HIPAA-compliant file sharing: vendors with a BAA compared

Of the eight services compared, Google Drive, Google Workspace, Microsoft 365, ShareFile, Box and Dropbox have a BAA available on a specific paid plan, so each is conditional. WeTransfer is unknown because it publishes no BAA terms. iCloud is no. This page covers the vendor table plus three child topics: file uploads, link shorteners, and enterprise search with link sharing. For other tool types, see HIPAA-compliant software by category.

Short answer: which file sharing tools can touch PHI

Google Drive and Google Workspace, Microsoft 365, ShareFile, Box and Dropbox each offer a BAA on named plans. Your organization still has to activate it, configure access and keep PHI out of unsupported features. A BAA being available is not the same as a tool being "HIPAA compliant". For how this site uses that phrase, see what 'HIPAA compliant' means for a tool.

• Conditional: a BAA is available on a named plan, and an admin must accept or request it.
• Unknown: the vendor publishes no BAA terms or trust documentation that supports a yes or a no.
• No: the vendor's terms bar use for PHI or it offers no BAA.

Last updated: 2026-10-20. This directory is published by Chanty, Inc., which lists Chanty as one vendor among others. Table placement never depends on payment or on Chanty's interest. Rows are grouped by verdict and are not a ranking.

Comparison table: BAA by plan, how to activate, last verified

BAA availability, activation and price

Vendor	Verdict	BAA from plan	How the BAA is accepted or requested	Starting price (as shown by vendor)
Google Drive	Conditional	Google Workspace (paid editions)	Super administrator accepts the Business Associate Addendum in the Admin console before any PHI is used	€6.80 per user/month (Business Starter, annual commitment, EUR as shown on the pricing page)
Google Workspace	Conditional	Paid editions administered in the Admin console: Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits	Super administrator accepts electronically, answering three covered-entity questions	€6.80/user/month (Business Starter, annual commitment; the pricing page showed EUR for this region, no US dollar price displayed)
Microsoft 365	Conditional	Microsoft 365 Business Basic	Included by default in the Data Protection Addendum (DPA); no separate signature. Microsoft does not sign customer-provided BAAs	$7.00/user/month (Business Basic, paid yearly)
ShareFile	Conditional	Premium	Account admin enables HIPAA under Compliance Policy and accepts the BAA	$26 per user/month (Premium, billed annually; $28.59 monthly)
Box	Conditional	Enterprise	Enterprise admin or co-admin requests the BAA in the Admin Console; Box Legal Operations emails it within 3-5 business days	Not published by the vendor
Dropbox	Conditional	Standard	Team admin sets up the BAA in the Admin console	Not published by the vendor
WeTransfer	Unknown	No BAA terms published	Not applicable	Not published by the vendor
iCloud	No	No BAA available	Not applicable	Not published by the vendor

Controls reported by vendors

Vendor	Encryption at rest	Audit log	SSO	SOC 2	Data residency
Google Drive	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Google Workspace	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Microsoft 365	Yes	Not published by the vendor	Not published by the vendor	Yes	Most Office 365 services let customers specify the region where customer data is located; data is not replicated outside the chosen geographic area
ShareFile	Not published by the vendor	Yes	Yes	Yes	Not published by the vendor
Box	Yes	Yes	Yes	Yes	Box Zones: customer selects a region or country for content at rest
Dropbox	Yes	Yes	Not published by the vendor	Yes	Not published by the vendor
WeTransfer	Yes	Not published by the vendor	Yes	Not published by the vendor	EU (AWS, Ireland)
iCloud	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor

Prices are shown as they appear on each vendor's page, including Google's EUR display, and may change. Dropbox's plan comparison lists Standard at $15 and Advanced at $24 per user per month, with Enterprise through sales. Google's page also lists Starter $7, Standard $14 and Plus $22 per user per month in USD, which differs from the EUR figure above..

The verification date and the vendor documents behind each row are listed under Sources at the end of the page.

What counts as HIPAA-compliant file sharing

For this page, a file sharing service qualifies when files containing PHI are stored and shared under a BAA on the plan you actually buy, with access controls and an audit log. Personal cloud accounts and consumer transfer services are excluded. The typical exclusions are personal and free accounts and AI search add-ons. A clinic that pays for a business plan but lets staff keep using personal accounts for scanned referrals has no coverage for those files.

