How Autumn uses DocuSign.

What the agreement is

The agreement is a Business Associate Agreement, often called a BAA. Health privacy law requires it before a company like Autumn can see any patient billing records. The practice signs it once. Autumn signs it too. Nothing else is signed through this integration: no service contract, no payment authorization.

What happens, step by step

1. An Autumn team member creates a private setup link for the practice. The link works for 14 days and can be turned off at any time.
2. The practice opens the link. The page shows the practice name and the full text of the agreement.
3. The signer reads the agreement, then draws or types a signature. DocuSign places that signature on the document and asks the signer to confirm.
4. Autumn checks with DocuSign that the signature is complete. Only then does the page continue to the next setup step.
5. An Autumn team member countersigns. DocuSign then produces the finished PDF.
6. Autumn emails the practice a confirmation with the signed agreement attached.

The practice does not need a DocuSign account. The signing window opens inside the Autumn setup page.

What Autumn sends to DocuSign

• the practice name;
• the signer's name and email address;
• the signature image the signer drew or typed; and
• the practice's legal name and the signer's title, which the signer types into the document.

That is the complete list.

What Autumn never sends to DocuSign

• patient names, records, or insurance details;
• passwords or logins for practice software;
• bank or payment details; and
• the private setup link itself.

Later setup steps collect access details for the practice's software. Those details never pass through DocuSign. They are encrypted and stored in a separate password vault.

What DocuSign sends back to Autumn

• whether the agreement has been signed; and
• the finished, signed PDF.

Autumn keeps the signed PDF with the practice's setup record and attaches it to the confirmation email.

How the connection is protected

• Autumn's server connects to DocuSign with Autumn's own DocuSign account and a private signing key. No person's DocuSign password is used.
• The practice's setup link contains a secret that is never stored in plain text and never appears in web server logs.
• A signature is complete only when DocuSign confirms it. A message from the browser alone is not enough.
• Autumn's connection to DocuSign is limited to creating and reading this one agreement.

Questions

Email jake@meetautumn.com with any question about this integration or about an agreement you were asked to sign. Autumn's privacy policy explains how Autumn handles information more broadly.