Several cloud storage vendors will sign a Business Associate Agreement (BAA), but almost always only for a specific plan or service, and never for a personal or free account. Of the nine vendors below, Google Cloud, AWS, OneDrive and SharePoint sign on commercial accounts, Google Drive, Backblaze, Box and Dropbox only on named plans or by request, and iCloud does not sign. This page is published by Chanty, Inc., which lists its own product elsewhere in the directory. Chanty is not featured here and does not influence row order.
HIPAA-compliant storage: vendors with a BAA compared
Nine vendors are covered. Four offer a BAA on every account or commercial subscription of the service (Google Cloud, AWS, OneDrive, SharePoint). Four offer it on specific plans or under conditions (Google Drive, Backblaze, Box, Dropbox). One offers none (iCloud). No row is currently classed as unknown.
The verdict scale is yes / conditional / no / unknown. A verdict needs a vendor source and a date. Without one, the row is "unknown". The order is fixed and is not a ranking. A BAA alone does not make your use of a storage service compliant: you still configure access, encryption options and retention, and you decide who may upload what.
Quick answer: which cloud storage vendors sign a BAA, and from which plan
Each entry reads "BAA available on plan X for services Y". For the same checks on other software, see all vendor HIPAA checks.
- Google Cloud: BAA available on all accounts. Verdict: yes.
- Google Drive: BAA available on paid Google Workspace editions. Verdict: conditional.
- Backblaze: BAA available for B2 Cloud Storage, for business customers on request. Verdict: conditional.
- AWS: BAA available on all accounts, covering HIPAA-eligible services only. Verdict: yes.
- Box: BAA available on the Enterprise plan. Verdict: conditional.
- Dropbox: BAA available on the Standard plan. Verdict: conditional.
- OneDrive: BAA available under commercial Microsoft 365 subscriptions. Verdict: yes.
- SharePoint: BAA available under commercial Microsoft 365 subscriptions. Verdict: yes.
- iCloud: no BAA listed. Verdict: no.
Comparison table
"Not published by the vendor" means the vendor's own pages do not state the control. "—" means no plan carries a BAA. Dates appear only in the Last verified column.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Google Cloud Platform | Yes | All Google Cloud accounts | Review and accept the Google Cloud BAA online (see Privacy compliance and records for Google Cloud) | Not published by the vendor | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Google Drive | Conditional | Google Workspace (paid editions) | A super administrator reviews and electronically accepts the Business Associate Addendum in the Admin console under Account settings > Legal and compliance, before any PHI is used. | €6.80 per user/month (Business Starter, annual commitment, EUR as shown on the pricing page) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Backblaze | Conditional | B2 Cloud Storage (business customers) | On request to Backblaze for business customers who are covered entities under HIPAA. | $6.95/TB/month (B2 Cloud Storage, pay as you go) | Yes | Not published by the vendor | Not published by the vendor | Yes | 2026-10-28 |
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) | Sign in to AWS Artifact in the AWS Management Console, review and accept the Business Associate Addendum for the account, or accept it once for all accounts in an AWS Organization; PHI must then be processed only in HIPAA-eligible services. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Yes | 2026-10-19 |
| Box | Conditional | Enterprise | An enterprise admin or co-admin opens the Box Admin Console > Account & Billing, scrolls to the HIPAA Compliance section, clicks Request a HIPAA BAA, completes the form (organization, signer, covered entity or business associate) and submits; Box Legal Operations emails the addendum within 3-5 business days. A signed BAA should be in place before storing PHI. | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-19 |
| Dropbox | Conditional | Standard | Team admin signs in to dropbox.com, opens Admin console > Settings > Team profile (under Account) > Advanced > Set up BAA, reviews and completes the agreement; a signed copy can be downloaded from the same menu. Electronic signing is available only to US-based customers; teams with a BAA cannot enable reseller support. | Not published by the vendor | Yes | Yes | Not published by the vendor | Yes | 2026-10-19 |
| OneDrive | Conditional | Office 365 / Microsoft 365 commercial subscriptions (OneDrive for Business) | Included by default in the Microsoft Online Services Data Protection Addendum for all customers that are covered entities or business associates; no separate signature needed. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| SharePoint | Conditional | Office 365 / Microsoft 365 commercial subscriptions (SharePoint Online) | Included by default in the Microsoft Online Services Data Protection Addendum for all customers that are covered entities or business associates; no separate signature needed. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| iCloud | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
Vendors that do not sign a BAA
iCloud carries a "no" verdict: no BAA plan or route is listed for it. In practice this matters at the front desk. A staff member who photographs a signed intake form and lets the phone sync it to a personal iCloud account has placed PHI in a service with no BAA behind it.