The BAA requirement comes from the HIPAA rules. For what the agreement covers and what it leaves to you, read what a business associate agreement covers.

How each BAA is actually activated

Activation is an admin action, not automatic, except where noted for Microsoft. Files uploaded before activation were not under the agreement, so audit what already sits in the account.

• Google: a super administrator reviews and electronically accepts the Business Associate Addendum in the Admin console. The path is Account > Account settings > Legal and compliance > Security and Privacy Additional Terms > Google Workspace/Cloud Identity HIPAA Business Associate Amendment > Review and Accept. This must be done before any PHI is used. The admin answers three questions confirming covered-entity status and clicks OK. Google's HIPAA Included Functionality list covers AppSheet, Apps Script, Cloud Identity Management, the Gemini app (excluding Gemini in Chrome), Gemini Mac App, Gemini in Workspace, Gmail, Google Calendar, Google Chat, Google Cloud Search, Google Drive (including Docs, Forms, Pics, Sheets, Slides and Vids), Google Groups, Keep, Meet, Sites, Tasks, Google Vault (if applicable) and Google Voice (managed users only). Third-party apps and add-ons are not covered.
• Microsoft 365: the terms are included by default in the Microsoft Products and Services Data Protection Addendum, incorporated into the Product Terms for all customers that are covered entities or business associates. No separate signature or request is needed. Microsoft does not sign customer-provided BAAs, so a clinic whose counsel insists on its own template will not get that.
• ShareFile: the account admin goes to Account settings > Admin Overview, selects Enable HIPAA under Compliance Policy, checks the box to accept the BAA and clicks Enable. The executed BAA can be viewed on that page.
• Box: an enterprise admin or co-admin opens Admin Console > Account & Billing, finds the HIPAA Compliance section, clicks Request a HIPAA BAA and completes the form. Box Legal Operations emails the addendum within 3-5 business days. A signed BAA should be in place before storing PHI, so plan for the wait.
• Dropbox: a team admin opens Admin console > Settings > Team profile > Advanced > Set up BAA, reviews and completes the agreement, and can download a signed copy from the same menu. Electronic signing is available only to US-based customers. Teams with a BAA cannot enable reseller support, which matters if an MSP currently resells your licenses.

HIPAA-compliant file uploads (including WordPress image uploads)

A website upload form sends files to a server. The storage destination and the hosting need a BAA, not only the form plugin. A patient-photo upload on a practice site may pass through a plugin, land in the web server's media library and get copied to a third-party image service. Each of those is a place PHI can sit.

No WordPress plugin or host is named here, because none has a published BAA position in this directory. Any plugin-specific verdict is unknown. For vetted options, see HIPAA-compliant forms and form builders and HIPAA-compliant websites.

Before you accept an upload feature, check:

1. Where do files land after upload: server disk, object storage or an email inbox?
2. Who can open them, and is that list limited by role?
3. Does an audit log record access and downloads?
4. Are images copied into a media library, thumbnail service or CDN that sits outside the BAA?

HIPAA-compliant link shorteners

A short link to a PHI file is only as safe as the file's permissions. If the destination is public or unauthenticated, anyone holding the short link can open it. The shortener may also see the destination URL.

No link shortener is listed in this directory, so the verdict for any shortener is unknown. To be assessed, a vendor must publish:

• whether a BAA is available, and on which plan
• whether it logs or can read destination URLs
• whether links can expire or be disabled
• its security documentation

The safer pattern is to use the sharing tool's own expiring, permissioned links rather than a third-party shortener. Most of the services above offer sharing controls inside the same account the BAA covers, though mainly on paid or business plans:

• Google Drive: restrict a file to named people and, for work or school accounts, set an access expiry up to one year ahead. This expires a person's access, not the link itself.
• OneDrive: view-only or edit links, Block download, passwords and expiration dates. Expiration is for Microsoft 365 subscribers only and, for folders, only on "Anyone" links.
• Dropbox: link expiry, passwords and view-only or edit links on paid plans, but not on free Basic.
• Box: link controls are not described here.

