Conditional ShareFile, owned by Progress Software Corporation, makes a BAA available on the Premium, Enterprise, VDR and Industry Advantage plans. The main exclusions are the Advanced plan and any PHI processed before the BAA is executed. Last verified 2026-10-20. See also All vendor HIPAA checks.
Short answer
A BAA is available on four ShareFile plans, covering file storage, sharing and workflows. The account admin accepts it when enabling HIPAA support in the account settings. The Advanced plan, self-hosted deployments and PHI processed before the BAA is executed are not covered. A signed BAA is a precondition for handling PHI, not proof that your configuration or policies meet HIPAA.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Premium | Available | Account admin enables HIPAA support and accepts the BAA | None; included in the plan |
| Enterprise | Available | Same | None; included in the plan |
| VDR | Available | Same | None; included in the plan |
| Industry Advantage | Available | Same | None; included in the plan |
| Advanced | Not covered | None | Not applicable |
Minimum seats for BAA eligibility: Not published by the vendor.
How the admin enables it. Go to Account settings > Admin Overview, select Enable HIPAA under Compliance Policy, accept the BAA, then click Enable. The executed BAA can be viewed on that same page.
Pricing context. Premium starts at $26 per user per month billed annually, or $28.59 billed monthly.
What the BAA covers and what it excludes
Covered
- File storage and processing
- File viewing
- Co-authoring
- Audit logging and reporting
- Workflows, including requests and e-signature
Excluded
- On-premises or self-hosted deployments
- PHI processed before HIPAA support is enabled and the BAA is executed
- Transmission of PHI to email services
ShareFile's guide states that earlier data is not retroactively covered.
A clinic that has used the account for months to swap referral letters and intake PDFs should treat those files as uncovered until it has reviewed them.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
"Published status" means what ShareFile states on its own pages. This site does not audit vendors.
How to use ShareFile with PHI
Definitions for BAA and PHI are in the HIPAA glossary: BAA, PHI. Broader implementation steps are in the HIPAA guides.
- Confirm the account is on Premium, Enterprise, VDR or Industry Advantage. The Advanced plan has no BAA.
- Have the account admin enable HIPAA support and accept the BAA before anyone uploads PHI.
- Review files uploaded before that date. Move them out, or decide with your privacy officer how to handle them, because they are not retroactively covered.
- Keep PHI out of email transmission. A shared link sent by email is a decision for your privacy officer, given the email-services exclusion.
- Configure access controls and SSO, and turn on audit logging. Check who can reach each client folder, such as billing staff versus clinicians.
- Confirm the deployment is the hosted service. Self-hosted deployments are outside the BAA.
- Write a staff policy on what may be uploaded, and train front-desk and billing staff on it.
Compliance depends on the signed BAA, your configuration and your policies, not on the plan alone.
Alternatives with a BAA
Each of these is conditional on a BAA. The plan where the BAA starts is shown for each. Browse more in HIPAA-compliant software by category, under file sharing and document management.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Adobe Acrobat | Conditional | Acrobat Sign Solutions for enterprise |
| Adobe Acrobat Sign | Conditional | Acrobat Sign Solutions for enterprise |
| Box | Conditional | Enterprise |
| DocHub | Conditional | Site License |
| Dropbox | Conditional | Standard |
Related checks: Is Box HIPAA compliant? and Is Dropbox HIPAA compliant?.
Sources
- Enable HIPAA — Help article, checked 2026-10-20. "ShareFile Premium, ShareFile Enterprise, VDR, or Industry Advantage account"
- Progress ShareFile with HIPAA Support — Trust center, checked 2026-10-20. "HIPAA support is available with select plans and only under a valid, mutually executed Business Associate Agreement (BAA) with Progress. Under the BAA, Progress is a “Business Associate” or “Subcontractor” of our customer, who is typically a “Covered Entity” or Business Associate."
- Progress ShareFile with HIPAA Support — Trust center, checked 2026-10-20. "PHI processed before that point is not retroactively covered under HIPAA support or the Progress BAA."
- ShareFile Pricing — Pricing page, checked 2026-10-20. "Customers must have a signed BAA in place with ShareFile (Progress Software Corporation)."
- ShareFile Trust Center | Powered by Conveyor — Trust center, checked 2026-10-20. "Uses a centralized IAM solution (SSO) to manage employee access"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. Future updates appear in Recent changes in vendor HIPAA status.
Is the ShareFile Advanced plan covered by a BAA?
No. A BAA is available on Premium, Enterprise, VDR and Industry Advantage. Advanced is not covered, so PHI should not be stored there.
How does an admin enable HIPAA support and accept the ShareFile BAA?
Go to Account settings > Admin Overview and select Enable HIPAA under Compliance Policy. Accept the BAA and click Enable. The executed BAA can be viewed on that page.
Is PHI uploaded before the BAA was signed covered?
No. PHI processed before HIPAA support is enabled and the BAA is executed is not retroactively covered. Review earlier uploads with your privacy officer.
Does the ShareFile BAA cover sending PHI to email services?
No. Transmission of PHI to email services is listed as an exclusion.