Sharing permissions can be put in place to stop PHI from being shared with any person outside of a team. To avoid a HIPAA violation, sharing permissions should be configured properly to ensure files containing PHI can only be accessed by authorized individuals. Even with a signed BAA, it is possible to breach HIPAA Rules when using Dropbox. It is therefore vital to configure a Dropbox account properly. HIPAA requires healthcare organizations to put in place safeguards to preserve the confidentiality, integrity and availability of PHI.

If third party apps are used with a Dropbox account, covered bodies need to assess those apps separately prior to their being used. A BAA can be submitted electronically via the Account page of the Admin Console.ĭropbox allows third party apps to be used, although it is important to remember that they are not covered by the BAA. To avoid a HIPAA breach, the BAA must be obtained before any file containing PHI is uploaded to a Dropbox account. Dropbox is classified as a business associate so a BAA is necessary.ĭropbox will sign a business associate agreement with HIPAA-covered bodies. The Health Insurance Portability and Accountability Act requires covered bodies to enter into a business associate agreement (BAA) with an organization before any protected health information (PHI) is shared.

That said, healthcare organizations can use Dropbox to share or store files including protected health data without breaching HIPAA Rules. No software or file sharing platform can be HIPAA compliant as it depends on how the software or platform is used by the group in question. Dropbox is a widely-used file hosting service operated by many organizations to share files, but what about protected health information? Is the service HIPAA compliant?ĭropbox beleives it now supports HIPAA and HITECH Act compliance but that does not mean Dropbox is adhering with HIPAA.

Is dropbox business hipaa compliant