Enterprise search and link sharing for patient support teams

Search indexes copy or read file contents. The search layer therefore needs the same BAA coverage as the repository it indexes. A patient support team that searches across shared drives and sends links to billing documents is relying on both layers.

AI search add-ons are a typical exclusion, and coverage differs by vendor. Google lists the Gemini app, Gemini in Workspace and Cloud Search as covered (Gemini in Chrome is excluded). Microsoft lists Microsoft Copilot and Microsoft Copilot Chat as in scope. Dropbox says Dash, including Dash in Dropbox, does not support HIPAA compliance. Box does not state whether Box AI is covered. Treat these features as outside the BAA until the vendor's documents say otherwise.

No search-and-shortlink pairing is recommended here, because none has a documented BAA position. Use this checklist on any combination:

• The BAA covers the repository and the search index.
• Search respects file permissions, so staff cannot find what they cannot open.
• Link sharing is limited to named users or expiring links.
• An audit log covers searches and link creation.

For records workflows beyond sharing, see HIPAA-compliant document management.

The customer's side of shared responsibility stays the same whichever vendor you choose: permissions, offboarding, device security and staff training.

Internal team files: where team chat fits

Disclosure: Chanty, Inc. owns and publishes this directory. Chanty is not a row in the table above, and placement in any table does not depend on it.

Chanty is internal team communication for staff, and its Files capability covers shared files and procedures in the workspace. HIPAA with a signed BAA is available from the Business plan and on Enterprise. It is not available on the Free plan. The BAA does not extend to third-party integrations, and the Chanty BAA does not document coverage of AI agent processing. AI agents are Enterprise only. Chanty is not for patient messaging, and a BAA does not make an organization compliant by itself.

For the feature itself, see file sharing in Chanty.

How to choose and what to do next

1. Confirm which plan carries the BAA and check that you are on it.
2. Sign or activate the BAA before any PHI enters the account.
3. Restrict sharing to named users or expiring links, and block personal and free accounts.
4. Turn on audit logging where the vendor offers it.
5. Record the vendor, plan, BAA date and exclusions in your vendor inventory.

Neighbouring categories help when files are only part of the job: HIPAA-compliant storage and HIPAA-compliant backup.

If a vendor's terms have changed, or a cell above is wrong, tell us. Updates are logged on the recent changes page.

FAQ

Is Google Drive HIPAA compliant?

Google Drive is conditional. A BAA is available with Google Workspace, excluding the legacy free edition, and a super administrator must accept the Business Associate Addendum in the Admin console before any PHI is used.

Does Dropbox sign a BAA, and on which plan?

Yes, from the Standard plan. A team admin sets it up in the Admin console under Settings > Team profile > Advanced. Electronic signing is available only to US-based customers, and teams with a BAA cannot enable reseller support.

Is WeTransfer HIPAA compliant?

The verdict is unknown. WeTransfer publishes no BAA terms, so do not send PHI through it. Its Help Center says that, as a company not bound by US law, it isn't obliged to comply with HIPAA, and its official pages offer only GDPR Data Processing Agreements, not a BAA.

Can I use iCloud to share files containing PHI?

No. The verdict is no, with no BAA available. Apple's iCloud Terms & Conditions (§I.C) bar covered entities and business associates from using iCloud to create, receive, maintain or transmit PHI, or in any way that would make Apple their business associate.

Does Microsoft 365 sign a BAA?

Not as a separate signed document. HIPAA terms are included by default in the Data Protection Addendum for covered entities and business associates, from Microsoft 365 Business Basic. Microsoft does not sign customer-provided BAAs.

Do I need a BAA for a link shortener?

If the shortener can see or store links to PHI, treat it as a vendor that needs assessment, and a BAA question follows. No shortener is listed in this directory, so the verdict is unknown. Using the sharing tool's own permissioned links avoids the question.

Are AI search features covered by the BAA?

Not assumed. AI search add-ons are a typical exclusion, and coverage must be confirmed in each vendor's documents. Google and Microsoft list their AI tools as covered, Dropbox Dash is explicitly not covered, and Box does not state whether Box AI is covered.

Is a free personal account ever acceptable for PHI?

No. Personal and free accounts are excluded here because the BAA applies to the plan you buy. The BAA availability above is tied to paid plans, and Chanty's Free plan has none.

Sources