Last verified: October 2026, against the Dropbox Help Center and Box's own HIPAA and pricing pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is Dropbox HIPAA compliant? No file-sharing tool is compliant on its own, but Dropbox will sign a business associate agreement (BAA) for its team plans, and Box says it signs one with every client that plans to store protected health information (PHI). Whether your practice is covered depends on the plan you pay for, whether an admin actually signed, and how your links and devices are set up.
Is Dropbox HIPAA compliant? Short answer for Dropbox and Box
Short answer (verified October 2026): Dropbox's HIPAA/HITECH help article (opens in a new tab) says "a BAA must be in place before you transfer PHI into your Dropbox account." It applies to "certain teams" on Dropbox Standard, Advanced, Enterprise, Education, Business, Business Plus and Dropbox Sign. Team admins sign the BAA electronically in the admin console, which is "available only to US-based customers." Third-party apps and integrations aren't covered, and "Dash doesn't support compliance with HIPAA."
Box (verified October 2026): Box's HIPAA compliance page (opens in a new tab) says "Box signs Business Associate Agreements (BAAs) with all clients who plan to store PHI in the cloud" and that "healthcare organizations are responsible for configuring Box in a HIPAA-compliant manner." It doesn't describe a request process beyond contacting sales. Box's pricing page (opens in a new tab) lists HIPAA compliance support on the Enterprise and Enterprise Plus plans.
As Dropbox puts it, "There is no official HIPAA/HITECH certification." What counts is a signed BAA on the right plan.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which plans include a BAA
| Item | Dropbox | Box |
|---|---|---|
| Plans tied to HIPAA | Standard, Business, Advanced, Business Plus, Enterprise (the HIPAA article also names Education and Dropbox Sign) | Enterprise and Enterprise Plus (pricing cards) |
| Plans not named | Personal plans | Individual (free), Personal Pro, Business Starter; Business and Business Plus cards list SOC compliance only |
| How you get the BAA | Admin console: Settings, then Account, Team profile, Advanced, "Set up BAA" (Dropbox BAA article (opens in a new tab)) | Not published; Box points to sales |
| Not covered | Third-party apps and integrations; Dash | Not listed on Box's page |
Three practical notes before you upload anything:
- Check who sells you the plan. Once your team signs a BAA, Dropbox says "you can't enable reseller support."
- Audit connected apps. Third-party integrations are "not covered by your Dropbox terms of use, including a BAA." A scanning app linked to a PHI folder needs its own BAA.
- File the signed copy. Keep it with your other vendor agreements. For what the agreement itself must say, see BAA requirements.
Personal accounts and synced devices
A personal Dropbox account has no BAA with your practice. Dropbox's HIPAA article covers team plans only, and Box's individual plans don't mention HIPAA. A referral packet moved into a personal account to finish at home is PHI somewhere your practice has no contract.
Synced folders create the same problem on hardware: a PHI folder synced to a family laptop is PHI on a device you don't control. Use device approvals, sync PHI folders only to practice-owned machines, and remove a departing employee's devices the day they leave.
If PHI has already landed in a personal account, treat it as an incident and check your breach notification obligations.
Keep marketing assets and PHI apart
Before-and-after photos, testimonial originals and the signed forms behind them are PHI. They belong in a restricted folder on a covered plan, visible to the marketing lead and one clinical lead, never in a personal account or a designer's own Dropbox.
Under 45 CFR 164.508 (opens in a new tab), using a patient's image or story in marketing needs a signed authorization; see authorization for patient photos. Only images with a signed authorization move to the folder your agency can see.
Illustrative example: A fictional dermatology practice keeps two Dropbox team folders. "Clinical photos" is restricted to two people, with no shared links. "Marketing approved" holds only images whose authorization is on file, and is the only folder shared with its agency.
Medfy doesn't sell file-sharing tools. On the website side, patient data from forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice for its own services. See how Medfy handles patient data. A free marketing audit flags privacy risks such as tracking pixels on your patient forms.
Frequently asked questions
Does Dropbox sign a BAA?
Yes, for team plans. As of October 2026, Dropbox's help center says admins on Standard, Business, Advanced, Business Plus and Enterprise teams can sign a BAA in the admin console, and electronic signing is for US-based customers only. Personal plans aren't listed, and third-party apps connected to Dropbox aren't covered. Sign before any PHI is uploaded, keep a copy, and confirm the setup with your compliance officer or attorney.
Is Box better than Dropbox for HIPAA?
Neither is better by default. Box says it signs a BAA with every client that plans to store PHI and lists HIPAA compliance support on its Enterprise and Enterprise Plus plans. Dropbox offers a self-serve BAA on its team plans. The deciding factors are the plan you would need, its price, and which admin controls your team will actually use. Get the BAA in writing and check the choice with your compliance officer or attorney.
Can we send patient records with a Dropbox link?
Yes, if your team plan is covered by a signed BAA and the link is locked down: shared with specific people rather than anyone, password-protected, set to expire and sent to the right address. Give the password by phone, not in the same email. Never use a personal account. For routine record requests, your EHR's patient portal is often simpler. Confirm the process with your compliance officer or attorney.
Is a personal Dropbox account ever OK for PHI?
No. Dropbox's HIPAA article covers team plans only, and a personal account has no BAA with your practice. That includes quick shortcuts such as a referral packet uploaded from home or clinical photos synced from a staff phone. If PHI is already in a personal account, move it to a covered account, delete the copy, and ask your compliance officer or attorney whether breach notification applies.