HIPAA eSignature Requirements: What Healthcare Practices Need to Know

The number of healthcare providers offering telehealth services surged in response to COVID-19. At the height of the pandemic, up to 95 percent of providers offered telehealth options.

The rush to add or expand telehealth services was challenging. For many providers, implementing digital signatures was a key source of concern. How could they protect themselves and their patients? What HIPAA rules apply to eSignatures? Do the laws vary from state to state?

Additionally, when things began to open back up and patients could see their physicians in person again, many patients (and even doctors) still preferred the convenience of telehealth options. Providers also saw the in-office benefits of electronic signing for simplified document completion, HIPAA form signing, and signature collection.

It was clear that electronic signatures were here to stay. But how were providers to ensure compliance during this transition?

Here’s what every healthcare provider needs to know about HIPAA’s eSignature requirements.

Let’s Start with HIPAA

HIPAA is the acronym for the Health Insurance Portability and Accountability Act of 1996. Lawmakers passed HIPAA to protect patients’ rights to control and preserve the privacy of their health information explicitly.

Over time, expansions to the law have and continue to include additional provisions to stay current and helpful. Today, HIPAA dictates:

• That healthcare providers protect patient information from unauthorized third-party access
• When and how providers can share patient information with business associates
• That digital information be protected to the same standards as hard-copy information
• That healthcare providers document their compliance with HIPAA regulations
• Almost everyone who engages with patients and their data must comply with HIPAA. This data compliance includes, but is not limited to:
  • Direct care providers such as medical clinics, hospitals, and doctors’ offices
  • Long-term care facilities of all kinds
  • Dentists and dental surgeons
  • HMOs and other insurance providers
  • Business partners of any covered entity and medical supply and device resellers are also subject to HIPAA.

The Role of E-signatures in Healthcare

When HIPAA first went into effect, eSignatures were rare. The Electronic Health Records (EHR) system adoption was growing. Still, the process could have been faster and was yet to be mandated by the federal American Recovery and Reinvestment Act of 2013-2014, which dictated that all medical charts were converted to a digital format.

Slowly but surely, digital health records, prescriptions, and electronic signatures began to fit into the daily processes of healthcare institutions and medical businesses throughout the U.S. Patient medical records are now vastly dictated, transcribed, and stored digitally, patient permissions are sometimes given with electronic signatures, and even prescriptions are often eSigned and digitally sent to pharmacies.

But that’s where things can get complicated.

What HIPAA Rules Say About Electronic Signatures

As published, the HIPAA Security Rule does not contain any language about eSignatures. Lawmakers did originally intend to address the subject. All references to it were removed before publication, however.

Instead, the Department of Health and Human Services (HHS), which oversees HIPAA, published guidelines afterward. Per those guidelines, electronic signatures must adhere to the following to maintain HIPAA compliance:

Legally Binding

eSignatures must be legally binding under state law in the provider’s state

ESIGN Act

eSignatures must comply with the federal United States Electronic Signatures in Global and National Commerce (ESIGN) Act

UETA

eSignatures must comply with the federal Uniform Electronic Transactions Act (UETA), where applicable

Security standards

eSignatures must meet general HIPAA electronic safety and security standards

HIPAA Rules

eSignatures may not violate HIPAA rules in any way when collected, used, or stored

Understandably, providers often need clarification on what this looks like in practice. To better understand these requirements, it is best to break them down into several categories:

• Compliance with the Law
• Authentication and Non-Repudiation
• Control

 Compliance with the Law

The first step to legal compliance for eSignatures involves patient consent. Patients must agree to use digital or electronic means when doing business with their providers. If they do not, providers must work with them using only hard-copy documents and wet ink signatures.

Second, documents patients will eSign must clearly state the following:

• The terms to which the signee agrees
• The signee’s intent in signing the document
• That signees have the option to receive a hard copy or digital copy of the document at their request

Third, documents patients will eSign must comply with federal and state laws. These laws can vary from state to state. Providers should review the laws that apply to them to ensure their documents are in order before providing them to patients.

Authentication and Non-Repudiation

To protect users’ personal health information (PHI), providers must choose their eSignature software carefully; this includes digital signature technology that:

• Verifies the identity or source location of the signer
• Uses private encryption keys to transmit documents securely
• Uses hash algorithms to lock documents
• Uses public decryption keys
• Uses hash algorithms to match both keys before delivering the signed document to the recipient
• Has a verifiable auditing process

This type of system provides the detailed documentation providers need for HIPAA compliance. It also prevents tampering or changing of the document or signature after the fact. This type of stringent protection and documentation make eSignatures legally binding. It also enables them to stand up to HIPAA risk assessment scrutiny and auditing.

It’s crucial that healthcare providers use electronic signature software, such as Foxit eSign, that enables third-party service for their digital signatures. By doing this, they can ensure that they meet these standards and provide an extra layer of legal oversight and protection.  

For HIPAA purposes, eSigned documents are viewed the same as hard-copy documents. Healthcare providers must apply the same high control and protection standards to both.

First and foremost, this means storing documents on encrypted or otherwise protected servers and devices. It also entails securely discarding or destroying extra or no longer needed copies.

Finally, it applies to document retention, as well. HIPAA leaves document retention regulation to the states. Thus, providers should review and abide by their state’s documentation safety and retention standards.

eSignature Technology Use Today

Today’s electronic signature software offers an array of options. eSigning can be as fast and easy as a single keystroke, the swipe of a finger, or the click of a mouse. Electronic signature options can be seamlessly built into documents and processes from start to finish.

Healthcare providers can build eSignature options into front- and back-of-house documents and processes. They can apply digital signatures with almost any device, streamlining workflows to unprecedented degrees.

With the proper planning and implementation, eSignatures can:

• Help you achieve and document HIPAA compliance
• Streamline your onboarding process
• Help your practice go paperless
• Protect yourself and your patients
• Reduce the time and costs associated with handling patient paperwork
• Reduce your document storage space and costs
• Reduce patient wait times

Together, these benefits reduce the strain on your staff. They increase efficiency and lower the likelihood of costly errors.

From your patients’ perspective, eSignatures make the paperwork part of their care take less time and go more smoothly; this allows them to feel in control and like they are getting the most out of their time with you.

Getting the Most Out of e-Signatures

You may already use some form of eSignature at your practice. But maybe you aren’t confident in its HIPAA compliance. Or, perhaps, you aren’t seeing the benefits you know are available. Perhaps, you may have not yet taken the leap to integrate digital signatures into your practice – You want to, but you’re worried about legal compliance and liability.

Whatever the case may be, you can gain the most benefits from eSignatures by getting help from digital signature solution experts, like those at Foxit. They can walk you through the following:

• How to design eSignable documents that match your brand
• How to use templates to save time and money
• How to access and sign documents from various places (e.g., email, browser, EHR system)
• How to create a document workflow that is user-friendly for both staff and patients
• Our fully customizable API options
• How to train your staff to use the digital signature tools and resources available to them for maximum effect
• How to generate, store, and retrieve documents
• How mass-signing documents can save you time and money
• How to integrate eSignatures into programs you already use, like Dropbox or Google docs