No. Apple offers no BAA for iCloud, so patient photos, notes, device backups and files should not go into it.
No No BAA is available on any iCloud plan, and the main exclusion is that all iCloud features are excluded for PHI. Verdict date: 2026-10-20.
Short answer
Apple's iCloud terms require covered entities and business associates not to use the service to create, receive, maintain or transmit PHI, or to use it in any manner that would make Apple a business associate. No BAA is offered, and no consumer iCloud plan changes that. Paying for more storage does not either.
For a practice, this means an iPhone photo of a wound, a Notes entry with a patient's name or a Drive folder of intake scans should not sync to iCloud. For definitions of PHI, BAA and business associate, see the HIPAA glossary. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All iCloud plans (consumer service) | Not available | Not applicable | Not applicable |
Only the consumer iCloud terms are sourced on this page. Nothing here describes any other Apple business, enterprise or education service.
What the BAA covers and what it excludes
Covered services: none, because no BAA exists.
Excluded: all iCloud features, for PHI.
Backup, Drive, Photos and Notes fall under this only because the exclusion applies to all iCloud features. This page does not list sub-products as separately sourced facts. If a feature syncs through iCloud, treat it as excluded for PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Every row reads "Not published by the vendor" on the pages checked. Even if a control were published, controls do not substitute for a BAA. Encrypting a file before it goes to iCloud does not make PHI storage permitted, and no source supports that reading.
How to use iCloud with PHI
Don't. If staff use iPhones, Macs or iPads with iCloud turned on, the exposure comes from sync settings on those devices. A practical checklist:
- Turn off iCloud Backup, iCloud Drive and iCloud Photos on any device that handles patient data, or move that work to a managed device.
- Set a device and account policy for personal Apple IDs. Staff should not sign work devices into a personal Apple ID that syncs patient content.
- Stop staff from photographing patients or paperwork with the default camera app if photos sync to iCloud. Route them to a tool with a signed BAA.
- Move shared files, scans and exports to storage under a signed BAA (see the next section).
- Train staff on what counts as PHI and where it may and may not be saved.
- Review the vendor inventory so iCloud is recorded as "no BAA available, not for PHI."
- Document the decision, with the verdict date and the Apple terms cited below.
Compliance depends on the signed BAA, correct configuration and staff policies, not on the product alone.
If PHI has already synced to iCloud, whether that is a reportable breach is a legal question:.
Alternatives with a BAA
These vendors offer a BAA on defined plans. Confirm scope on each vendor's check page before relying on it.
- Amazon Web Services (conditional; all AWS accounts, no plan tiers): Is AWS HIPAA compliant?
- Box (conditional; Enterprise): Is Box HIPAA compliant?
- Dropbox (conditional; Standard): Is Dropbox HIPAA compliant?
- Backblaze (conditional; B2 Cloud Storage business customers):
- Carbonite (conditional; Safe Backup Pro Core, Power, Ultimate):
Category comparisons: HIPAA-compliant file sharing, HIPAA-compliant storage and HIPAA-compliant backup.
"Conditional" means a BAA is available on the stated plan or service and must be signed. It also means the customer configures the service correctly.
Sources
- Legal – iCloud – Apple — Terms, checked 2026-10-20. "If you are a covered entity, business associate or representative of a covered entity or business associate (as those terms are defined at 45 C.F.R § 160.103), You agree that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information” (as such term is defined at 45 C.F.R § 160.103)"
- Legal – iCloud – Apple — Terms, checked 2026-10-20. "or use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is iCloud HIPAA compliant?
No BAA is available on any iCloud plan. Apple's terms say covered entities and business associates must not use the service to create, receive, maintain or transmit PHI. The verdict is no.
Does Apple sign a BAA for iCloud?
No. The consumer iCloud terms offer no BAA, and no plan or request process is published. This page does not cover other Apple services.
Does paying for more iCloud storage change the answer?
No. The terms apply to the consumer service as a whole, and no iCloud plan includes a BAA. A larger plan adds capacity, not HIPAA coverage.
What can covered entities use instead of iCloud?
Use a storage, file-sharing or backup service that signs a BAA and is configured for PHI. Examples with their conditions are Amazon Web Services, Box on Enterprise and Dropbox on Standard. Compare options in HIPAA-compliant storage and the other category pages above.