HIPAA
What the HIPAA profile enforces in the product, what a BAA can and cannot do, and what no software vendor can hold.
Editorial owner: Security + Growth. Last reviewed 2026-09-20. Review cadence: 90 days.
There is no HIPAA certificate to display
HIPAA does not award a certificate to a software vendor. What can exist is a business associate agreement and the controls behind it. Treat a vendor claim of HIPAA approval — ours included — as something to check rather than accept.
EndorsedSign is a business associate, not a covered entity. The HIPAA profile is opt-in per tenant. Enable it and execute a BAA before you send protected health information through the platform.
What the HIPAA profile enforces today
| Control | Detail |
|---|---|
| PHI-safe notifications | Email, SMS, and messaging bodies contain links only — no document content, no attachment |
| Two-person PHI deletion gate | Deletion requires confirmation from two authorised staff; the event is recorded |
| Extended retention settings | A separate minimum window applies to PHI documents before purge is allowed |
| PHI access logging | Access events are written to the append-only audit trail |
| Tenant scoping on every tenant-owned record | A request authenticated for one tenant cannot read another tenant's records |
The public BAA is a draft
The Business Associate Agreement published on this site has not been reviewed by counsel and is not executable in that form. Execution is a countersigned, versioned document. The public page exists so a compliance team can see the shape of the commitment before a call.
Review the draft, then talk to us
Read the draft BAA, then contact the team if you need HIPAA profile controls enabled on a regulated tenant setup.