Unknown Checked 2026-10-20. No BAA is published for any WeTransfer plan on the pages the vendor pages, and the vendor positions itself outside US HIPAA obligations, so there are no BAA terms to cite. See Is it HIPAA compliant? All vendors for how verdicts are assigned across the directory.
Short answer
WeTransfer's pages do not mention a BAA. The vendor says it holds no HIPAA certification (none exists for any product) and that, as a Dutch company, it is not bound by US HIPAA. It offers Data Processing Agreements (DPAs) on business plans instead. We report these statements as the vendor's position. We do not endorse them as a legal conclusion. Whether a non-US vendor can act as a business associate is a question for your counsel.
A DPA is a data-protection contract. It is not a BAA, which is the contract HIPAA requires before a vendor handles PHI for a covered entity. See the HIPAA glossary: BAA and DPA.
Do not put PHI through WeTransfer without a signed BAA. A lab result PDF, a referral packet or an intake scan sent by transfer link counts as PHI in transit and at rest on the vendor's servers.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| No plan has a published BAA | Not mentioned on the pages checked | Not published by the vendor | Not published by the vendor |
Data Processing Agreements are available on business plans. The plan names are not published in the sources we hold. Do not infer a BAA from DPA availability.
What the BAA covers and what it excludes
- Covered services: none published, because there is no BAA terms.
- Excluded features: none published by the vendor.
The vendor publishes no BAA terms on the pages checked. This is a statement about what the pages say. It does not mean WeTransfer would refuse to sign one.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | EU (AWS, Ireland) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Controls alone do not create HIPAA coverage. Encryption and an ISO 27001 certificate do not substitute for a signed BAA. Data stored in the EU may also matter for your own policies, so record it in your vendor inventory.
How to use WeTransfer with PHI
WeTransfer's own HIPAA file sharing page advises confirming compliance obligations before use if your content is subject to HIPAA. Compliance depends on the signed BAA, how the service is configured and your policies. A checklist for a clinic or MSP:
- Ask your privacy officer or counsel whether WeTransfer can serve as a business associate for your use case.
- Get a signed BAA before any PHI enters a transfer. A DPA does not meet this step.
- Without a BAA, keep PHI out of transfers entirely. That includes file names, message fields and email addresses that identify a patient.
- Check link and access settings, such as who can open a link, and confirm how long files remain available.
- Train front-desk and billing staff on what may and may not be sent, using real cases like sending records to a specialist or an imaging file to a patient.
- Move routine PHI exchanges to a tool with a BAA (see below), so staff are not choosing between convenience and policy.
- Record the decision, the verdict date and the owner in your vendor inventory.
Alternatives with a BAA
These services publish BAA terms. Each is conditional on plan and configuration, so read its page before relying on it.
- Box (conditional, BAA from Enterprise): Is Box HIPAA compliant?
- Dropbox (conditional, BAA from Standard): Is Dropbox HIPAA compliant?
- Google Drive (conditional, Google Workspace paid editions): Is Google Drive HIPAA compliant?
- Google Workspace (conditional, paid editions administered in the Admin console): Is Google Workspace HIPAA compliant?
- Microsoft 365 (conditional, BAA from Business Basic): Is Microsoft 365 HIPAA compliant?
For a side-by-side comparison, see HIPAA-compliant file sharing tools.
Sources
- Gate your healthcare content behind payment | WeTransfer — Vendor page, checked 2026-10-20. "Note that WeTransfer is not HIPAA-certified, so if your content is subject to HIPAA, confirm your compliance obligations before use."
- Secure file sharing built for healthcare teams | WeTransfer — Vendor page, checked 2026-10-20. "While WeTransfer is not bound by US HIPAA regulations as a Dutch company, its security architecture, Data Processing Agreements available on business plans, and strict data handling policies align closely with the principles that healthcare organizations rely on."
- Secure file sharing built for healthcare teams | WeTransfer — Vendor page, checked 2026-10-20. "Every transfer on WeTransfer is protected with TLS encryption in transit and AES-256 encryption at rest, stored on EU-based AWS servers in Ireland, and backed by ISO 27001 certification and full GDPR compliance, with Data Processing Agreements available on business plans."
- WeTransfer Trust Center — Trust center, checked 2026-10-20. "ISO/IEC 27001:2022"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20.
Does WeTransfer sign a BAA?
No BAA is mentioned on the pages the vendor pages, for any plan. That means there are no terms to cite, and the verdict is unknown. The pages do not say whether a BAA can be requested.
Is WeTransfer HIPAA certified?
The vendor says it holds no HIPAA certification. No HIPAA certification exists for any product, so a vendor can only offer a BAA and controls. WeTransfer does list ISO/IEC 27001:2022 on its Trust Center, which is a separate standard.
Is a Data Processing Agreement the same as a BAA?
No. WeTransfer offers DPAs on business plans, and a DPA addresses data protection obligations generally. A BAA is the contract HIPAA requires between a covered entity and a business associate that handles PHI. A DPA does not replace it.
Is data on WeTransfer encrypted and where is it stored?
The vendor publishes encryption in transit and at rest, and its data residency is the EU on AWS in Ireland. Encryption and location do not by themselves make a service suitable for PHI without a signed BAA.