A BAA is available for Dropbox Sign on annual Standard or Premium plans, and only after a separate signed agreement. Free, Essentials and monthly Standard plans do not get one. For a clinic that wants patient consent forms signed electronically, the plan and contract term decide the answer.
Is Dropbox Sign HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available on annual Standard or Premium plans (a minimum contract value applies); the main exclusion is the monthly and Essentials plans. Verified 2026-10-20 against Dropbox's help article and terms. See all vendor HIPAA checks for other tools.
Many people still search for this product as HelloSign.
Short answer
BAA available on annual Standard or Premium for the Dropbox Sign service. It is arranged through an account manager or the sales contact form, and the BAA must be signed before the account handles PHI. In HIPAA mode, Dropbox Sign disables CC on signature requests and emailed PDF copies of signed documents.
The BAA covers Dropbox Sign only. Dropbox file storage has separate terms; see Is Dropbox HIPAA compliant?.
Which plans include a BAA
Under Dropbox's terms, HIPAA applies only if the customer and Dropbox separately enter a business associate agreement (BAA). Using the service does not create one.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Standard (annual) | Yes | Account manager or sales contact form; signed BAA and minimum contract value required | Not published by the vendor |
| Premium (annual) | Yes | Account manager or sales contact form; signed BAA and minimum contract value required | Not published by the vendor |
| Free | No | n/a | n/a |
| Essentials | No | n/a | n/a |
| Standard (monthly) | No | n/a | n/a |
The minimum contract value amount is Not published by the vendor.
What the BAA covers and what it excludes
Covered service
- Dropbox Sign.
Disabled or restricted in HIPAA mode
- CC on signature requests.
- PDF copies of signed documents sent by email.
- Editing a document's title and message. Admins can re-enable this from the admin console.
Practical impact. Signers do not receive an emailed copy of what they signed. A front desk that currently tells patients "you'll get a copy by email" needs a different step. Examples are a patient portal upload, a printout at checkout, or a document held in a system covered by your own BAA. The office also cannot CC a billing coordinator or a referring provider on the signature request itself.
Security controls the vendor publishes
On the pages checked, none of the following is published.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence from these pages is not a statement that a control does not exist. It means the pages checked do not document it.
How to use Dropbox Sign with PHI
- Confirm the account is on an annual Standard or Premium plan, not Free, Essentials or monthly Standard.
- Get the BAA signed before anyone sends a form that contains PHI.
- Confirm HIPAA mode is on for the account.
- Review the admin setting for editing document title and message, and decide whether to re-enable it.
- Tell staff that CC and emailed PDFs are off. Set a defined process for storing signed documents, for example in a repository covered by its own BAA (see Is Box HIPAA compliant?).
- Manage user access: add only staff who need to send forms, and remove accounts the day someone leaves.
- Keep the signed BAA and the plan record in your vendor inventory.
Compliance depends on the signed BAA, your configuration and your organization's own policies. See HIPAA guides for the surrounding steps.
Alternatives with a BAA
These e-signature and forms tools also have conditional verdicts. Details sit on each vendor's own check.
- Adobe Acrobat: conditional; Acrobat Sign Solutions for enterprise.
- Adobe Acrobat Sign: conditional; same Acrobat Sign Solutions terms.
- DocHub: conditional; Site License.
- DocuSign: conditional; Enhanced plans via sales.
- Formstack: conditional; Forms HIPAA add-on.
Compare them side by side in HIPAA-compliant software by category.
Sources
- Is Dropbox Sign HIPAA compliant? – Dropbox Help — Help article, checked 2026-10-20. "Dropbox Sign supports HIPAA compliance for customers who are on an annual Standard or Premium plan."
- Is Dropbox Sign HIPAA compliant? – Dropbox Help — Help article, checked 2026-10-20. "Admins can re-enable the ability to edit a document's title and message for their team from the admin console."
- Official Terms of Service – Dropbox Sign — Terms, checked 2026-10-20. "unless Customer and Dropbox separately enter into a HIPAA Business Associate Agreement."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is HelloSign HIPAA compliant?
HelloSign is the earlier name of the product now called Dropbox Sign. The BAA terms are those on the Dropbox Sign help page: BAA available on annual Standard or Premium.
Can I use Dropbox Sign's Free, Essentials or monthly plan for PHI?
No. The help article lists a BAA only for annual Standard and Premium plans, so those other plans have none. Without a signed BAA, don't send PHI through them.
How do I get a BAA for Dropbox Sign?
Contact your account manager or use the sales contact form. A minimum contract value is required, and its amount is Not published by the vendor.
What does HIPAA mode turn off?
It disables CC on signature requests and emailed PDF copies of signed documents. It also disables editing a document's title and message, which an admin can re-enable from the admin console.