A parent signs your new-patient consent on their phone in the parking lot. It takes forty seconds. Later someone asks the obvious question: does that actually hold up?
Usually, yes. In the United States an electronic signature is a real signature. But "valid" and "easy to defend" are different things, and what decides the second is not what the signature looks like. It's the evidence around it.
The short legal answer
Two laws do most of the work.
ESIGN (2000). The federal Electronic Signatures in Global and National Commerce Act says a signature, contract or record relating to a transaction in interstate commerce "may not be denied legal effect, validity, or enforceability solely because it is in electronic form". It defines an electronic signature broadly: an electronic sound, symbol or process, attached to or logically associated with a record, and executed or adopted by a person with the intent to sign the record.
UETA. The Uniform Electronic Transactions Act is the state-level version, adopted by 49 states and the District of Columbia. Texas adopted it as Chapter 322 of the Business & Commerce Code: a record or signature "may not be denied legal effect or enforceability solely because it is in electronic form", and where a law requires a signature, an electronic signature satisfies it. New York never adopted UETA. Its own Electronic Signatures and Records Act gives an electronic signature the same validity and effect as one signed by hand.
Two details matter in practice:
- UETA applies when both sides agreed to do business electronically, and that agreement can be inferred from context and the parties' conduct. A family that opens your link and signs on screen is generally showing it.
- There are exceptions. ESIGN does not cover wills and testamentary trusts, adoption, divorce and other family-law matters, most of the Uniform Commercial Code, court documents, and certain notices such as utility shut-offs, foreclosure or eviction, cancellation of health or life insurance benefits, and product recalls. Everyday clinic paperwork (intake forms, consents to treat, financial policies, acknowledgements) is not on that list. Both laws are written for business transactions, though, and state health-care rules can add their own requirements for particular consents.
What makes an e-signature defensible
Legal validity is the floor. When a signature is challenged, the question becomes "can you show what happened?" Here is what auditors, opposing counsel and courts look for.
1. Intent to sign
The signer has to mean it. A clear act shows that: drawing a signature, typing a name into a box labelled as a signature, or ticking a statement like "By signing I acknowledge that I have read and agree to this document" next to a button that says what it does.
2. Consent to do business electronically
UETA asks whether the parties agreed to transact electronically. ESIGN adds a stricter rule for one situation: when another law requires information to be given to a consumer in writing, electronic delivery only counts if the consumer affirmatively consented after specific disclosures, including the right to a paper copy and to withdraw consent. A short, plain consent line before signing covers the general case and costs nothing.
3. Attribution: it was this person
This is where most disputes land. Under UETA a signature is attributable to a person if it was their act, and that act "may be shown in any manner, including a showing of the efficacy of any security procedure" used to identify them. In practice that looks like:
- a private link sent to the person's own email or phone, not a shared kiosk or public form;
- a one-time code sent to that email or phone and entered before signing;
- the time, IP address and device the signature came from;
- a link that expires, so an old one is useless to whoever finds it.
No single item is proof. Together they make "someone else signed this" a hard argument to win.
4. The signature is tied to the exact document
The signature has to belong to this record: this version of the form, with this wording. If your consent text changes next month, you need to show which version each patient signed.
5. Integrity and retention
A retained electronic record has to accurately reflect the original, stay accessible to the people entitled to it, and be capable of being accurately reproduced. For a signed PDF, that means showing it hasn't been edited since signing. A cryptographic fingerprint (a SHA-256 hash) recorded at the moment of signing does exactly that: change one character and it no longer matches. The signer should also be able to keep a copy.
6. An audit trail
Who sent the form, when it was signed, and who has looked at it since. An audit trail turns "we think" into "here is the record."
Typed name, drawn signature or click-to-sign?
All three can be valid. The law cares about intent and attribution, not penmanship. A fingertip squiggle proves little on its own, because nobody can match it to a wet-ink signature. A typed name backed by a private link to the patient's own phone, a timestamp and a tamper-evident PDF is far easier to defend than a beautiful drawn signature with nothing around it.
Many tools collect both, because patients expect to "sign" and the typed name keeps the record readable. That's sensible. Just don't mistake the drawing for the evidence.
What about HIPAA and Medicare?
