Skip to main content

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA is a U.S. law governing protected health information (PHI). Evaluate it when your organization handles PHI as a Covered Entity or Business Associate, including when you exchange records on behalf of a healthcare customer.

When HIPAA Applies

HIPAA establishes requirements for protecting health information within its scope. PHI includes individually identifiable health information handled by a Covered Entity or Business Associate, such as patient records and healthcare billing information, subject to the law's definitions and exclusions.

HIPAA applies to two categories of organization:

  • Covered Entities: health plans, healthcare clearinghouses, and healthcare providers that conduct specified healthcare transactions electronically.
  • Business Associates: organizations performing certain functions or services for a Covered Entity that involve creating, receiving, maintaining, or transmitting PHI. Subcontractors handling PHI for a Business Associate can also have Business Associate obligations.

Working in healthcare or holding information related to health does not, by itself, establish that every record or organization falls under HIPAA. Identify your role and the information involved before selecting the agreement and configuration. The U.S. Department of Health and Human Services explains Covered Entities and Business AssociatesExternal LinkThis link leads to an external website and will open in a new tab.

Organizations in either category must maintain the confidentiality, integrity, and availability of PHI in storage and in transit, and must implement technical and organizational safeguards.

Files.com as a Business Associate

Files.com supports HIPAA-regulated use on an Enterprise plan, with an executed Business Associate Agreement (BAA) and the required maximum-security configuration. These conditions apply together; a plan subscription or an encrypted connection alone does not establish compliant handling of protected health information (PHI).

When Files.com stores or transmits PHI on behalf of a Covered Entity, Files.com acts as a Business Associate under HIPAA.

Files.com offers a pre-written and pre-approved Business Associate Agreement (BAA) that we execute with any customer on an Enterprise plan. The BAA defines the roles and responsibilities of both Files.com and the customer for handling PHI in compliance with HIPAA.

HIPAA support, including BAA execution, is not available on the Starter or Power plans.

Security Configuration Requirements

The Files.com BAA requires customers to configure their site according to our Configuring Files.com for Maximum Security documentation, which covers:

  • Two-Factor Authentication (2FA)
  • Role-based access controls and least-privilege permissions
  • IP allowlisting
  • Session timeout and expiration settings
  • Encryption in transit and at rest
  • Logging and audit trail configuration
  • Remote Server Mounting for compliant storage backends (when needed)

These configuration steps are required to protect PHI in accordance with HIPAA's Security Rule.

Requesting a BAA

Customers on an Enterprise plan who want to sign a BAA with Files.com can contact their Account Executive or our customer support team. BAAs are not offered on the Starter or Power plans, and customers must follow our security configuration guidelines to activate HIPAA-compliant usage.

Shared Responsibility

HIPAA compliance using Files.com is a shared responsibility. Files.com provides the infrastructure, tools, and documentation. You are responsible for how the platform is configured and for ensuring your team handles PHI in accordance with HIPAA.

Work with your compliance, security, or legal team to confirm that your implementation of Files.com satisfies all relevant HIPAA obligations. For help configuring your site for HIPAA compliance, contact our support team.