HIPAA-compliant file sharing for clinic and practice staff

Chanty lets clinic and practice staff share files inside the same conversations where they discuss them, and turn those messages into assigned tasks. Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI. This page covers internal staff file sharing only. Chanty is not an SFTP or managed file transfer service, and it is not a way to exchange documents with patients.

What makes file sharing HIPAA compliant

HIPAA does not certify software. HHS states that no HIPAA standard requires certifying compliance, that it does not recognize private "certifications," and that OCR does not endorse, certify or recommend specific technology or products. (hhs.gov) A tool supports compliance when the vendor signs a business associate agreement (BAA) and the practice configures and uses the tool according to the Security Rule's safeguards. These are the administrative safeguards (45 CFR 164.308), physical safeguards (45 CFR 164.310) and technical safeguards (45 CFR 164.312). (ecfr.gov) A cloud vendor that stores or transmits PHI for you is generally a business associate, even if it never views the data. HHS guidance says a cloud provider that stores or processes ePHI is a business associate even if it cannot view the data or lacks the encryption key; only transmission-only "conduits" with temporary storage are excepted. (hhs.gov)

When you review any file sharing tool, look for these safeguards:

• A signed BAA that covers the specific plan and features you will use.
• Access controls and roles that limit who can see which files and conversations.
• Encryption in transit and at rest.
• Strong authentication, such as two-factor authentication (2FA) or single sign-on (SSO).
• Retention settings so files are not kept longer than your policy allows.
• Fast offboarding so you can remove a departing employee's access the same day.

Shared responsibility. The vendor provides the controls. The practice signs the BAA before any PHI is shared, configures roles and permissions, manages user access and offboarding, secures staff devices, and trains staff on what they may share. A tool with every control turned off does not protect anyone.

Vendor review checklist (copy and paste)

• Will you sign a BAA? On which plan? Which features does it cover?
• Are files encrypted in transit and at rest? With what protocols?
• Can we set roles that restrict file access by team, channel or location?
• Do you support 2FA, SSO and IP allowlisting? On which plan?
• What retention options are available for messages and files?
• Do you log file access or downloads? Can we export those logs?
• Are connected integrations covered by your BAA, or do they need their own?
• How do we remove a user's access and devices immediately?

Internal file sharing vs file transfer services (SFTP, MFT) vs cloud storage

"HIPAA compliant file transfer" covers several different tool categories. Pick the category before you pick the vendor.

Internal team file sharing. Staff share files inside conversations and channels. Examples include an updated cancellation policy, a scanned supply invoice, a screenshot of a scheduling error, or a photo of a broken printer at the front desk. Chanty fits this category.

Secure file transfer, SFTP and managed file transfer (MFT). These tools handle system-to-system or bulk transfers, such as claim files to a clearinghouse, batch results from a lab, or exports to a billing vendor. They are a different category with scheduled jobs, automated delivery and transfer logging. Chanty is not one of these tools.

Cloud storage (Dropbox, Google Drive, OneDrive, Box). These are document libraries with folders, versioning and sharing links. HIPAA eligibility depends on each vendor's plan and BAA. For example, Dropbox signs a BAA only on paid team plans, and Box signs one only for Enterprise, Enterprise Plus and Enterprise Advanced customers; Google and Microsoft also offer BAAs, so check which plans qualify before storing PHI. (help.dropbox.com)

Patient-facing document exchange. Sending forms, results or records to patients is handled by patient portals or your EHR. It is a separate category.

Use case	Tool category	Questions to ask the vendor
Staff share a procedure, form or photo while discussing work	Internal team chat with file sharing	Is a BAA available on this plan? Can roles limit which channels see which files?
Nightly claim or lab file transfers between systems	SFTP / managed file transfer	Do you support automated, scheduled transfers? What transfer logs do you keep?
Long-term document library with folders and versioning	Cloud storage	Which plan includes a BAA? How are sharing links restricted?
Sending documents to patients	Patient portal or EHR	Is patient identity verified? Is the exchange covered by your BAA?

