On March 24, 2026, the Centers for Medicare & Medicaid Services (“CMS”) issued a final rule establishing a Health Insurance Portability and Accountability Act (“HIPAA”) standard for electronic signatures in connection with health care claims attachments transactions, as well as standards governing the electronic exchange of claims attachments more generally. The rule adopts the first-ever standards for health care claims attachments under HIPAA. CMS explains that the standards are intended to eliminate reliance on manual processes, such as faxing and mailing, which the agency believes will lead to cost and time savings, faster care delivery, enhanced security, and improved efficiency.

Electronic Signatures

The final rule requires that electronic signatures used in conjunction with health care claims attachments transactions conform to the Health Level 7 (“HL7”) Implementation Guide (“IG”) for Clinical Document Architecture (“CDA”) Release 2: Digital Signatures and Delegation of Rights, Release 1 (the “Digital Signatures Guide”). CMS explained that it selected the Digital Signatures Guide because it adequately supports the three core features “essential to ensuring trust in electronic signatures”: authentication, message integrity, and nonrepudiation.

Notably, the finalized HIPAA electronic signature standard applies only in the context of electronic health care claims attachments transactions. The proposed rule also included proposals related to standards for prior authorization attachments, including electronic signatures, but CMS explained in the final rule that it elected not to finalize the attachments standards supporting prior authorization transactions at this time based on comments received in response to the proposed rule. The final rule clarifies that the health care industry “may continue to set expectations for electronic signatures in other contexts.”

Additional Standards for Health Care Claims Attachments Transactions

The final rule also adopts several standards for electronically requesting and transmitting health care claims attachments. For administrative transaction data, the final rule adopts the following ASC X12 Version 6020 standards:

• X12N 275 (Additional Information to Support a Health Care Claim or Encounter – 006020X314)
• X12N 277 (Health Care Claim Request for Additional Information – 006020X313)

For clinical information exchanged in claims attachments transactions, the final rule adopts the following HL7 implementation guides as HIPAA standards:

• HL7 CDA Release 2 Attachment IG: Exchange of Consolidated Clinical Document Architecture (“C-CDA”) Based Documents, Release 2, March 2022
• HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, June 2019 with Errata
• HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019 with Errata

The final rule goes into effect on May 26, 2026, and covered entities must comply with the new standards by May 26, 2028.