Move data forward: introducing Transfer data and Related Documents

An electronic signature is any digital indication of a person's intent to sign a document, such as a typed name, a drawn signature, or a click. It's the legal act of agreeing. A digital signature is the cryptographic technology underneath: an encrypted fingerprint attached to a document that verifies who signed it and confirms nothing has changed since they did.

Most e-signature platforms, including PandaDoc, use digital signature technology under the hood to secure the electronic signatures your recipients see and interact with.

Digital signatures provide a higher level of assurance because they rely on cryptographic encryption to verify the signer's identity and confirm the document hasn't been altered since signing.

A standard electronic signature establishes intent and produces an audit trail, which is sufficient for most business agreements. Digital signatures add a layer of cryptographic proof that makes them the standard for regulated industries and high-stakes transactions where tamper-evidence is a legal or contractual requirement.

Use a digital signature when the legal or regulatory standard for a document explicitly requires cryptographic verification of identity and tamper-evidence, not just a record of intent. Common scenarios include federal government contracts under FISMA and NIST standards, pharmaceutical and life sciences documents under 21 CFR Part 11, regulated financial transactions, and cross-border EU agreements requiring a qualified electronic signature under eIDAS. For most standard business agreements, such as  proposals, NDAs, service contracts, onboarding documents, an electronic signature with a complete audit trail meets the legal standard.

A qualified electronic signature (QES) is a specific type of digital signature, the highest tier of legal recognition under the EU's eIDAS regulation. All QES are built on digital signature technology, but not all digital signatures meet the QES standard.

To qualify, a signature must be created using a qualified certificate issued by a trust service provider on the EU Trust List. A QES is legally equivalent to a handwritten signature across all EU member states, making it the required standard for certain employment contracts, real estate transactions, and regulated financial agreements in the EU.

HIPAA does not mandate digital signatures for most healthcare transactions. Electronic signatures are permitted under HIPAA, provided your signing process maintains the access controls and audit trail requirements consistent with your organization's security obligations. 

Some healthcare organizations use digital signatures for higher-security documents because the cryptographic controls satisfy those requirements more comprehensively. What your specific workflows require is a determination for your compliance officer or legal counsel, the guidance here reflects what the regulation generally requires, not advice for your specific situation.