For a side-by-side view of chat tools, see team chat tools compared on HIPAA.

Is there free HIPAA-compliant file sharing?

The BAA is what matters, and many vendors only sign one on paid plans. Dropbox, Box and Chanty, for example, offer a BAA only on paid or business plans, not on free tiers. (help.dropbox.com) A free plan without a BAA is not a HIPAA-compliant option for PHI, however good its encryption is.

Chanty Free plan: no BAA is available. Do not store PHI on it. It is useful for trying the workspace with non-PHI content, such as building channels, testing the mobile apps or sharing a front desk script. It is limited to 5 members, 10 integrations and 20 GB per team.

Chanty Business plan: this is where HIPAA coverage and a signed BAA start. Business costs $3 per user per month billed annually, or $4 billed monthly. (chanty.com) Enterprise also includes a BAA and adds a negotiated MSA.

How file sharing works in Chanty

Files live where the work is discussed. That way staff do not have to hunt across email, a shared drive and a group text to find the latest version. (For the full feature set, see all Chanty features for healthcare teams.)

Share files in any conversation. Attach files in team chats, private conversations and one-on-one messages. The file stays next to the discussion about it. A front desk lead posts a revised check-in checklist in the #front-desk channel, and the questions about it land in the same thread. Chat and files work together as part of HIPAA-compliant chat for staff. Images, PDFs, videos and Office documents preview inside the app.

[Screenshot: file shared in a team conversation, non-PHI sample data]

Find files in Teambook. Teambook gathers files, links, pinned messages, tasks and conversations in one hub. A new medical assistant can open it and find the current rooming procedure without scrolling back three months.

[Screenshot: Teambook file view, non-PHI sample data]

Pin what everyone needs. Pin key documents in announcement channels for every location. Good candidates include the phone tree, the after-hours escalation contact list, front desk scripts and the current holiday schedule.

Turn a file into work with an owner. When a file needs action, turn a shared file into an assigned task in one click. For example: "Review updated intake form by Friday," assigned to the practice administrator, with a due date and status on the Kanban board.

[Screenshot: task created from a message with an attached file, non-PHI sample data]

Open files anywhere. Apps for iOS, Android, macOS, Windows and web let deskless and mobile staff open and share files from the floor or between locations. Message history is unlimited and searchable on all plans, so a file shared last year is still findable. When a document needs a live walkthrough, staff can switch to HIPAA-compliant video calls for staff.

Security and compliance controls for shared files

Control	Free	Business	Enterprise
HIPAA compliance with signed BAA	No	Yes	Yes, plus negotiated MSA
Encryption in transit (TLS 1.2+) and encrypted file storage	Yes	Yes	Yes
Roles and permissions (120+ settings)	No	Customizable roles	Unlimited custom roles
Retention settings	No	Yes	Yes
2FA, SSO, IP allowlisting	No	Yes	Yes
SAML SSO, directory sync, SCIM provisioning	No	No	Yes
DLP and governance controls	No	No	Yes
Data residency (US, EU, APAC) and on-premise	No	No	Yes

Encryption. Data is encrypted in transit with TLS 1.2+ (forward secrecy, AES-128-GCM), and file storage is encrypted. Chanty does not offer end-to-end encryption.

Roles and retention. Permission settings control what each person can see and do. You can limit file sharing in sensitive channels or keep billing conversations visible only to the billing team. Business includes customizable data retention policies for how long conversations and files are kept, and Enterprise adds custom retention with DLP and governance controls. (chanty.com)

Logging. The audit trail Chanty documents covers AI agent actions on the Enterprise plan. Chanty says every AI agent action is logged in a real-time trail; it does not document logging of file access or downloads, or tie this trail to a specific plan. (chanty.com)

Hosting. Chanty runs on Amazon Web Services. Plans below Enterprise have no regional commitment. Chanty holds SOC 2 Type II and ISO/IEC 27001:2022 certifications covering the Chanty services, and the reports are available on request.

For the full breakdown, read Chanty security, HIPAA and BAA details.

