PHI exposure through the signing layer
Clinicians often focus on the EHR and overlook the signing service. Consent forms, intake sheets and letters can contain enough identifying and clinical detail to be PHI in their own right.
For clinics, therapists and private practices
Electronic signatures for clinics and healthcare practices
Every practice runs on signed paperwork: consent to treat, HIPAA acknowledgements, financial responsibility agreements, treatment plans, referral letters, vendor and staff agreements. Collecting those signatures is routine — but each one puts a question in front of you about PHI.
A cloud e-signature service holds a copy of whatever you send through it. When that document is a consent form with diagnosis codes or an intake sheet with a date of birth, the service is handling protected health information on your behalf, which is what triggers a business associate agreement and a set of obligations you then have to manage.
A tool that never receives the document changes the analysis. If no PHI is transmitted to us, we are not handling PHI, and there is no business associate relationship to paper. That is not a marketing claim — it follows from the fact that processing happens in your browser.
Where the friction is
What actually slows signing down in a clinical practice
Vendor paperwork for occasional use
Signing a handful of staff or vendor agreements does not justify procuring, assessing and maintaining another vendor that processes PHI.
Front-desk logistics
Printing, chasing and re-filing paper consent forms still consumes staff time, and patients increasingly expect to sign on a tablet or their own phone.
What you sign
Typical documents
- Consent to treat and consent to disclose
- HIPAA acknowledgement of privacy practices
- Patient intake and registration forms
- Financial responsibility and payment agreements
- Treatment plans and care agreements
- Referral letters and care coordination summaries
- Staff, contractor and vendor agreements
- Practice policy acknowledgements
Clear limits
When a signature is not enough
- Documents that exist only in a payer or clearinghouse portal — those must be signed through the system the payer provides.
- Anything requiring notarisation, such as certain advance directives and guardianship instruments.
- Records with specific retention requirements. An electronic signature creates the mark; your retention and security obligations for the signed record are unchanged.
- State-specific consent formalities for certain treatments or research participation, which can impose their own requirements above ESIGN.
Where HIPAA actually sits in this
HIPAA does not prescribe a particular electronic signature technology. It requires safeguards for protected health information and, where a vendor handles PHI on your behalf, a business associate agreement. Because this tool processes entirely in the browser and transmits nothing, no PHI reaches us and there is no business associate relationship to establish. Your own obligations are unaffected: you still need to store signed records securely, control access, and keep them for the required period.
How it works
Why nothing leaves your device in a clinical practice
The documents in this field are the ones people are least comfortable handing to an unfamiliar service. Our tools process them entirely in the browser.
- 0
- bytes of your document sent anywhere The PDF is opened, modified and saved in your browser tab. There is no upload step in the process.
- None
- upload endpoint to send to This site is generated as static files. There is no API route and no server process, so there is nothing to receive a document even in principle.
- Nothing
- to log into, delete or unshare No account is created, so no server-side copy accumulates. Closing the tab ends the session.
- Yours
- to keep or destroy at any time You save the signed file where you choose. We never hold it, so there is no retention policy to read.
The technical version
PDF pages are rendered and written in the browser with open-source libraries that run entirely on the client. Signature strokes are captured on a canvas, and saved signatures are kept in your browser's own storage — the same mechanism any website uses to remember a preference. None of these components has a network call that transmits a file, and there is no backend for one to reach.
You do not have to take that on trust. Open your browser's developer tools, switch to the network tab, and sign a document. You will see the page's own assets load — fonts, scripts, stylesheets — and nothing else. No request carries your document, because none is made.
Where this is not the right tool. Browser-based signing is excellent for documents you sign yourself. It does not send a document to other people, collect their signatures, verify their identity, or produce an audit trail. When a counterparty or a compliance policy requires those things, use a platform built for it — the trade-off is real and worth naming rather than glossing over.
Related
Other industries we cover
FAQ
Clinics & healthcare practices: common questions
Do I need a business associate agreement to use this?
No. A BAA exists to cover a vendor that creates, receives, maintains or transmits PHI on your behalf. This tool does none of those things — the document is processed in your browser and never reaches a server we operate. If a vendor never receives PHI, there is no business associate relationship to paper.
Is this HIPAA compliant?
We make no compliance guarantee about your overall workflow, and you should be sceptical of any tool that does. What is accurate is narrower and more useful: because nothing is transmitted to us, using this tool does not create a new HIPAA disclosure or a new business associate relationship. Your practice's own safeguards, record retention and access controls still apply.
Can patients sign consent forms on a tablet at the front desk?
Yes. The tool runs in a browser and supports touch input, so a patient can draw their signature on a tablet or their own phone and you save the completed file. Nothing is sent anywhere in the process.
Where are the signed forms stored?
Wherever you put them — your device, then your practice management system or secure file store. That is deliberate: the signed record belongs in your system of record, not in a third-party signing account.
Can I sign clinical and administrative documents?
Yes. Consent forms, acknowledgements, financial agreements, referral letters and staff or vendor contracts can all be signed this way. Payer-specific documents signed through a portal are the exception, since that workflow belongs to the payer.
Does an electronic signature on a consent form make it valid?
The signature itself is valid under ESIGN and the state UETA. Whether the consent is effective also depends on your state's informed-consent requirements — what must be disclosed and how it is documented — which is a separate question from how the signature was applied.