The same applies to personal and free accounts of brands that do sign a BAA elsewhere. Google, Dropbox, Box and Microsoft offer BAAs on specific paid or commercial plans. A staff member's personal account at the same brand is usually outside that agreement. Block personal accounts on clinic devices rather than relying on staff to remember the difference.
What counts as HIPAA-compliant cloud storage
No storage service is HIPAA compliant as a product property. What you can verify is a combination of conditions:
- A BAA for the service on the plan you buy. The BAA must name the storage service you use. A BAA for a vendor's email product does not cover its file storage, and a BAA on an Enterprise plan does not cover a Starter account. The business associate agreement guide explains what the agreement contains and who signs it.
- Controls you can turn on. Look for encryption, access controls and an audit trail. Where a vendor does not publish a control, treat it as unverified, not as absent.
- No personal or free accounts, no consumer apps. These are the typical exclusions in vendor terms.
- A BAA in place before PHI is stored. Uploading scanned referrals to a trial account while the agreement is "being sorted out" is already a problem.
- Shared responsibility. The vendor secures the service. You configure sharing settings, manage user access, secure devices and train staff.
How to choose
- Confirm the BAA covers the exact service and plan, not just the brand. "Google" or "Microsoft" is not enough: Google Cloud, Google Drive, OneDrive and SharePoint appear as separate rows with different terms.
- Check the BAA is signed or accepted before any PHI is uploaded. Make this a go-live gate for a new shared drive or migration.
- Look for audit log, SSO and encryption at rest. Treat any unpublished item as unverified until the vendor confirms it in writing.
- Check data residency options if location matters. If a contract or state rule requires data to stay in a region, ask for the storage location in writing.
- Check what the BAA excludes. Non-eligible services and add-ons are the usual gap. An AWS BAA, for example, covers HIPAA-eligible services only.
- Plan offboarding and access reviews. Remove departed staff and review shared folders on a schedule. Keep the signed BAA on file with your vendor inventory. The patient data security guide covers access reviews in more detail.
Related
- HIPAA-compliant software by category
- HIPAA-compliant file sharing
- HIPAA-compliant backup
- HIPAA-compliant document management
- The glossary defines BAA, PHI and related terms.
FAQ
Is cloud storage HIPAA compliant?
It depends on the vendor, the plan and the service. A BAA is the starting point, not a certification. The rows above show BAAs tied to specific plans or services, so check your exact plan against the vendor's BAA terms before storing PHI.
Is there free HIPAA-compliant cloud storage?
None of the nine rows lists a BAA on a free plan. BAAs are tied to paid or business plans: paid Google Workspace editions, Box Enterprise, Dropbox Standard, commercial Microsoft 365 subscriptions, and business customers of Backblaze B2. Google Cloud and AWS offer BAAs on all accounts, but you still pay for the services you use. See why free plans rarely include a BAA.
How do I get a BAA from Dropbox, Box, AWS or Google Workspace?
Each vendor has its own route, and the steps change, so follow the instructions on the vendor's own BAA page.
- Box: the BAA is available on Enterprise, with a turnaround of 3-5 business days.
- Dropbox: the BAA is available on the Standard plan.
- AWS: the BAA covers HIPAA-eligible services only, so confirm each service you plan to use is on the eligible list.
- Google Workspace: the BAA is available on paid editions. Google Drive's listed starting price is EUR 6.80 per user/month (Business Starter, annual).
Does iCloud sign a BAA?
No. The verdict for iCloud is "no", and no BAA plan or route is listed. Do not store PHI in iCloud.
Do OneDrive and SharePoint need a separate BAA?
Both are listed under commercial Microsoft 365 subscriptions, and no separate agreement is listed for either. A personal Microsoft account is not a commercial subscription and is not covered.