Conditional A BAA is available on Dropbox team plans (Standard, Advanced, Business, Business Plus, Enterprise, Education) for file storage and sharing; individual plans and Dropbox Dash are excluded. Last verified 2026-10-19.
Short answer
Dropbox offers a BAA on team plans for file storage, sync and sharing. A team admin signs it electronically in the admin console, and electronic signing is available to US-based customers only. See All vendor HIPAA checks for how other tools compare.
Individual plans (Basic, Plus, Essentials) and Dropbox Dash are excluded. Dropbox Sign needs its own BAA on an annual Standard or Premium plan.
Dropbox's help article says the BAA must be in place before PHI is transferred into the account. A clinic that uploads scanned intake forms first and signs afterward has already moved PHI outside the agreement.
Which plans include a BAA
The HIPAA glossary: BAA and PHI defines both terms.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Standard | Yes | Team admin signs in the admin console | Not published by the vendor |
| Advanced | Yes | Team admin signs in the admin console | Not published by the vendor |
| Business | Yes | Team admin signs in the admin console | Not published by the vendor |
| Business Plus | Yes | Team admin signs in the admin console | Not published by the vendor |
| Enterprise | Yes | Team admin signs in the admin console | Not published by the vendor |
| Education | Yes | Team admin signs in the admin console | Not published by the vendor |
| Basic | No | Not available | Not published by the vendor |
| Plus | No | Not available | Not published by the vendor |
| Essentials | No | Not available | Not published by the vendor |
| Family | Not published by the vendor | Not published by the vendor | Not published by the vendor |
| Professional | Not published by the vendor | Not published by the vendor | Not published by the vendor |
To sign, go to Admin console > Settings > Team profile > Advanced > Set up BAA. The signed copy can be downloaded from the same menu.
Electronic signing is for US-based customers only. Teams with a BAA cannot enable reseller support.
What the BAA covers and what it excludes
Covered
- Dropbox team accounts: file storage, sync and sharing. Source: Dropbox BAA help article.
- Dropbox Sign, but only under a separate BAA. It requires an annual Standard or Premium plan and a minimum contract value. Source: Dropbox Sign article.
Excluded
- Dropbox Dash, including Dash in Dropbox. Source: Dropbox BAA help article.
- Third-party apps connected to Dropbox. They are not covered by Dropbox terms or the Dropbox BAA. Source: Dropbox HIPAA/HITECH overview.
In practice, a front desk that connects a scheduling or e-fax app to the practice's Dropbox has created a data path the Dropbox BAA does not reach. That app vendor needs its own BAA before it touches PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
This table reports what Dropbox publishes. It is not an audit by this site.
How to use Dropbox with PHI
- Sign the BAA in the admin console before any PHI enters the account.
- Confirm the account is on a team plan. A personal account used by one staff member does not fall under the team BAA.
- Restrict who can share externally, and review the audit log on a set schedule.
- Keep third-party apps off PHI unless each one has its own BAA.
- Keep Dropbox Dash out of PHI workflows.
- If you use Dropbox Sign for consent forms, sign its separate BAA first.
- Train staff, document your policies and manage offboarding. A departing biller should lose access the same day.
Compliance depends on the signed BAA, configuration and policies, not on the product name.
Alternatives with a BAA
Order is alphabetical and is not influenced by payment.
- AWS HIPAA status: conditional, all accounts.
- Backblaze: conditional, B2 Cloud Storage business customers.
- Box HIPAA status: conditional, Enterprise.
- Carbonite: conditional, Safe Backup Pro.
- Google Cloud Platform: yes, all accounts.
Category tables: HIPAA-compliant file sharing tools, HIPAA-compliant storage and HIPAA-compliant backup.
Sources
- Sign a Business Associate Agreement for your Dropbox team account – Dropbox Help — Help article, checked 2026-10-19. "Dropbox team admins can sign a Business Associate Agreement (BAA) directly through the admin console."
- Sign a Business Associate Agreement for your Dropbox team account – Dropbox Help — Help article, checked 2026-10-19. "applies to certain types of admins on Dropbox Standard, Business, Advanced, Business Plus, and Enterprise"
- Sign a Business Associate Agreement for your Dropbox team account – Dropbox Help — Help article, checked 2026-10-19. "The ability to sign an electronic BAA via the Admin Console is available only to US-based customers."
- Dropbox and HIPAA/HITECH – Dropbox Help — Help article, checked 2026-10-19. "a BAA must be in place before you transfer PHI into your Dropbox account."
- Dropbox and HIPAA/HITECH – Dropbox Help — Help article, checked 2026-10-19. "Dash doesn't support compliance with HIPAA, including Dash in Dropbox."
- Dropbox and HIPAA/HITECH – Dropbox Help — Help article, checked 2026-10-19. "they're not covered by your Dropbox terms of use, including a BAA that you might sign with Dropbox."
- Is Dropbox Sign HIPAA compliant? – Dropbox Help — Help article, checked 2026-10-19. "customers who are on an annual Standard or Premium plan, have a signed Business Associate Agreement (BAA)"
- How Dropbox security works – Dropbox Help — Help article, checked 2026-10-19. "Dropbox files at rest are encrypted using 256-bit Advanced Encryption Standard (AES)"
- How Dropbox security works – Dropbox Help — Help article, checked 2026-10-19. "SSL/TSL creates a secure tunnel protected by 128-bit or higher Advanced Encryption Standard (AES) encryption"
- Dropbox Trust Center — Trust center, checked 2026-10-19. "Dropbox for Teams includes the Dropbox Standard, Advanced, Enterprise, Education, Business, and Business Plus plans."
- Dropbox Trust Center — Trust center, checked 2026-10-19. "Dropbox's updated SOC reports for the period of October 1, 2024 through September 30, 2025"
- Dropbox Trust Center — Trust center, checked 2026-10-19. "Updated ISO certificates for the current certification cycle are also available"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Dropbox Business HIPAA compliant?
A BAA is available on Dropbox team plans, including Business, for file storage and sharing. A team admin signs it electronically in the admin console (US customers only). Sign it before any PHI is uploaded. The BAA does not cover Dropbox Dash or third-party apps connected to the account.
Can I store PHI in a free or individual Dropbox account?
No. Basic, Plus and Essentials have no BAA, so they should not hold PHI. Family and Professional status is not published by the vendor.
How do I sign a BAA with Dropbox and does it cost extra?
On a team plan, a team admin goes to Admin console > Settings > Team profile > Advanced > Set up BAA and signs electronically. The signed copy can be downloaded from the same menu. Extra cost is not published by the vendor.
Are Dropbox Dash and Dropbox Sign covered by the Dropbox BAA?
Dash is not covered, including Dash in Dropbox. Dropbox Sign is covered only under its own BAA, on an annual Standard or Premium plan with a minimum contract value.