Best HIPAA compliant cloud storage
6 tools compared. Checked 6 Nov 2026.
Storing patient files with a cloud vendor generally requires a BAA, even if the files are encrypted. Personal accounts are the usual trap.
Where to start
If you already use Google Workspace or Office 365, start with Google Drive or OneDrive. Otherwise look at Dropbox, where team admins can sign the BAA online. Don’t use iCloud, because Apple’s terms bar it.
| Tool | Result | Where the BAA applies |
|---|---|---|
| BBox | On some plans | Enterprise tiers only |
| DDropbox | On some plans | Team plans, Standard and above |
| GGoogle Drive | On some plans | Google Workspace with the BAA accepted |
| MMicrosoft OneDrive | On some plans | OneDrive for Business |
| SSharePoint | On some plans | SharePoint Online |
| IiCloud | No BAA | Apple’s terms bar it for PHI |
Box
On some plansBox says only Enterprise, Enterprise Plus and Enterprise Advanced accounts can sign a BAA, requested by an admin from the Admin Console.
Covered: Enterprise; Enterprise Plus; Enterprise Advanced.
Left out: Third-party apps and partners are not automatically covered; a partner handling PHI needs its own BAA with the customer.
See the full Box result and proofDropbox
On some plansDropbox lets certain admins on team plans sign a BAA electronically in the admin console, and says a BAA must be in place before PHI is transferred.
Covered: Standard; Business; Advanced; Business Plus; Enterprise.
Left out: Dropbox Dash, including Dash in Dropbox, does not support HIPAA compliance per Dropbox, and more.
See the full Dropbox result and proofGoogle Drive
On some plansGoogle lists Drive as covered functionality under its Workspace BAA, so the BAA route runs through a Workspace account whose super admin has accepted it.
Covered: Drive in a Google Workspace account with an accepted BAA.
Left out: Third-party apps and Docs add-ons connected to Drive.
See the full Google Drive result and proofMicrosoft OneDrive
On some plansMicrosoft lists OneDrive for Business as in scope for its HIPAA BAA, which is included by default in the Data Protection Addendum for customers who are covered entities or business associates.
Covered: OneDrive for Business under Office 365 Commercial and GCC.
Left out: Microsoft’s HIPAA page describes no coverage for consumer or personal OneDrive; it is simply not listed.
See the full Microsoft OneDrive result and proofSharePoint
On some plansMicrosoft lists SharePoint Online as in scope for its HIPAA BAA, which is included by default in the Data Protection Addendum for customers who are covered entities or business associates.
Covered: SharePoint Online under Office 365 Commercial and GCC.
See the full SharePoint result and proofiCloud
No BAAApple’s iCloud terms bar covered entities and business associates from using the service to create, receive, maintain or transmit PHI, and from using it in a way that makes Apple a business associate.
See the full iCloud result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.