Last verified: October 2026, against Apple's iCloud Terms and Conditions (last revised September 14, 2026). General information, not legal advice — confirm with your compliance officer or attorney.
iCloud and HIPAA don't mix, and Apple says so in writing. Apple doesn't offer a business associate agreement (BAA) for iCloud, and its terms tell covered entities and business associates not to use iCloud for protected health information (PHI) at all. For a practice, the real job is keeping patient information off the iCloud accounts on staff phones and Macs.
Short answer: iCloud HIPAA terms from Apple's own documentation
Short answer (verified October 2026): Apple's iCloud Terms and Conditions (opens in a new tab), under "Limitations on Use," say that if you are "a covered entity, business associate or representative of a covered entity or business associate," you agree "you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any 'protected health information'," or "use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party's business associate." We found no Apple page offering a BAA for iCloud.
That's stronger than "no BAA available." Putting PHI in iCloud means using Apple's service against its own terms, with no contract protecting the data.
People look this up often: "icloud hipaa" gets about 210 searches a month in the US, at a CPC of $27.27 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
HIPAA's test is whether a vendor will "create, receive, maintain, or transmit protected health information" for you (45 CFR 164.502(e) (opens in a new tab)). iCloud Photos and iCloud Backup do the "maintain" part the moment a clinical photo syncs. That requires "satisfactory assurance" in a written contract meeting 45 CFR 164.504(e) (opens in a new tab), which, among other things, makes the vendor return or destroy the information when the relationship ends. Our guide to business associate agreements explains the rest; Apple's terms rule such a contract out.
Encryption doesn't remove the need. HHS's cloud computing guidance (opens in a new tab) says storing encrypted data without the key "does not exempt a CSP from business associate status," and that using a cloud provider to maintain electronic PHI without a BAA violates the HIPAA Rules. So Apple's Advanced Data Protection, useful as it is, doesn't make iCloud usable for PHI.
And where a BAA does exist, it's still only the start: configuration, access and staff habits decide whether a tool is used compliantly.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which iCloud plans a BAA can cover
None. The same terms govern every version of the service.
| iCloud option | Covered by these terms? | BAA available? |
|---|---|---|
| Free iCloud account | Yes | No |
| iCloud+ storage plans (Section III) | Yes | No |
| Advanced Data Protection (Section II.J) | Yes | No |
The terms also say iCloud is "designed and intended for personal use on an individual basis." Apple's separate Apple Business terms (opens in a new tab) page didn't show its text when we checked, so we make no claim about business-managed accounts. If Apple ever publishes a BAA, this page will change.
Staff phones: photos, notes and backups
In a practice, the iCloud question usually starts with personal iPhones. The iCloud terms cover iCloud Photos, iCloud Drive and iCloud Backup, and each one can quietly copy PHI off the phone:
- Photos. A wound photo, a rash, a before-and-after shot or a picture of an insurance card taken with the Camera app lands in the photo library. With iCloud Photos on, it syncs to Apple's servers and every device on that account.
- Screenshots. A screenshot of the day's schedule or a lab portal is just another photo.
- Notes. A quick note with a patient's name and callback reason syncs like any other note.
- Backups. iCloud Backup can copy the phone's data, including any of the above, to Apple.
- Messages. Texts with patients sit on the phone, and its backups. See our texting guide for what belongs in a text.
Video calls raise a related question; see facetime.
Safe uses and unsafe uses for a practice
| Use | Safe? | Why |
|---|---|---|
| Staff's personal photos and backups | Yes | No patient information |
| Office photos and marketing drafts with no patients in them | Yes | No PHI |
| Clinical photos on a personal iPhone with iCloud Photos on | No | PHI synced to Apple without a BAA |
| Scans of referrals or insurance cards in iCloud Drive | No | Same |
| Patient callback lists in Notes | No | Same |
| Before-and-after images for marketing, even with authorization | No | The authorization covers use in marketing, not storage in iCloud |
Safer setup or alternatives
- Write a one-line policy: no patient photos, documents or notes on any personal iCloud account.
- Give clinical photos a covered home. If your EHR has a mobile app that sends images straight to the chart, use it instead of the Camera app.
- Clean up what's there. Ask staff to move existing clinical images into the chart and delete them from the phone, including Recently Deleted.
- Use practice-owned devices for anything clinical, with iCloud sync turned off for those workflows.
- Pick covered storage for files. Google lists Google Drive in the Workspace services covered by its BAA (Google (opens in a new tab)), and Microsoft lists OneDrive for Business and SharePoint Online for commercial subscriptions (Microsoft Learn (opens in a new tab)).
For the rest of a practice's everyday tools, start at HIPAA and everyday tools.
Medfy doesn't store files or photos for practices. What it does hold is the patient information that arrives through your website's forms and chat, kept in separate, encrypted HIPAA databases in the US or Canada and covered by the BAA Medfy signs with each practice; see how Medfy handles patient data. A free marketing audit checks your site for privacy risks such as tracking pixels on patient forms.
Frequently asked questions
Will iCloud sign a BAA?
No. As of October 2026, Apple's iCloud Terms and Conditions go further than declining: a covered entity or business associate agrees not to use any part of iCloud to create, receive, maintain or transmit protected health information, or in any way that would make Apple its business associate. We found no Apple page offering a BAA for iCloud. Keep patient information out of it and confirm your policy with your compliance officer.
Is the free version of iCloud HIPAA compliant?
No, and paying doesn't change that. The same iCloud Terms and Conditions cover the free service and iCloud+ subscriptions, and the limitation on protected health information applies to the whole service. A bigger storage plan or Advanced Data Protection doesn't create a BAA. Practices need a different, covered storage service for anything that identifies a patient.
Can a practice use iCloud without patient information?
Yes. Staff can use iCloud on their phones for personal photos, contacts and backups, and a practice can use it for things like office photos or marketing drafts with no patient details. The work is keeping patient information from drifting in: clinical photos, insurance cards, screenshots of schedules, notes about patients and texts with patients can all sync to iCloud.
What is a HIPAA-compliant alternative to iCloud?
Use storage whose vendor signs a BAA with your practice. Google lists Google Drive among the Workspace services in its BAA, and Microsoft lists OneDrive for Business and SharePoint Online for commercial subscriptions. If your EHR has a mobile app, it's the cleanest route for clinical photos because images go straight into the chart. Confirm the plan and settings with your compliance officer.