B
On some plansIs Box HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Box says only Enterprise, Enterprise Plus and Enterprise Advanced accounts can sign a BAA, requested by an admin from the Admin Console. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Account types other than the three Enterprise tiers named by Box | Not covered |
| Enterprise | Covered |
| Enterprise Plus | Covered |
| Enterprise Advanced | Covered |
What the BAA leaves out
- Third-party apps and partners are not automatically covered; a partner handling PHI needs its own BAA with the customer
How to get the BAA
An enterprise admin or co-admin goes to Admin Console, Account & Billing, HIPAA Compliance, selects Request a HIPAA BAA, and Box Legal Operations emails the addendum in 3 to 5 business days.
What the vendor says to do
- Have a signed BAA in place before storing PHI
- Grant explicit access to files and monitor access
- Review audit trails and reporting
- Control who can access, change and delete data, and revoke accounts when needed
Proof from the vendor
- Box HIPAA and HITECH Overview and FAQEligible plans, request process, timing, partner BAA requirement, configuration duties
- HIPAA-Compliant File Sharing & Cloud Storage: HealthcareMarketing statement that Box signs BAAs with clients storing PHI
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.