E-signatures for consent forms, on the client record, under one BAA.

The short answer

What makes an e-signature tool "HIPAA compliant"

No product is HIPAA compliant on its own; practices are. For an e-signature tool, three things matter:

• A BAA with the vendor. A signed treatment consent, a medical history attestation or a financial agreement for care identifies a person and their care. The vendor that stores it is a business associate.
• A reasonable record of the signing. Who signed, when, and from where, kept with the document.
• Access control. Only the right staff can see signed forms, and the signing link can't be reused by someone else indefinitely.

The legal validity of electronic signatures in the US comes from the federal ESIGN Act and state adoption of the Uniform Electronic Transactions Act. HIPAA doesn't prescribe a particular e-signature technology; it cares that PHI is protected.

How signing works in JBMOnboard360

1. Staff create a signing request from the client record, attached to a consent form, an agreement or another document.
2. The client gets an email with a unique, single-purpose link. Links expire after 30 days if unused.
3. The client signs on any device by drawing or typing their signature.
4. The signature is stored with the time it was signed and the signer's IP address, and the request is marked signed on the client record.
5. Both sides get a confirmation email. Staff see status (pending, signed, declined, expired) without chasing.

Because the signed form sits on the same record as the client's appointments, intake forms, notes and invoices, the front desk can see before a visit whether consent is on file. That's usually the real problem with paper or separate e-sign tools: the form was signed, but nobody can find it at check-in.

Good practice

Five habits for e-signed consent forms

• Version your forms. When a consent changes, give it a new name or date so you know which version each client signed.
• Send before the visit. A link sent with the booking confirmation clears most paperwork before the client arrives.
• Don't send the form over WhatsApp or SMS with health details. Email a link; the form itself lives behind it. Meta disclaims HIPAA compliance for WhatsApp.
• Check status at check-in. Make "consent on file?" part of the front-desk routine.
• Use a dedicated platform where the stakes need it. For multi-party contracts or identity-verified signing, use a tool built for it, under its own BAA if PHI is involved.

What it costs

Signing is part of JBMOnboard360's forms and client records, not a separately priced add-on. Professional is $79 per user per month billed annually ($99 monthly) and covers client records, scheduling, invoicing, forms, team chat and AI meeting summaries. Business is $399 per location per month billed annually ($499 monthly) with unlimited users, and adds the help desk, WhatsApp concierge and lead inbox. Every plan includes a BAA and US hosting on AWS.

JBMOnboard360 is not an EHR, doesn't process US card payments and doesn't send SMS. If you need signatures inside a charting workflow, your EHR's built-in consent tools may be the better place for clinical consents.