HIPAA does not prohibit electronic signatures. HHS guidance says the Privacy Rule allows HIPAA authorizations to be obtained electronically, provided any electronic signature is valid under applicable law. HIPAA defers to ESIGN, UETA and state law on validity; its own rules are about protecting the information.
Medicare accepts electronic signatures on medical documentation. The Medicare Program Integrity Manual, chapter 3, §3.3.2.4, covers electronic signatures alongside handwritten ones and says providers need "a system and software products that are protected against modification", with adequate administrative procedures. That section is about clinicians authenticating their own entries, not patient forms, but the principle is the same: the system around the signature is what counts.
This is general information, not legal advice. For your specific forms, especially anything involving minors, financial agreements or state-specific consents, ask your attorney.
A checklist for any e-signature tool
Whether you use OwnSites, a dedicated e-signature service or your EHR's portal, you should be able to answer yes to these:
- Does each patient get a private link to their own email or phone, and does it expire?
- Can you require a one-time code before the form opens?
- Does the signer agree to sign electronically first?
- Is there a clear signature action and attestation statement?
- Is the document filed against the right patient automatically, rather than by whatever name gets typed?
- Are the time, IP address and device recorded, and visible on the signed document?
- Does the PDF show which version of the form was signed?
- Can you show the stored PDF hasn't changed since signing?
- Does the signer get a copy?
- Is every staff view and download logged?
- Does a correction create a new version instead of overwriting the old one?
If a tool misses most of these, its signatures may still be valid. You'll just have a harder time proving it.
How OwnSites patient kits handle it
Clinics on OwnSites can send families a patient kit: the intake packet they complete and sign on their phone before the visit. Behind each signature:
- A private, expiring link. The kit goes to the family's email address or mobile number. The link expires after 14 days, and we store only a one-way digest of it, so it can't be recovered from our database. On first open it's exchanged for a session, so it isn't carried from page to page.
- An optional one-time code. A practice can switch on a 6-digit code, sent to the same email or phone the kit went to, that must be entered before any form in the kit opens.
- Consent to sign electronically. The box the family ticks to sign also says they agree to sign electronically and can ask the practice for a paper copy.
- Identity from the invitation. Each kit is issued for a specific patient, and signed documents are filed against that patient automatically.
- A clear act of signing. The signer types their name and relationship to the patient, can also draw a signature, and must tick an attestation statement before the form will submit.
- Evidence on the page. The time of signing, the IP address, the form's name and version, and a fingerprint of the form's wording are printed on the signed PDF. The device is recorded with the record.
- A Certificate of Signing. Each newly signed PDF ends with a certificate page: how the kit link was sent and to whom (masked), when it was opened, whether a one-time code was confirmed, and when, from which IP address and on which device it was signed.
- Tamper evidence. A SHA-256 fingerprint of the stored PDF is recorded at signing, and staff can see it next to the document, so a copy can be hashed and compared with the file that was signed.
- A copy for the family. When the kit was sent by email, the signer is emailed a copy of each signed PDF, to that same inbox.
- An access log. Every staff view or download of a signed document, from the dashboard or the provider app, is logged.
- Corrections, not overwrites. A corrected document is stored as a new version; the earlier one is kept and marked superseded.
We don't claim this makes any practice "HIPAA compliant". No software can do that on its own, and OwnSites does not yet sign Business Associate Agreements; our HIPAA page says where that stands. What we can say is that each signature comes with the evidence above.
FAQ
Is an electronic signature legally binding in Texas? Yes, for most purposes. Texas Business & Commerce Code chapter 322 says a signature can't be denied legal effect solely because it's electronic, and an electronic signature satisfies a legal requirement for a signature. Exceptions such as wills fall under other law.
Is a typed name a valid signature? It can be. What matters is that the person intended to sign and that you can show it was them.
Does HIPAA allow e-signatures on patient forms? HIPAA does not prohibit them. HHS guidance says authorizations can be obtained electronically as long as the signature is valid under applicable law.
Can a parent e-sign for a minor? Generally, yes, just as they would on paper, and the form should record their relationship to the patient. Rules for minors vary by state and type of care, so check specific consents with your attorney.
What's the most important thing to look for in an e-signature tool? Attribution evidence: a private link to the patient's own email or phone, ideally with a one-time code, plus a record of when and from where they signed.