HIPAA compliant cloud storage
Where documents containing patient information end up. Sharing settings and connected third-party apps are the recurring gap.
Storage is where documents drift. A scanned referral goes into a folder, a link is shared to move it along, and the link keeps working long after the person who needed it has gone. Public or anyone-with-the-link sharing is the failure mode that recurs, because it is a two-click action available to every staff member and it leaves behind nothing that looks like a mistake.
Connected applications are the other half. A storage account is usually the hub every other tool plugs into, and vendors here are consistent in placing those third-party connections outside the agreement, which means coverage effectively ends the moment a file syncs somewhere else. A workable product gives an administrator real control: restrict external sharing, expire links, allowlist connected apps, prevent permanent deletion, and show an audit trail of who opened what.
6 file storage and sharing tools compared
6 of 6 can be used with patient information under a signed agreement.
| Vendor | Verdict | Agreement and plan | How to get it | Not covered | Reviewed |
|---|---|---|---|---|---|
| BoxBox (Enterprise, Enterprise Plus, Enterprise Advanced) | Conditional | Box Enterprise, Enterprise Plus or Enterprise Advanced | Admin Console → Account & Billing → HIPAA Compliance → 'Request a HIPAA BAA' → complete the form → Continue. | Box Personal, Starter and Business accounts. | |
| DropboxDropbox team accounts | Conditional | Team plans: Standard, Advanced, Business, Business Plus, Enterprise, Education and Dropbox Sign. | US customers: Admin console → Settings → Account → Team profile → Advanced → 'Set up BAA'. Outside the US: email sales@dropbox.com. | Dropbox Dash. Dropbox states Dash does not support compliance with HIPAA, including Dash in Dropbox. | |
| Google DriveGoogle Drive on Google Workspace or Cloud Identity | Conditional | Google Workspace or Cloud Identity. Google scopes coverage by service through Included Functionality rather than by subscription tier. | Nothing to request and no signature to chase: a super administrator accepts it in the Admin console under Account settings → Legal and compliance. | Drive on a personal Google account. The amendment is accepted in the Admin console, which a consumer account does not have. | |
| OneDriveOneDrive for Business | Conditional | Applies by default to business and government Online Services customers. Coverage is scoped by service, not subscription tier. | Nothing to request. Download the agreement from the Service Trust Portal. | Consumer OneDrive on a personal Microsoft account: Microsoft's list names 'OneDrive for Business' specifically. | |
| SpiderOakSpiderOak encrypted backup and storage | Conditional | Not stated. SpiderOak names no plan, and qualifies its support to 'certain customers'. | SpiderOak's HIPAA page points to information on how to request a SpiderOak business associate agreement. Confirm eligibility for your account and product before relying on it. | Customers SpiderOak does not accept. Its own wording limits support to certain customers. | |
| TresoritTresorit encrypted cloud storage | Conditional | Not stated. Tresorit's security page says it signs agreements with customers seeking HIPAA compliance without naming a plan. | Not described on the security page beyond the statement that Tresorit signs them. Request it through Tresorit sales or support before uploading patient data. | Anything you copy out of Tresorit. The protection is a property of the store, not of the file. |
What to check before you adopt one
- Check whether an administrator can disable public or anyone-with-the-link sharing outright, rather than relying on each staff member to pick the right option every time.
- Ask how permanent deletion works and whether you can stop staff destroying records you are obliged to keep for years.
- Get the vendor's position on connected third-party apps in writing, since storage sits at the centre of everything and these connections are routinely outside scope.
- Confirm the agreement is signed before you migrate, because several vendors state it must be in place before any patient files are transferred in.
- Verify that the audit log records file access and sharing events, and that it is retained at least as long as your own record-keeping obligations.
The expensive mistake
Migrating years of scanned records into a new account first and sorting the paperwork out afterwards. Several vendors state plainly that the agreement must exist before patient files arrive, and a bulk upload is not something you can undo. The same mistake happens on downgrade: moving to a cheaper plan can end coverage while every file stays exactly where it is.