As I understand it there are plans or modules that can be included to adhere to HIPAA compliance. Here is the best resource I could find but would suggest contacting DocuSign Sales or your Account Manager to get further information....

https://www.docusign.com/solutions/industries/healthcare

I recently signed up for a trial period and sent a staff member a sample paper to sign. Although we both received an email that it was signed with the request to log in to view the completed document, it was also attached to the email. This would not be considered compliant in my mind, since emails are easily hacked.

Does anyone know how to turn that feature off? I've been searching around the site but can't find it. Is it possible?

We cannot use it for our needs if a copy of the signed document containing personal information is emailed as an attachment.

Well you have two options in DocuSign that would meet these compliance needs....

1) As you noted turn off the Attachments in the email. This is done by a DocuSign Admin under the Admin Console, then Signing Settings, then uncheck "Attach documents to completion email".

1) Mask or hide potentially protected data by using DocuSign fields that are "hidden with astericks"