HIPAA Scope Policy

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: Robert — Security Lead

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Define Touch2Sign Ltd's position regarding the US Health Insurance Portability and Accountability Act (HIPAA) and Protected Health Information (PHI). Prevents inadvertent HIPAA scope expansion and sets clear boundaries for customers, staff, and sales.

2. Default position

Touch2Sign is OUT OF HIPAA SCOPE by default.

Statement	Detail
HIPAA covered entity?	No
HIPAA business associate?	No — unless separate written BAA executed (not offered by default)
PHI processing	Prohibited on the platform without executed BAA
HIPAA compliance marketing	Prohibited unless BAA programme formally launched

This policy applies to all Touch2Sign personnel, customers, and integrations.

3. Definitions

Term	Meaning
PHI	Individually identifiable health information as defined in 45 CFR §160.103
BAA	Business Associate Agreement under HIPAA §164.308(b)
Covered entity	Health plans, clearinghouses, certain healthcare providers under HIPAA

Touch2Sign provides electronic signature and deed witnessing — not healthcare services.

4. Prohibited activities

Without an executed Touch2Sign BAA (currently not offered):

4.1 Customer prohibitions (Terms of Service)

Customers must not:

• Upload PHI to the Touch2Sign platform
• Use Touch2Sign for patient medical records, clinical trial informed consent regulated as PHI, or insurance claim documents containing PHI
• Configure workflows expecting Touch2Sign to act as a HIPAA business associate
• Represent to their patients or regulators that Touch2Sign is HIPAA-compliant

Terms of Service include explicit PHI prohibition — Legal maintains wording.

4.2 Touch2Sign personnel prohibitions

Staff must not:

• Tell prospects or customers that Touch2Sign is "HIPAA compliant" or "HIPAA certified"
• Execute a BAA without CEO and Legal approval
• Store PHI in support tickets, Slack, or demo environments
• Create HIPAA-specific product configurations implying compliance

4.3 Technical environment

• Platform controls align with general security standards (encryption, access control) — not mapped to HIPAA Security Rule by default
• No BAAs with AWS or sub-processors solely for HIPAA — standard DPAs apply
• Audit trails designed for eIDAS / general compliance — not 45 CFR Part 164 subpart C by default

5. If a customer attempts to upload PHI

Step	Action
1	Support/engineering identifies potential PHI (medical record, diagnosis, treatment data)
2	Escalate to DPO and Legal immediately
3	Request customer remove content and confirm cessation
4	Delete identified PHI per Data Retention & Disposal Policy
5	Document in incident/privacy log — breach assessment if PHI was exposed
6	Do not renew or sign BAA retroactively without CEO decision

6. Sales and marketing guidance

Approved statements:

• "Touch2Sign provides GDPR-aligned electronic signature and witnessing with encryption and audit trails."
• "Touch2Sign is not intended for US HIPAA Protected Health Information. Customers must not upload PHI."

Prohibited statements:

• "HIPAA compliant" / "HIPAA certified" / "BAA available" (unless programme launched)
• "Suitable for patient health records" without Legal-approved disclaimer

Enterprise questionnaire response: "Out of scope — PHI prohibited per Terms."

7. Exceptions — BAA programme (future)

If Touch2Sign launches a formal HIPAA programme:

1. CEO and Legal approve programme scope
2. Execute Touch2Sign BAA with qualifying customers only
3. Complete HIPAA Security Rule gap assessment and remediation
4. Execute BAAs with relevant sub-processors (AWS BAA, etc.)
5. Update this policy, Terms, DPA, and marketing
6. Train all customer-facing staff

Until then, no BAAs.

8. Relationship to other policies

General security controls (encryption, MFA, incident response) support overall data protection but do not constitute HIPAA compliance. Customers requiring HIPAA must use a provider with an active BAA programme — not Touch2Sign by default.

9. Related documents

• Information Security Policy §7
• Acceptable Use Policy §4.3
• Data Classification Policy
• Data Processing Agreement
• Terms of Service

10. Review

Reviewed annually and before any decision to enter HIPAA scope or offer BAAs.

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026