What Chanty file sharing is not for

• Not SFTP, FTP or managed file transfer. Use a dedicated transfer service for bulk or system-to-system transfers to payers, labs or clearinghouses.
• Not for patients. Chanty is internal staff communication. Send documents to patients through your patient portal or EHR.
• Not an EHR or clinical documentation system. Clinical records, including clinical images, belong in your EHR/EMR. Operational photos fit in Chanty, such as a damaged autoclave, an empty supply shelf or a leaking ceiling tile.
• Connected storage is outside Chanty's BAA. Files in Google Drive, Dropbox, OneDrive or Box are governed by that vendor's terms. Each needs its own BAA before PHI goes there.
• Guests need a deliberate decision. Guest access limits contractors, IT vendors and consultants to the conversations they are added to. Decide case by case whether a guest should ever see PHI, and enforce it through roles and policy.
• AI agents are a separate question. Agents are available only on Enterprise. BAA coverage of agent processing and external models is not documented, so do not route files containing PHI to agents unless your BAA explicitly confirms it.

Looking for a HIPAA-compliant Dropbox alternative?

The right tool depends on how your staff use files.

• Use a dedicated storage tool when you need a large, structured document library with deep folder hierarchies, versioning and long-term archives.
• Use Chanty when most files are shared as part of staff conversations and follow-up tasks, such as procedures, forms, screenshots, schedules and photos.

Many practices use both. Chanty integrates with Google Drive, Dropbox, OneDrive and Box for file sharing and previews inside conversations. The storage vendor's BAA, not Chanty's, governs any file stored in that vendor's service. Check which of that vendor's plans includes a BAA before you store PHI there.

For vendor-by-vendor answers, see Is it HIPAA compliant? Popular tools checked.

Setting up HIPAA-ready file sharing in Chanty

1. Choose Business or Enterprise and sign the BAA before anyone shares PHI. Until then, treat the workspace as non-PHI only.
2. Configure roles. Decide who can share files in which channels, which channels are private to billing, clinical leads or HR, and how guests are limited. Set retention to match your records policy.
3. Lock down access. Turn on 2FA or SSO and add IP allowlisting where your IT policy requires it. On Enterprise, connect SCIM so accounts are removed when HR offboards someone.
4. Plan offboarding. Remove access the same day staff leave, and include personal devices with the Chanty app installed in your checklist.
5. Write a one-page staff policy. Cover what can be shared, the minimum necessary PHI, no work files on personal messengers, phone photo rules, and device security (screen lock, OS updates). Start from our free HIPAA policy templates.

Ready to set it up? Start a workspace and use the Business plan for anything involving PHI.

FAQ

Is Chanty file sharing HIPAA compliant?

Yes, on the Business and Enterprise plans with a signed BAA, provided your practice configures access and policies correctly. The Free plan has no BAA.

Is there a free HIPAA-compliant file sharing option in Chanty?

No. The Free plan does not include a BAA and should not be used for PHI. It is suitable for testing the workspace with non-PHI content.

Can I use Chanty to send files to patients?

No. Chanty is for internal staff communication only. It is not for patient messaging or document exchange.

Is Chanty an SFTP or managed file transfer (MFT) service?

No. Chanty is team chat with file sharing for staff. Use a dedicated transfer service for bulk or system-to-system transfers.

Are files encrypted?

Yes. Files are encrypted in transit with TLS 1.2+ and stored in encrypted file storage. Chanty does not claim end-to-end encryption.

Are files I share from Google Drive or Dropbox covered by Chanty's BAA?

No. Third-party integrations are outside Chanty's BAA scope. You need a BAA with that vendor before storing PHI there.

Can staff share photos from their phones?

Yes, through the iOS and Android apps. Set a policy on whether photos may contain PHI, keep clinical images in your EHR, and require basic device security.

Can outside contractors see shared files?

Guests only see the conversations they are added to. Control what they can access with roles and your own policy.

How much storage do I get?

The Free plan includes 20 GB per team. Business includes 20 GB per user, and Enterprise offers custom storage capacity. (chanty.com)