Is Dropbox HIPAA compliant? Dropbox, Box, iCloud and cloud storage checked

Dropbox and Box can hold protected health information (PHI) only on plans where the vendor signs a business associate agreement (BAA), and only if your practice configures and uses them correctly. Apple does not advertise a BAA for iCloud, so iCloud should not hold PHI. Dropbox Sign and HelloFax each need their own BAA check. Below is a plan-by-plan answer, what to change in your settings, and a checklist to run before files go in.

Short answer: which cloud storage services can hold PHI

Service	BAA available?	Eligible plans	Last verified
Dropbox	Yes, on eligible business plans	Business team plans only; check Dropbox's current list. Do not use personal plans for PHI	Confirm with vendor
Box	Yes, on eligible business plans	Business and enterprise tiers; check Box's current list	Confirm with vendor
iCloud	No BAA advertised	None	Confirm with vendor
Dropbox Sign (HelloSign)	Confirm with Dropbox	Confirm tier with Dropbox	Confirm with vendor
HelloFax / Dropbox Fax	Confirm with Dropbox	Confirm tier with Dropbox	Confirm with vendor

Dropbox: A BAA is offered only on specific business plans. Check Dropbox's current list and signing steps before you upload PHI. Do not treat personal accounts as covered.

Box: A BAA is offered on specific business and enterprise plans.

iCloud: Apple does not advertise a BAA for iCloud. Keep PHI out of it.

Vendor terms change. Many answers that rank for "is Dropbox HIPAA compliant 2014," "2016" or "2018" describe plans and policies that may no longer exist. Check the "last verified" date above against the vendor's current BAA page before you rely on it. For other vendors, see more HIPAA tool checks.

Why 'HIPAA compliant' depends on the BAA and on you

A cloud provider that stores PHI for your practice is a business associate. HIPAA requires a signed business associate agreement (BAA) before any PHI goes into the service. If someone uploads a referral letter before the BAA is signed, that upload is the problem. Signing a BAA afterward does not fix it.

There is no HIPAA certification for software. When a vendor says it is "HIPAA compliant," it means the vendor supports your compliance. In practice, that means it will sign a BAA and maintain safeguards on its side. It does not mean every account on every plan is safe for PHI.

Responsibility is shared:

• The vendor secures its infrastructure and meets the obligations in the BAA.
• Your practice controls who has accounts, how links are shared, which devices sync files, how often access is reviewed, and how staff are trained.

Encryption is not enough on its own. A consumer storage account can encrypt files and still be the wrong place for PHI, because there is no BAA behind it.

Dropbox and HIPAA: plans, BAA and setup

Plans and BAA. Dropbox offers a BAA on certain business plans, the plans people search for as "Dropbox Business." On eligible plans, an admin typically signs the BAA through the admin console. The BAA is not automatic. Someone with admin rights has to accept it. File a copy with your privacy officer.

Cost. Dropbox prices BAA-eligible plans per user. Ask Dropbox whether the BAA itself carries any extra charge. Budget for every staff member who will touch PHI. Shared logins are not a workaround.

Settings to review after signing:

• Shared links: restrict public links, default to team-only access, and require expiry dates and passwords on any external link, where your plan offers those controls
• Two-step verification required for all team members
• Device approvals, so files sync only to approved computers and phones, if your plan includes them
• Remote wipe for lost or departing staff devices, if available on your plan
• Admin audit logs, so you can see who viewed, shared or downloaded files, if available on your plan

Medical records. Dropbox can store files under a BAA. It is not an EHR. If you scan old paper charts into Dropbox, your records retention schedule still applies. So does your policy on which copy is the official record.

Common mistakes in clinics:

• A front desk coordinator saves insurance cards to a personal Dropbox account because it is already on her phone.
• A practice manager syncs the shared billing folder to a home computer that family members also use.
• Someone emails a Dropbox link for a patient's records request to the wrong address, and the link has no password or expiry.

Dropbox Sign (HelloSign) and HelloFax / Dropbox Fax

These are separate products with separate terms. Do not assume your storage BAA covers them.

Dropbox Sign (HelloSign). Check whether a BAA is available and on which plan. Confirm whether your Dropbox storage BAA extends to Dropbox Sign or whether Dropbox Sign needs its own agreement.

HelloFax / Dropbox Fax. Confirm BAA availability, the eligible plan and the terms.

The rule: read your BAA and check that it names each product you use. A BAA for one product does not automatically cover another, even from the same company.

How practices use them:

• Sending intake packets or consent forms for signature before a first visit
• Receiving faxed referrals from specialists or hospitals

Route completed documents into a covered storage location, or into your EHR. Do not leave them sitting in the signing or fax tool's history. If you automate that routing through Zapier or a similar service, the automation tool needs its own BAA review as well. See Zapier and other connected work apps.

Box and HIPAA: plans, BAA and AI features

Plans and BAA. Box offers a BAA on specific business and enterprise plans. Confirm the plan name on your invoice matches an eligible tier before you upload PHI.

Settings to review:

• Shared link defaults: set them to company-only access or invited collaborators only
• Collaborator permission levels: use viewer or previewer access where staff do not need to edit
• External collaboration restrictions, so files can be shared only with approved outside domains
• Two-factor authentication required for all users
• Audit and reporting, so you can review downloads and sharing activity

Box AI and PHI. Before you enable Box AI features on folders that contain PHI, confirm whether those features are covered under your Box BAA. If coverage is unclear, keep AI features off for PHI folders until your privacy officer confirms it in writing.

