A Behavioral Health Provider Exchanges Patient Records With Outside Organizations Through Files.com Inboxes and Share Links

A US nonprofit provider of behavioral and mental healthcare serves children, teens, and families. Its services span residential, outpatient, and community-based programs, with a records function responsible for exchanging protected health information (PHI) with outside organizations.

Care never happens inside one organization. Patient records move between the provider and outside organizations as children receive treatment and return to their schools or communities. At each of those handoffs, the child’s medical record has to move between the provider and an organization the provider does not control.

With Files.com, the provider runs every patient record exchange through one governed front door that outside organizations use without creating accounts or installing software.

Every Counterparty Had to Be Able to Use It

The provider wanted one governed path for those records: a single access-controlled surface, covered by a HIPAA business associate agreement (BAA), that every organization on the other side of an exchange could use without being set up first. The path also had to carry a complete medical history in one transfer. Email attachments cap out well before that size.

The organizations on the other side of an exchange are not the provider’s to manage. They cannot be told to install software or to hold accounts on the provider’s systems before a record can move. Any replacement had to be as easy for the sender as attaching a file to an email. If it asked more of the sender than that, it would not get used.

A Password-Protected Front Door for Outside Partners

Files.com met that requirement while keeping each exchange inside one access-controlled boundary. It became the single point of exchange for patient records: inboxes took files in, share links sent them out, and the whole surface sat under the provider’s signed BAA with Files.com.

The provider set up password-protected Files.com Inboxes for departments receiving files from outside. An organization with a record to send opened the department’s page, entered the password, and uploaded, with no account to create and nothing to install. Each uploader saw only its own session, never what another organization had sent, and the file landed in the correct department’s controlled folder.

Share links carried records in the other direction. The recipient followed a link and downloaded the file in a browser, again without an account. A share link could carry a complete medical history in a single transfer, at sizes an attachment could not.

One Governed Exchange for Every Record That Moves

With the Files.com workflow in production, the provider runs every patient record exchange through one governed surface.

• Patient medical records move to and from outside organizations through a single access-controlled surface covered by a signed HIPAA BAA. Every exchange lands inside a boundary the provider controls.
• Outside partners send records with nothing asked of them beyond a web page and a password. A path every counterparty can use on the first try is the one that gets used.
• A complete patient medical history goes out as one share link and one download, whatever its size.
• What began in a single department now runs intake for departments across the organization, and bringing on the next one is another inbox, not another project.

A Web Page and a Password

The provider did not build a patient portal, and it did not ask its partners to change how they work. It gave them one place to send the files. On the outside, the Files.com front door asks less of a partner than an attachment does. On the inside, it gives the provider one boundary around every record that moves, with the organization’s own controls on it.