Conditional A BAA is available on Box Enterprise, Enterprise Plus and Enterprise Advanced for the Box content cloud. Business and Business Plus are not listed as BAA-eligible. Verified 2026-10-19. For other tools, see Is it HIPAA compliant? All vendors.
This page reports Box's published terms, not an audit and not legal advice. Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc.; Chanty has no connection to this entry.
Short answer
Box offers a BAA for the Box content cloud on the three Enterprise tiers. An admin requests it from the Admin Console. Business, Business Plus and Individual/Personal plans are outside it. Box Shield and Box KeySafe are optional paid add-ons.
Box's help article says a signed BAA should be in place before PHI is stored:.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Enterprise | Available | Admin Console request (steps below) | Not published by the vendor |
| Enterprise Plus | Available | Admin Console request | Not published by the vendor |
| Enterprise Advanced | Available | Admin Console request | Not published by the vendor |
| Business | Not available / not listed as BAA-eligible | None | n/a |
| Business Plus | Not available / not listed as BAA-eligible | None | n/a |
| Individual / Personal | Not available / not listed as BAA-eligible | None | n/a |
Requesting the BAA on an Enterprise tier:
- An admin or co-admin opens Admin Console > Account & Billing > HIPAA Compliance > Request a HIPAA BAA.
- They complete the form: organization, signer, and whether the organization is a covered entity or a business associate.
- Box Legal Operations emails the addendum within 3-5 business days.
Box's pricing page lists a minimum of 3 seats.
A clinic on Business Plus therefore cannot get a BAA by changing settings. It has to move to an Enterprise tier first.
What the BAA covers and what it excludes
Covered: the Box content cloud on Enterprise, Enterprise Plus and Enterprise Advanced accounts.
Excluded: the sources checked publish no list of excluded features. Business, Business Plus and Individual plans fall outside the BAA.
Box Shield and Box KeySafe are optional paid add-ons. They are not part of the baseline BAA requirement, and this page does not treat them as required for HIPAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Box Zones: customer selects a region or country for content at rest |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
For data residency, Box Zones lets customers choose a region or country for content at rest.
How to use Box with PHI
A BAA only covers the vendor's side. Terms such as BAA and PHI are defined in the HIPAA glossary. Before a billing office or referral coordinator moves PHI into Box, work through this checklist:
- Confirm the plan. The account must be Enterprise, Enterprise Plus or Enterprise Advanced.
- Sign first. Request the BAA and have it signed before any PHI is uploaded. Migrating existing shared folders counts as uploading.
- Configure access and sharing. Set collaboration and shared-link settings, and turn on SSO and MFA for every user. Box does not publish an access-control model, so document your own.
- Use the audit log. Assign someone to review it on a schedule, for example after a departing employee's last day.
- Decide on Zones and add-ons. Choose a storage region if your policy requires one. Evaluate Shield and KeySafe against your risk analysis.
- Train staff and write policy. Cover what may be stored, who may share externally, and offboarding.
Compliance depends on the signed BAA, your configuration and your organization's own policies.
Box for AI: the sources checked do not state whether the BAA covers Box's AI features. Treat that as not published by the vendor and confirm in writing with Box before any PHI goes near them. The same applies to third-party integrations, which are not shown as covered.
Alternatives with a BAA
Other vendors with a conditional verdict:
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Adobe Acrobat | Conditional | Acrobat Sign Solutions for enterprise |
| Adobe Acrobat Sign | Conditional | Acrobat Sign Solutions for enterprise |
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) |
| Backblaze | Conditional | B2 Cloud Storage (business customers) |
| DocHub | Conditional | Site License |
Related file-sharing and storage checks: Is Dropbox HIPAA compliant?, Is Google Drive HIPAA compliant? and Is OneDrive HIPAA compliant?.
Browse by category in HIPAA-compliant software by category: file sharing, storage and document management.
Sources
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "signs BAA addendums to with its customers who have an Enterprise, Enterprise Plus, or Enterprise Advanced account"
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "A signed BAA should be in place between Box and the customer prior to storing any Protected Health Information (PHI) on Box."
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "from the Box Admin Console, click Account & Billing, and scroll down (if necessary) to the HIPAA Compliance section."
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "Data encryption in transit and at rest"
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "Reporting and audit trail of account activities on both users and content"
- Box HIPAA and HITECH Overview and FAQ — Help article, checked 2026-10-19. "Additionally, Box is ISO 27001 certified"
- Box Plans & Pricing — Pricing page, checked 2026-10-19. "HIPAA, SOC 1/2/3 compliance support"
- Box Plans & Pricing — Pricing page, checked 2026-10-19. "minimum of 3 users"
- Box Trust Center – Security and Compliance — Trust center, checked 2026-10-19. "Box uses TLS 1.3 as the standard protocol to encrypt content uploaded to Box in transit."
- Box Trust Center – Security and Compliance — Trust center, checked 2026-10-19. "Zones allows customers to store their content (at rest) in a specific region or even country."
- Box Security & Compliance — Trust center, checked 2026-10-19. "Strong user authentication via SSO and MFA"
- Box Security & Compliance — Trust center, checked 2026-10-19. "With Box Keysafe, you maintain complete, independent control of your encryption keys."
- Box Security & Compliance — Trust center, checked 2026-10-19. "Box Shield and Shield Pro give your organization the intelligence to protect content, detect threats"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Box HIPAA compliant?
Conditional. A BAA is available on Enterprise, Enterprise Plus and Enterprise Advanced for the Box content cloud. HIPAA status depends on the signed BAA, your configuration and your policies, not on the product alone.
Does Box sign a BAA on its Business or Business Plus plan?
Not per the sources checked. Business and Business Plus are not listed as BAA-eligible, so an organization on either plan should not store PHI in Box.
How do I request a HIPAA BAA from Box?
An admin or co-admin on an Enterprise-tier account goes to Admin Console > Account & Billing > HIPAA Compliance > Request a HIPAA BAA and completes the form. Box Legal Operations emails the addendum within 3-5 business days. The BAA's cost is not published by the vendor.
Is Box HIPAA compliant for AI features?
Not published by the vendor. The sources checked do not state whether Box's AI features are covered by the BAA. Get written confirmation from Box before using them with PHI.