Is Box HIPAA compliant?
Yes, if you are on a Box Enterprise-tier account and you request and sign the agreement before any patient files are stored.
Applies to Box (Enterprise, Enterprise Plus, Enterprise Advanced). Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Be on an Enterprise-tier account. Box requires Enterprise, Enterprise Plus or Enterprise Advanced.
- Have the agreement in place first. Box states it should be signed prior to storing any patient information.
- An admin or co-admin requests it: Admin Console → Account & Billing → HIPAA Compliance section → 'Request a HIPAA BAA' → complete the form → Continue. Box sends the addendum by email in three to five business days.
- Configure Box yourself. Box states customers are responsible for configuring Box compliantly and enforcing their own policies.
- If you use a Box partner product that touches patient information, sign a separate agreement with that partner in addition to your agreement with Box.
Does Box sign a business associate agreement?
Yes. Box offers one. Box Enterprise, Enterprise Plus or Enterprise Advanced Admin Console → Account & Billing → HIPAA Compliance → 'Request a HIPAA BAA' → complete the form → Continue.
What this means in practice
Box gates this at the Enterprise tier, and the trap is entirely in the plan names. Box sells a plan called Business, and a practice manager who has been told to buy a business account will reasonably buy it. Business is not eligible; Enterprise, Enterprise Plus and Enterprise Advanced are. Personal and Starter are out too.
The request is not instant either. An admin or co-admin fills in the form in the Admin Console under Account and Billing, and Box emails the addendum back in three to five business days. That is fine if you plan for it and painful if you discover it the week files are due to move, since the agreement is meant to be in place before anything is stored.
After signing, the work is yours. Box is clear that configuring the account and enforcing your own policies sits with the customer, not with Box. And if you use a Box partner product that touches patient information, you need a separate agreement with that partner as well as the one with Box.
How organizations get this wrong
- Buying Box's Business plan because the name sounds right for a business, when only Enterprise, Enterprise Plus and Enterprise Advanced qualify.
- Starting the request the week of go-live and losing three to five business days waiting for Box to email the addendum back.
- Connecting a Box partner product to folders holding patient files without signing a separate agreement with that partner too.
- Treating Box's security reputation as though it does your configuration work, when Box states policy enforcement and setup remain the customer's job.
What the agreement does not cover
- Box Personal, Starter and Business accounts.
- Box partner and third-party integrations, which require their own separate agreement.
Alternatives
Self-serve electronic signing in the admin console, available below the enterprise tier
Amendment accepted instantly in the Admin console with no sales cycle
Keep a record of your Box agreement
Sources
- Box HIPAA and HITECH Overview and FAQ: Box. Read July 29, 2026.
- HIPAA-Compliant File Sharing & Cloud Storage: Box. Read July 29, 2026.
Box can change these terms at any time. If something here no longer matches what Box tells you, tell us.