Box versus Dropbox for multi-location groups. Both can work when the plan is BAA-eligible. Compare them on how your group is run:

• Can you set up a folder structure per location?
• Can a clinic manager administer their own site's folders without seeing the others?
• How granular is the admin reporting?

Pick the one whose admin model matches how your locations are managed. Brand familiarity is a weaker reason.

iCloud, personal accounts and other storage to avoid for PHI

iCloud. Apple does not advertise a BAA covering iCloud Drive, iCloud Photos or iPhone device backups. The quiet risk is staff phones. A medical assistant photographs a patient's insurance card or a lab requisition, and the photo backs up to her personal iCloud automatically. Notes typed into a personal notes app can sync the same way. Apple's other services raise the same question; see whether Zoom and FaceTime can be used under HIPAA.

Personal Google Drive, OneDrive and Dropbox. Treat consumer plans as having no BAA. A staff member's personal account is never the right place for PHI, even "just for today."

If your practice already uses a suite: Google Workspace and Microsoft 365 offer BAAs on eligible plans. Read Google Drive and HIPAA, and for Microsoft, how to use OneDrive and SharePoint under a Microsoft BAA. The storage you already pay for may cover you without adding Dropbox or Box.

Backup is part of the requirement. HIPAA requires a contingency plan that includes data backup. A sync service is not automatically a backup. If someone deletes a folder, the deletion syncs everywhere. Check version history and restore windows on your plan. Any separate backup vendor that holds PHI also needs a BAA.

Checklist before your practice stores PHI in the cloud

1. Confirm the plan is BAA-eligible. Then sign the BAA and file a copy with your privacy officer, dated.
2. Lock down sign-in and sharing. Turn on 2FA or SSO for every account, set link-sharing defaults to internal-only, and enable audit logs.
3. Use practice-owned accounts only. No personal accounts, no shared logins. Offboard departing staff the same day: remove access and wipe their devices.
4. Decide what goes where. Write down what belongs in storage (scanned faxes, signed forms, HR files, policies) and what belongs only in the EHR (clinical notes, results). Document it in your HIPAA policies.
5. Update your risk analysis. Add the storage service to your risk analysis.
6. Train staff on three behaviors: sharing links (internal by default, expiry on external), downloading to personal devices (don't), and photographing documents (use approved workflows only).

You can find free HIPAA templates and checklists to help document these steps.

Where files meet team chat

Staff rarely open storage directly. More often, someone drops a link into a chat: "Updated referral form is here," or "Can you check this fax?" That means your chat tool is part of the PHI path. It needs its own BAA too.

File names and previews matter as well. A link to "Garcia_M_prior_auth.pdf" puts a patient name in the chat. That name is in the chat whether or not anyone opens the file.

Chanty connects to Google Drive, Dropbox, OneDrive and Box for file sharing and previews. Chanty supports HIPAA compliance with a signed BAA on its Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI.

Third-party integrations are outside Chanty's BAA. Each storage vendor you connect needs its own BAA with your practice.

Chanty is for internal operational coordination among staff: front desk handoffs, supply requests, schedule changes, assigned follow-up tasks. It runs alongside your EHR and your storage. It is not a patient-facing tool or a records system.

See how HIPAA-compliant staff chat works, review Chanty security and BAA details, or create a workspace.

FAQ

Is Dropbox HIPAA compliant in 2025?

Dropbox can support HIPAA compliance on business plans where it signs a BAA; check Dropbox's current list of eligible plans. No version of Dropbox is compliant by itself. Your practice still has to sign the BAA, configure sharing and devices, and train staff.

Is Dropbox Business HIPAA compliant, or only certain plans?

Only certain business plans are eligible for a BAA. Personal plans should not be used for PHI. Check the plan name on your current invoice against Dropbox's eligible list.

How do I make Dropbox HIPAA compliant?

1. Move to an eligible plan.
2. Sign the BAA, typically in the admin console.
3. Require two-step verification.
4. Restrict shared links and approve devices.
5. Enable audit logs.
6. Remove all PHI from personal accounts.
7. Add Dropbox to your risk analysis.

Does Dropbox sign a BAA, and does it cost extra?

Dropbox signs a BAA on eligible business plans. Confirm current per-user plan pricing, and whether the BAA carries any additional charge, with Dropbox before you budget.

Is Dropbox HIPAA compliant for medical records?

Under a signed BAA, Dropbox can store files that contain PHI, such as scanned records. It is not an EHR. Your retention schedule, access rules and official-record policy remain your practice's responsibility.

Is Dropbox Sign (HelloSign) HIPAA compliant?

Dropbox Sign needs its own check: whether a BAA is offered, on which plan, and whether your Dropbox storage BAA extends to it. Do not assume coverage.

Is HelloFax or Dropbox Fax HIPAA compliant?

Only if a BAA covering the fax product is in place. Confirm the BAA names HelloFax or Dropbox Fax specifically.

Is Box HIPAA compliant, and is Box AI covered?

Box offers a BAA on eligible business and enterprise plans. Whether Box AI features are covered under that BAA must be confirmed before you use them on PHI.

Is iCloud HIPAA compliant?

No. Apple does not advertise a BAA for iCloud. Keep PHI out of iCloud Drive, iCloud Photos and device backups on staff phones.

Does HIPAA require cloud backup of patient data?

HIPAA requires a data backup plan as part of your contingency plan. It does not require the cloud specifically. Any cloud backup vendor that holds PHI needs a BAA.

Do I need a separate BAA for each tool connected to my storage?

Yes, for every tool that creates, receives, stores or transmits PHI. That includes e-signature, fax, automation and chat tools. A storage BAA does not extend to tools connected to it, and a chat vendor's BAA does not cover the storage services it links to.