Backblaze offers a business associate agreement (BAA) on request to business customers that are HIPAA covered entities, for B2 Cloud Storage and Business Backup. Personal backup accounts and the free 10 GB B2 tier are not addressed in the vendor's published terms.
Is Backblaze HIPAA compliant? Verdict: conditional
Conditional A BAA is available on request for business customers that are HIPAA covered entities (B2 Cloud Storage and Business Backup); the main exclusion is personal accounts and the free 10 GB B2 tier, which the vendor does not address. Checked 2026-10-28.
Short answer
Backblaze publishes that a BAA is available on request for B2 Cloud Storage and Business Backup, for business customers that are covered entities. It does not state BAA terms for personal accounts or the free B2 tier, so treat those as not covered.
A signed BAA is a precondition for putting PHI in any cloud service. This page reports the vendor's published terms. It is a reference, not legal advice. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
Check the terms against the HIPAA glossary (BAA, covered entity) if you are unsure whether your organization qualifies.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| B2 Cloud Storage (business customers) | Available | On request to Backblaze, for covered-entity business customers | Not published by the vendor |
| Business Backup (business customers) | Available | On request to Backblaze, for covered-entity business customers | Not published by the vendor |
| Personal backup accounts and the free 10 GB B2 tier | Not addressed | Not stated by the vendor | Not applicable |
B2 pricing starts at $6.95/TB/month, pay as you go. This is pricing context only. It is not the cost of a BAA, and the vendor publishes no separate BAA price.
What the BAA covers and what it excludes
Covered:
- B2 Cloud Storage
- Computer Backup (Business)
Excluded (not addressed; the BAA is offered to business customers only):
- Personal Backup accounts
- The free B2 tier
This page does not extend the BAA to any other Backblaze product. If a service is not named in the vendor's published terms, ask Backblaze in writing before it holds PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
These are the controls the vendor states. Listing them does not mean they satisfy any HIPAA requirement; that judgment belongs in your own risk analysis. A control marked "Not published" may exist, but this check cannot confirm it. Ask Backblaze directly if your policy requires one, such as audit logs for access to a backup of imaging files.
How to use Backblaze with PHI
Responsibility is shared between the vendor and your organization. A checklist for a clinic or an MSP:
- Sign the BAA before uploading any PHI, including test restores from a real patient database.
- Confirm your organization is a covered entity or business associate and that the account is a business account.
- Limit access with roles and access controls, so only the staff who run backups can reach the storage.
- Manage offboarding: remove access when an IT contractor or front-desk administrator leaves.
- Keep PHI off personal accounts and the free B2 tier, such as a staff member's home backup of a work laptop.
- Record Backblaze in your vendor inventory and risk analysis, with the plan, the BAA date and the services in scope.
- Train staff on what may be backed up and where.
Compliance depends on the signed BAA, your configuration and your policies, not on the vendor alone.
Alternatives with a BAA
Verdicts below are as listed on this site. The order is alphabetical and implies no ranking.
- Amazon Web Services: conditional, BAA on all AWS accounts. See Is AWS HIPAA compliant?
- Box: conditional, Enterprise plan. See Is Box HIPAA compliant?
- Carbonite: conditional, Safe Backup Pro Core, Power and Ultimate.
- Dropbox: conditional, Standard plan. See Is Dropbox HIPAA compliant?
- Google Cloud Platform: yes, all accounts.
For side-by-side tables, see HIPAA-compliant backup software and HIPAA-compliant cloud storage.
Sources
- Cloud Regulatory Compliance | Backblaze — Trust center, checked 2026-10-28. "Yes. Backblaze can provide a Business Associate Agreement (BAA) upon request for business customers who are Covered Entities under HIPAA."
- Cloud Regulatory Compliance | Backblaze — Trust center, checked 2026-10-28. "has achieved Service Organization Control (SOC) 2 Type 2 compliance by an independent third-party firm."
- Cloud Storage Pricing | Backblaze — Pricing page, checked 2026-10-28. "Starts at $6.95 / TB / mo."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Backblaze sign a BAA?
Yes, for business customers that are HIPAA covered entities. The vendor's published terms cover B2 Cloud Storage and Business Backup, and the BAA is available on request.
Is a BAA available for Backblaze personal backup or the free 10 GB B2 tier?
Backblaze does not state BAA terms for either. The BAA is offered to business customers, so treat personal backup accounts and the free B2 tier as not covered and keep PHI off them.
Does Backblaze have a SOC 2 report?
The vendor's compliance page states SOC 2 Type 2. A SOC 2 report is not a HIPAA attestation and does not replace a BAA.
How do I request a Backblaze BAA?
Request it from Backblaze as a business customer that is a covered entity. The vendor publishes no extra cost for the BAA. Get it signed before any PHI is uploaded.