A backup vendor will sign a BAA only for specific plans or products, and none of the six vendors checked here does so on every plan. Google Drive, Backblaze, Carbonite, Dropbox and OneDrive offer a BAA on specific plans or on request. iCloud does not sign one.
Six backup and cloud storage vendors were checked, with these results:
- 0 sign a BAA on every plan.
- 5 sign on specific plans or on request: Google Drive, Backblaze, Carbonite, Dropbox and OneDrive.
- 1 does not sign: iCloud.
- 0 publish nothing.
A backup is a full copy of PHI, so the backup vendor is a business associate. A BAA must be signed before any PHI is stored. This page is a directory of published vendor terms, not legal advice or an audit. It sits in HIPAA-compliant software by category and is published by Chanty, Inc.; Chanty is not a backup product and is not listed here.
Quick answer: which backup services sign a BAA, and from which plan
Each line below states where a BAA is available, not that the vendor "is HIPAA compliant." See all vendor HIPAA checks for the full directory.
- Google Drive: conditional. BAA available on Google Workspace paid editions.
- Backblaze: conditional. BAA available for B2 Cloud Storage, for business customers, on request.
- Carbonite: conditional. BAA available on Safe Backup Pro: Core, Power and Ultimate.
- Dropbox: conditional. BAA available on the Standard plan.
- OneDrive: conditional. BAA terms apply to Microsoft 365 commercial subscriptions, OneDrive for Business.
- iCloud: no. No BAA published.
Comparison table
Vendors are listed in a fixed order, not ranked. Placement never depends on payment.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Google Drive | Conditional | Google Workspace (paid editions) | A super administrator reviews and electronically accepts the Business Associate Addendum in the Admin console under Account settings > Legal and compliance, before any PHI is used. | €6.80 per user/month (Business Starter, annual commitment, EUR as shown on the pricing page) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Backblaze | Conditional | B2 Cloud Storage (business customers) | On request to Backblaze for business customers who are covered entities under HIPAA. | $6.95/TB/month (B2 Cloud Storage, pay as you go) | Yes | Not published by the vendor | Not published by the vendor | Yes | 2026-10-28 |
| Carbonite | Conditional | Carbonite Safe Backup Pro (Core, Power, Ultimate) | On request: new or trial Safe Backup Pro customers call sales (855-227-2249); existing customers email [email protected]. BAA based on the federal standard template. | Not published by the vendor | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Dropbox | Conditional | Standard | Team admin signs in to dropbox.com, opens Admin console > Settings > Team profile (under Account) > Advanced > Set up BAA, reviews and completes the agreement; a signed copy can be downloaded from the same menu. Electronic signing is available only to US-based customers; teams with a BAA cannot enable reseller support. | Not published by the vendor | Yes | Yes | Not published by the vendor | Yes | 2026-10-19 |
| OneDrive | Conditional | Office 365 / Microsoft 365 commercial subscriptions (OneDrive for Business) | Included by default in the Microsoft Online Services Data Protection Addendum for all customers that are covered entities or business associates; no separate signature needed. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| iCloud | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
Each row should be confirmed against the vendor's own BAA or trust page, with the date, before a verdict goes live. Without a dated source, the verdict is "unknown." Editors need to confirm these scope points:
- and whether Drive qualifies as backup. -. -. -. -.
Vendors that do not sign a BAA
iCloud is a "no": no BAA is published. A clinic that stores PHI there has no business associate agreement behind the copy. The typical front-desk case is a staff member's iPhone backing up photos of insurance cards and intake forms to a personal Apple ID. That copy sits outside any agreement.
Personal, home and consumer plans are the usual exclusion even at vendors that sign a BAA elsewhere. Every "conditional" verdict above is tied to a named plan or product. A vendor that signs for its business tier has not signed for the consumer app an employee installed on their own. The free plans and BAAs guide explains why free tiers fall outside these agreements.
What counts as HIPAA-compliant backup services
No product holds a HIPAA certification, and a signed BAA alone does not make a backup setup compliant. A setup is acceptable for PHI when these conditions hold together:
- A BAA covers the exact product and plan you bought. The business associate agreement guide covers what the agreement must contain.
- Encryption at rest, retention you control and a documented restore path. If you cannot say how long copies are kept or how a file is restored, the backup is incomplete.
- Consumer and personal plans are excluded.
- Sync is not backup. A synced folder mirrors deletions and overwrites. Treat Drive, OneDrive or Dropbox as backup only where the vendor confirms it for your plan.
Searches for disaster recovery and data recovery come down to the same rules. If a ransomware event or a failed server forces a restore, the recovery process handles PHI too. The offsite copy, the restore and any vendor-assisted recovery must all fall under the same BAA. Contingency planning is a regulatory topic, so document the plan. This page does not promise recovery times, because none are published in the sourced rows.
How to choose a backup service for PHI
- Confirm the BAA covers your exact product and plan, not just the vendor. Backblaze's BAA is tied to B2 Cloud Storage for business customers, and Carbonite's is tied to Safe Backup Pro tiers.
- Check how the BAA is obtained and who signs. Google is accepted in the admin console. Dropbox is set up in the admin console, with US-only e-signing. Backblaze is on request. Carbonite goes through sales.
- Verify encryption at rest, audit log and SSO on the plan you will buy. Where the table shows a control as unconfirmed, ask the vendor in writing.
- Check retention controls and test a restore before relying on the service. Restore one patient folder to a clean machine and time it yourself.
- Review reseller and integration exclusions. Dropbox offers no reseller support with a BAA. An MSP that resells a plan may leave the clinic outside the agreement.
- Ask for the current SOC 2 report where the vendor publishes one.
- Assign your own duties. Access control, offboarding of departed staff and device security stay with the clinic.
Related
- Neighbour categories: HIPAA-compliant storage, HIPAA-compliant file sharing and HIPAA-compliant hosting.
- More explanations, including patient data security, are in the HIPAA guides.
FAQ
Which backup services will sign a BAA, and on which plan?
Google Drive on Google Workspace paid editions, Backblaze for B2 Cloud Storage business customers, Carbonite on Safe Backup Pro (Core, Power, Ultimate), Dropbox on Standard, and OneDrive under Microsoft 365 commercial subscriptions. All five are "conditional." See the table above.
Can I use iCloud or a personal plan to back up PHI?
No. iCloud has no published BAA, so its verdict is "no." Personal and consumer plans are excluded from the BAAs that other vendors offer.
How do I get a BAA from Dropbox, Google Drive or Carbonite?
For Google Drive, accept the BAA in the Google admin console. For Dropbox, set it up in the admin console. E-signing is US-only, and there is no reseller support with a BAA. For Carbonite, contact sales by phone or email.