Of the 10 document tools checked, 9 will sign a BAA only on specific plans or through a contract. The tenth, OpenText, is unknown because its BAA terms could not be verified. This page shows the plan, how to obtain the BAA, and what is excluded, so you can shortlist before you open a vendor's sales page.
HIPAA-compliant document management: vendors with a BAA compared (summary)
Ten vendors were checked. The verdicts: 9 conditional (BAA on specific plans or through contract), 0 unconditional on every plan, 0 "no", and 1 unknown (OpenText). No vendor here signs a BAA on every plan. A verdict reports the vendor's published terms. It is not an audit, a certification or legal advice.
This directory is published by Chanty, Inc. and the ownership is disclosed on every page. Order and placement in these tables never depend on payment.
Quick answer: which document management systems sign a BAA, and from which plan
Each entry below is a verdict on a service and plan, not on the brand. See all vendor HIPAA checks for the full directory.
- Google Docs: conditional. BAA for Google Workspace plans and managed Cloud Identity accounts.
- ShareFile: conditional. BAA from the Premium plan.
- Adobe Acrobat: conditional. Adobe's BAA is scoped to specific services, not the whole brand.
- Adobe Acrobat Sign: conditional. BAA covers Acrobat Sign Solutions for enterprise.
- Box: conditional. BAA on the Enterprise plan, requested through a form.
- DocHub: conditional. BAA on the Site License.
- Notion: conditional. BAA on the Enterprise plan.
- PandaDoc: conditional. BAA on the Enterprise plan.
- SharePoint: conditional. Microsoft 365 commercial subscriptions, with the BAA terms in the Data Protection Addendum (DPA).
- OpenText: unknown. No verifiable source.
Comparison table
"—" means no plan applies. "Not published by the vendor" means the vendor publishes nothing on that control. Dates appear only in the last column.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Google Docs | Conditional | Google Workspace (Business Starter, Business Standard, Business Plus, Enterprise, Education, Nonprofits) and Cloud Identity accounts managed in the Admin console | Self-serve: a Workspace administrator reviews and electronically accepts the HIPAA BAA in the Admin console (Account settings > Legal and compliance). | €6.80/user/month billed monthly (Business Starter, EU price page; USD price not retrievable) | Yes | Yes | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| ShareFile | Conditional | Premium | Account admin logs in, goes to Account settings > Admin Overview, selects Enable HIPAA under Compliance Policy, checks the box to accept the Business Associate Agreement and clicks Enable; the executed BAA can be viewed on that page. | $26 per user/month (Premium, billed annually; $28.59 monthly) | Not published by the vendor | Yes | Yes | Yes | 2026-10-20 |
| Adobe Acrobat | Conditional | Acrobat Sign Solutions for enterprise | Contact an Adobe sales representative; requires the correct license and a signed BAA | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Adobe Acrobat Sign | Conditional | Acrobat Sign Solutions for enterprise | Contact your Adobe sales or channel representative to determine eligibility, providing the Acrobat Sign Account ID; after the BAA is executed Adobe enables the Linked Business Associate Agreement setting on the account. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Box | Conditional | Enterprise | An enterprise admin or co-admin opens the Box Admin Console > Account & Billing, scrolls to the HIPAA Compliance section, clicks Request a HIPAA BAA, completes the form (organization, signer, covered entity or business associate) and submits; Box Legal Operations emails the addendum within 3-5 business days. A signed BAA should be in place before storing PHI. | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-19 |
| DocHub | Conditional | Site License | Submit the HIPAA request form; DocHub confirms the plan setup and shares the BAA for signature | Not published by the vendor | Yes | Yes | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Notion | Conditional | Enterprise | On the Enterprise plan, a workspace owner goes to Settings > Workspace settings > HIPAA compliance > Activate, reviews the BAA and accepts it; Notion emails a confirmation. | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-19 |
| PandaDoc | Conditional | Enterprise | Contact the PandaDoc account/support team (request a demo) to sign the BAA before any ePHI workflows | Not published by the vendor | Not published by the vendor | Yes | Yes | Yes | 2026-10-20 |
| SharePoint | Conditional | Office 365 / Microsoft 365 commercial subscriptions (SharePoint Online) | Included by default in the Microsoft Online Services Data Protection Addendum for all customers that are covered entities or business associates; no separate signature needed. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| OpenText | Unknown | — | By contract through OpenText sales; the standard BAA text is published on cybersecurity.opentext.com/legal (page could not be fetched for verification). | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
Each row's verdict cites the vendor's own BAA or trust page, and the source URL is on the vendor's page. A row with no verifiable source is "unknown".
