E-signature
E-signature and HIPAA: which tools sign a BAA, and on which plan
Quick answer
Of the 9 e-signature tools we rank, only SignWell says it signs a HIPAA Business Associate Agreement on its entry plan: Light, $10 a month billed yearly. DocuSign, Dropbox Sign, PandaDoc, Adobe, SignNow, Zoho Sign and Foxit eSign offer one only through sales, on request, on a higher plan or as an add-on. Signeasy's pages mention HIPAA but no BAA.
If your practice sends intake forms, consent forms or treatment agreements for signature, the e-signature tool holds patient information. We checked what each of the 9 tools in our e-signature ranking says about signing a Business Associate Agreement (BAA), and on which plan. All were read on Sep 27, 2026.
What a BAA is
The US Department of Health and Human Services puts it this way: "The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA), that the business associate will appropriately safeguard the information, among other obligations." (HHS, checked Sep 25, 2026.)
The one tool that signs one on its entry plan
- SignWell: its pricing page says "SOC 2 Type II, HIPAA, and audit trails included on every plan." The comparison table ticks "HIPAA support / BAA" for Light ($10 a month billed yearly, $12 monthly), Business and Enterprise at no added price. It is not ticked for the Free plan. SignWell's healthcare page adds: "SignWell will sign a Business Associate Agreement so your organization can handle protected health information with confidence."
The 7 tools that offer one through sales, on request, a higher plan or an add-on
- DocuSign: the compare table's "HIPAA support through BAA" row reads "Does Not Include" for Personal, Standard and Business Pro, and "Contact sales" for Enhanced plans.
- Dropbox Sign: "Dropbox Sign can support HIPAA compliance with a signed BAA (minimum contract value required)." That is not part of the $15-a-month Essentials plan.
- PandaDoc: "Execute a Business Associate Agreement (BAA) with PandaDoc before using the platform for any ePHI workflows. Contact your account team to request a BAA." No plan or price is named.
- Adobe: its HIPAA-Ready Services list names Adobe Acrobat Sign, the standalone service sold through sales, not Acrobat Standard, Pro or Studio. "For more information on executing an Adobe BAA for HIPAA-Ready Services, please contact your Adobe sales representative or customer success manager."
- SignNow: "HIPAA compliance through BAA" is a dash on Business, Business Premium and Enterprise, and a paid add-on only on the Site License ($1.50 per signature invite, through sales).
- Zoho Sign: "You can request our BAA template by sending an email to legal@zohocorp.com." No plan or price is named.
- Foxit eSign: "Where applicable, we are prepared to enter into a Business Associate Agreement." The pricing table marks HIPAA Compliance not included on eSign Essentials ($120 per user a year) and included on eSign Business ($300 per user a year, 5 licences minimum).
The one that doesn't say
- Signeasy: its pages, including its compliance page, say it complies with HIPAA but don't mention signing a BAA. HIPAA compliance is an add-on on Business Pro, priced at $1000 in the row description without a billing period, and included in Build Your Plan, for 5 or more seats. It isn't on the Personal plan either way.
What else a practice may want on the same plan
A BAA covers the paperwork, not the workflow. On the entry plans: SignWell Light includes Template Links, a reusable link a patient can open to fill in and sign a document, but its pages don't mention payment collection, and signer passcodes start at Business. PandaDoc Starter collects payments through Stripe. Zoho Sign Standard and Foxit Essentials include signer authentication. None of those three signs a BAA on its entry plan.
Why we have no healthcare list for e-signature
Our rule for healthcare lists is that a tool must sign a BAA on the entry plan we price, and state at least one of: fillable web forms, collecting payment at signing, or signer ID verification. Only SignWell meets it (a BAA on Light, plus Template Links), and a list for an industry needs at least three tools that qualify, so we haven't published an e-signature list for healthcare practices.
A practice that prefers another tool should ask its sales team which plan the BAA comes with and what it costs, and get that in writing before sending patient information. Our method explains how we score the plans themselves.