compliant software development vendors.
Pricing: what is public and what is quote-only
Public
- Formstack: $83/month for Forms, billed annually, plus the HIPAA add-on. Formstack does not publish the add-on price; contact Formstack. Formstack is a forms and signature product, so confirm it fits your signing need before comparing it with dedicated e-signature APIs.
Not published by the vendor
- Adobe Acrobat, Adobe Acrobat Sign, DocHub, DocuSign, Dropbox Sign and PandaDoc publish no price for the BAA tier.
- Dropbox Sign does publish API plan prices (Essentials $75/month, $900 billed yearly; Standard $250/month, $3,000 billed yearly; Premium by custom quote; Test mode free). It does not publish the HIPAA tier price, which carries additional cost.
So the honest answer to "what does it cost" is mostly "ask sales." A low-priced public plan is not the plan that carries the BAA.
Hidden-cost checklist
- Minimum contract value (Dropbox Sign requires one)
- Annual billing only
- HIPAA or compliance add-ons on top of the base plan
- Per-envelope or API call fees
- Overage charges
- Separate fees for sandbox or additional environments
Why individual and standard plans are usually excluded
In this category the BAA usually sits on enterprise, add-on or sales-only tiers, not on individual and standard plans. The table shows this directly:
- Adobe Acrobat Sign Solutions for enterprise
- DocuSign enhanced plans
- PandaDoc Enterprise
- DocHub Site License
- Formstack's HIPAA add-on on Forms and Suite plans
Dropbox Sign is the nearest exception: its Standard (annual) plan qualifies, but only with a signed BAA and a minimum contract value.
The practical consequence for a clinic: a free trial or cheap standard plan used to collect new-patient consents is not covered. Do not put PHI in it. Read what a business associate agreement covers to see what the signed agreement does and does not include.
Security controls to check beyond the BAA
The table shows these published controls:
- Encryption at rest: Formstack and DocHub
- Audit log: Formstack, DocHub, DocuSign and PandaDoc
- SSO: DocuSign and PandaDoc
- SOC 2: PandaDoc
- Data residency: PandaDoc, US or EU on Enterprise
"Not published by the vendor" means the vendor makes no public statement. It does not mean the control is missing. Ask the vendor and record the answer with a date.
An audit trail of signing events matters for consent evidence, for example showing who signed a procedure authorization and when. DocuSign states that every agreement is tracked with a complete, automated audit trail and certificate of completion. These record when a document was opened, viewed and signed, along with signer details, e-signature consent, the signature image, event timestamps and IP address. DocHub's audit trail logs every action and who performed it, including email, location, browser, operating system, IP address, views, emails sent, e-signatures and initials, and users can view or download it. Adobe Acrobat Sign, Dropbox Sign, Formstack and PandaDoc do not publish comparable detail on this page. The directory reports published terms and does not audit vendors.
How to get the BAA signed: a short checklist
- Match your plan to the BAA plan in the table before any PHI enters the tool.
- Confirm the BAA is executed, not just requested.
- Follow the vendor's route:
- Sales contact: Adobe, PandaDoc, Dropbox Sign
- Customer Support, then Sales: DocuSign
- HIPAA request form: DocHub
- Standard BAA from Formstack, with custom requests evaluated case by case
- For Adobe, provide the Account ID and check that the Linked Business Associate Agreement setting is on.
- Record the signing date and store the BAA in your vendor inventory.
Your responsibilities remain: roles and access, templates, retention and staff training. A BAA does not make the workflow compliant by itself.
Related categories and how this table is maintained
Signing usually sits next to intake and records. See HIPAA-compliant forms and form builders and HIPAA-compliant document management. When a vendor changes its BAA terms, the change is logged under recent changes in vendor HIPAA status.
Methodology: BAA information comes from each vendor's own page, and each row is checked against that source.
Disclosure: this directory is published by Chanty, Inc. Chanty has a vendor entry elsewhere on the site, and neither payment nor Chanty's interest affects placement. E-signature is planned for Chanty, not shipped. The broader lead topic, "HIPAA compliant electronic signatures," is covered at chanty.health/tools/e-signature/.
Sources
- Adobe HIPAA-Ready page: https://www.adobe.com/trust/compliance/hipaa-hds/hipaa-ready.html
- Adobe Acrobat Sign HIPAA overview: https://helpx.adobe.com/ph_fil/sign/config/compliance-issues/hipaa/overview.html
- DocuSign healthcare page: https://www.docusign.com/solutions/industries/healthcare
- DocHub security page (describes DocHub as HIPAA-ready; does not mention a BAA): https://www.dochub.com/en/security
- Dropbox Sign features: https://sign.dropbox.com/features
- Dropbox Sign API pricing: https://sign.dropbox.com/products/dropbox-sign-api/pricing
- Formstack pricing: https://formstack.com/pricing
- 45 CFR 160.103: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
Last verified: 2026-10-20
FAQ
Is there a HIPAA-compliant electronic signature API?
Six vendors will sign a BAA on specific plans: Adobe Acrobat Sign, DocHub, DocuSign, Dropbox Sign, Formstack and PandaDoc, plus Adobe Acrobat under the same enterprise gating. No vendor's published terms state whether the BAA covers API usage, so treat it as unconfirmed for every vendor. Adobe's HIPAA-Ready list includes Adobe Acrobat Sign, Acrobat Sign for Government, Analyzer in Acrobat and Knowledge Base in Acrobat, but not plain Adobe Acrobat, and Adobe says PHI must not be used in unlisted products. Confirm API coverage in writing.
How much does a HIPAA-compliant e-signature API cost?
Only Formstack publishes a starting price: $83/month (Forms, billed annually) plus a HIPAA add-on. The other vendors do not publish a price for the BAA tier. Dropbox Sign publishes API plan prices (Essentials $75/month and Standard $250/month, billed yearly), though not a price for the BAA tier.
Does the BAA cover the API or only the web app?
Published BAA terms do not say. Ask each vendor which account, plan and API tier the executed BAA covers.
Do free or standard e-signature plans include a BAA?
Generally no. The BAA sits on enterprise, add-on or sales-only plans. Dropbox Sign's Standard (annual) plan is the exception in the table, and it requires a signed BAA and a minimum contract value.
Can I send PHI through a sandbox or test account?
Not unless the signed BAA explicitly covers that account. Use synthetic data in test flows.
Is an e-signature on a consent form PHI?
Signed consents and authorizations are treated as PHI. See 45 CFR 160.103, the definitions of "protected health information" and "individually identifiable health information".
Which e-signature vendors sign a BAA?
Adobe Acrobat Sign (enterprise), DocHub (Site License), DocuSign (enhanced plans), Dropbox Sign (Standard, annual), Formstack (HIPAA add-on) and PandaDoc (Enterprise). Adobe Acrobat is listed under the same enterprise gating. The verification date is in the Sources list.
Does signing a BAA make my signing workflow HIPAA compliant?
No. The BAA covers the vendor's obligations. You still configure roles and access, templates, retention and staff training.