Vendors that do not sign a BAA
No row in this table is a "no". One vendor is unknown: OpenText. Its BAA is obtained by contract through OpenText sales. A standard text is published at cybersecurity.opentext.com/legal, but that page could not be fetched for verification.
"Unknown" means there is no verifiable source on our side. It is not a refusal by the vendor. If you are evaluating OpenText, request the BAA through sales and read the signed terms, not a summary.
What counts as HIPAA-compliant document management
In practice, a document tool is usable for PHI when four things line up:
- A signed BAA covers the service you use. It must cover storage, editing, sharing and e-signature of the documents, on the plan you buy. See the business associate agreement guide for the basics.
- The tool has configurable access controls, audit logs and retention. A front desk that scans intake packets needs to restrict who can open them. A privacy officer needs to see who opened or exported a record.
- You know the exclusions. Typical ones are personal and free editions, AI features and consumer apps. A BAA on one plan does not extend to a free account or a consumer app from the same brand.
- You use the right wording. The accurate form is "BAA available on plan X for services Y", never "HIPAA certified" or "X is HIPAA compliant".
Covered services can be narrower than the brand name suggests. Adobe's BAA, for example, applies to Acrobat Sign Solutions for enterprise, so "we use Adobe" does not tell you whether a given workflow is covered.
How to choose
- Match the BAA to the exact service and plan. If the practice uses ShareFile Premium, the BAA applies to Premium. Get it signed before any PHI enters the system, including a test upload of a real chart.
- Check how the BAA is obtained. It may be a self-serve admin step, a default in the DPA (SharePoint), a request form (Box) or a sales contact (OpenText, DocHub's Site License). This sets your timeline.
- Verify the exclusions. Look for AI features, add-ons and free tiers. If staff turn on an AI summarizer that sits outside the BAA, PHI has left coverage.
- Require audit logs, SSO and configurable retention. Confirm which plan includes each. A cheaper plan may meet the BAA threshold but lack the logs your security officer needs.
- Ask for the SOC 2 report. Check data residency options if location matters to your contracts.
- Check connected tools. Scanning apps, OCR or document-parsing APIs, redaction tools, e-signature add-ons, integrations and offsite paper storage each need their own BAA with their own vendor. A BAA with your document platform does not cover them.
- Plan for the customer side. Staff policies, access reviews and offboarding are yours. The BAA does not cover your configuration. Read how to read a vendor BAA before you sign.
Related
- Guide: patient data security
- All categories: HIPAA-compliant software by category
- Neighbouring categories: HIPAA-compliant storage, HIPAA-compliant file sharing and HIPAA-compliant electronic signatures
- How verdicts are defined: methodology page
FAQ
Which document management tools let an admin accept the BAA without talking to sales?
Per the rows above, Google Workspace, ShareFile and Notion offer BAAs without a sales conversation. Box uses a request form instead of a direct admin toggle. OpenText and DocHub's Site License go through a contract or sales contact. Confirm the current process on the vendor's own page, because it can change.
Can I store PHI in a free or personal edition of Google Docs, Notion or Box?
No BAA is listed for those editions. In the rows, Google's BAA applies to Workspace plans and managed Cloud Identity accounts, Notion's to Enterprise, and Box's to Enterprise. A personal or free account is outside those plans. Treat it as not covered and keep PHI out of it.
Does SharePoint need a separate BAA signature?
The row shows the BAA terms in the DPA for Microsoft 365 commercial subscriptions, so there is no separate signing step in the listing. Your obligation is to confirm your tenant is a commercial subscription covered by that DPA, and to check which add-ons are excluded.
Is a signed BAA enough to make my document management HIPAA compliant?
No. The BAA is the vendor's commitment on the covered service. You are still responsible for configuring roles and permissions, retention, user access and offboarding, device security, staff policies and training. A signed BAA is a precondition, not a finished program. This page reports published vendor terms and is not legal advice.