Report Sign-Off

A finished risk assessment is a record. Sign-off is what turns it into an attested record — a named person stating, on a date, that the assessment reflects a good-faith review of the organization.

Who signs, and what they are saying

Sign-off is a two-party record:

• Your organization signs first. The signer confirms the assessment was completed in good faith and reflects the organization's environment at that time. The statement cites 45 CFR § 164.308(a)(8) (the evaluation requirement) and is shown in full before signing.
• HIPAA Sherpa countersigns afterwards. Our countersignature attests to the integrity of the record — that the answers, findings, and evidence links are the ones that were captured. It deliberately does not certify that your organization is HIPAA compliant. No vendor can do that for you.

The customer statement is deliberately not a sworn or perjury declaration — we are not a law firm, and an attestation should not pretend to be a legal oath.

Signing inside the app

Open the completed report and use the sign-off panel. You must tick the agreement box explicitly; the button alone is not consent. Signing records your name, title, IP address, and the timestamp.

Sending it to someone without an account

The person who should sign is often an owner, principal, or compliance officer who does not use HIPAA Sherpa day to day. You do not need to create an account for them.

From the completed report, choose Send for signature and enter their name, email, and title, plus an optional note explaining what you are asking for. They receive a private link that:

• works once, then stops working;
• expires after 14 days;
• shows them the report summary and the exact statement they are agreeing to;
• grants nothing else — no dashboard, no other assessment, no ability to change any answer.

The link is shown to you once when you send it, so you can pass it along another way if email is unreliable. Treat it like a password: anyone holding it can sign that one report.

Sending to an outside signer is a Professional plan feature. Signing inside the app is available on every plan.

If you need to cancel

Withdraw an outstanding request from the same panel. That kills the link immediately. You can then send a fresh one — only one request can be outstanding per report at a time, so withdraw before re-sending.

What gets stored, and why it matters at audit time

The exact wording the signer agreed to is copied into the record, together with a version stamp. It is never reconstructed from today's text.

This matters: if the attestation wording is ever revised, a report signed last year still shows the wording that was actually agreed to last year. An auditor asking "what did they attest to, and when?" gets a straight answer. For the same reason, a signature is permanent — it is never removed by ordinary housekeeping, even if the original request record is cleaned up later.

The signature block appears on the report in the app and in the exported PDF, which is what an auditor usually receives.