D
On some plansIs Dropbox HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Dropbox lets certain admins on team plans sign a BAA electronically in the admin console, and says a BAA must be in place before PHI is transferred. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Standard | Covered |
| Business | Covered |
| Advanced | Covered |
| Business Plus | Covered |
| Enterprise | Covered |
What the BAA leaves out
- Dropbox Dash, including Dash in Dropbox, does not support HIPAA compliance per Dropbox
- Third-party apps and integrations are outside Dropbox’s services and the BAA
How to get the BAA
A qualifying team admin goes to Admin console, Settings, Team profile, then under Advanced selects Set up BAA; electronic signing is for US-based customers only.
What the vendor says to do
- Sign the BAA before moving PHI into the account
- Configure sharing permissions
- Disable permanent deletions
- Monitor account access and activity
- Review the third-party apps linked to accounts or the team
Proof from the vendor
- Dropbox and HIPAA/HITECHApplicable teams, BAA timing, Dash and third-party exclusions, setup recommendations, US-only electronic signing
- Sign a Business Associate Agreement for your Dropbox team accountEligible team plans, signing steps, reseller support limit
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.