Conditional Last verified 2026-10-28. A BAA is available on request for Carbonite Safe Backup Pro and Carbonite Safe Server Backup. The main exclusion is consumer Carbonite Safe and the free and evaluation services, whose terms prohibit PHI.
Short answer
Carbonite's help article supports a business associate agreement (BAA) for Carbonite Safe Backup Pro and Carbonite Safe Server Backup. You get it through Carbonite sales or by emailing [email protected]. It is not automatic, and it is not included by default. Carbonite says the BAA is based on the federal standard template.
Carbonite's Product Terms point the other way for everything else. They disclaim HIPAA and prohibit use with protected health information (PHI) unless a BAA is in place. For consumer Carbonite Safe, no BAA is offered, so PHI stays out. Both sources are quoted in the Sources section so you can see the conflict yourself. For terms used here, see the HIPAA glossary (BAA, PHI). For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Safe Backup Pro (Core, Power, Ultimate) | Available on request | New or trial customers call sales at 855-227-2249; existing customers email [email protected] | Not published by the vendor |
| Safe Server Backup | Available on request | Contact sales or email [email protected] | Not published by the vendor |
| Carbonite Safe (consumer) | Not available; terms prohibit PHI | Not applicable | Not published by the vendor |
| Free and evaluation services | Not available; terms prohibit PHI | Not applicable | Not published by the vendor |
A practice that started on a Pro trial should request the BAA before the first PHI-bearing backup runs, not at conversion to a paid plan.
What the BAA covers and what it excludes
BAA available on plan X for services Y:
Covered
- Carbonite Safe Backup Pro
- Carbonite Safe Server Backup
Excluded
- Carbonite Safe consumer plans. The terms prohibit PHI.
- Free and pre-release evaluation services. The terms prohibit PHI.
In practice, a clinic's front-desk PC that was set up years ago on a consumer Carbonite Safe account is outside the BAA. The same applies to a free trial of a business product that has not yet been moved under a signed agreement. Check which plan each machine is enrolled in before assuming coverage.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Carbonite does not publish algorithm or key-management details for encryption, so an evaluator cannot assess those from public material. If your risk analysis needs audit logs, SSO or a third-party attestation, ask Carbonite for them in writing during the BAA request.
How to use Carbonite with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the vendor alone. A practical checklist:
- Confirm the account is Safe Backup Pro or Safe Server Backup, not consumer Carbonite Safe.
- Request the BAA (sales line for new or trial customers, [email protected] for existing ones) and sign it before any PHI is backed up.
- Keep PHI off consumer and evaluation accounts. Inventory every workstation and server enrolled, including ones set up by a former IT contractor.
- Set up who can access the backup account and remove access the day a staff member or MSP technician leaves.
- Limit which devices are enrolled and secure them: screen locks, disk encryption and patching are your responsibility.
- Put backup handling in your written staff policies and training, including who may restore data and where.
- Record Carbonite, the plan, the BAA date and the covered services in your vendor inventory.
Alternatives with a BAA
All four are conditional, and the condition is the plan.
- Backblaze: conditional, B2 Cloud Storage for business customers.
- Is Dropbox HIPAA compliant?: conditional, Standard plan.
- Is Google Drive HIPAA compliant?: conditional, Google Workspace paid editions.
- Is OneDrive HIPAA compliant?: conditional, Office 365 and Microsoft 365 commercial subscriptions.
To compare more tools by category, see HIPAA-compliant software by category.
Sources
- Are Carbonite Safe Backup Pro plans HIPAA compliant? | Carbonite Support — Help article, checked 2026-10-28. "All Carbonite Safe Pro plans support HIPAA compliance. … we can provide a Business Associate Agreement (BAA). Please contact our Sales team at 855-227-2249 or [email protected] to request a BAA."
- Product Terms of Service | Carbonite — Terms, checked 2026-10-28. "Carbonite makes no representations that the Products and Services satisfy HIPAA requirements … (iii) you agree not to use the Products and Services in connection with any Protected Health Information"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. For the wider log, see Recent changes in vendor HIPAA status.
FAQ
Does Carbonite sign a BAA?
Yes, for Carbonite Safe Backup Pro and Carbonite Safe Server Backup, on request. It is not automatic and not included by default.
Can I store PHI in consumer Carbonite Safe?
No. No BAA is available for consumer Carbonite Safe, and its terms disclaim HIPAA and prohibit use with PHI.
How do I request a Carbonite BAA?
New or trial Pro customers call sales at 855-227-2249. Existing customers email [email protected]. Whether the BAA carries an extra cost is not published by the vendor.
Is Carbonite Safe Server Backup covered by the BAA?
Yes. Safe Server Backup is one of the two services for which a BAA is available on request, alongside Safe Backup Pro.