A Community Nonprofit Receives County Biometric Screening Data Through a BAA-Covered Files.com Folder

A regional community nonprofit provides fitness, child care, camps, and community health programs through branches across its region.

Less visible than the pools and gymnasiums is a clinical-data operation. The nonprofit runs health screenings with area employers and in partnership with local government. That government partnership brought a hard requirement: Screening data is protected health information, and it had to move securely between a county government and the nonprofit.

A Government Health Partnership Set the Requirement

The county partnership was designed to run one way: The county produced biometric screening data, and the nonprofit’s staff took delivery of it. The nonprofit wanted one governed path for that protected health information, covered by a business associate agreement and scoped to the county alone. The screening partnership depended on a channel the nonprofit could stand behind under HIPAA.

The county was the sharpest case of a wider need. Peer nonprofits in the region, a credit union partner, and vendors returning W-9s also needed a straightforward way to send the organization a document and have it land in a folder it controls.

The Channel Had to Carry the Compliance Without Burdening Senders

The nonprofit is not a healthcare IT shop. Its employees run branches, camps, child care, and screening events, so building and operating HIPAA-grade transfer infrastructure in-house was not the answer.

The channel had to do two things at once. On the nonprofit’s side, it had to be accountable under HIPAA: covered by a business associate agreement, with access scoped to each counterparty. For the county, that meant per-user accounts and a designated folder. Other partners needed an easier path: A vendor returning a tax form could upload it from a browser without installing anything or managing an account.

The nonprofit selected Files.com to be that channel.

Files.com gave the organization a way to meet the data-handling requirements of a government health partnership without building healthcare transfer infrastructure of its own.

A BAA, Scoped Folders, and an Upload Page Anyone Can Use

Files.com covered the site under a HIPAA business associate agreement, making the platform an accountable link in the exchange.

For the county, the nonprofit set up a designated folder, with per-user accounts and permissions scoping the county to its own space. County staff drop screening files in, folder-level upload notifications email the nonprofit’s staff the moment a file lands, and staff download it.

For everyone else, Files.com share links send documents out and a Files.com Inbox takes them in. Peer nonprofits, the credit union, and vendors returning W-9s open a link in a browser and upload. There is no account to create and nothing to install, and each submission lands in a folder the nonprofit controls.

In one initial setup meeting, the nonprofit created the accounts and folders, assigned permissions, and configured notifications.

The Screening Partnership Runs on One Governed Exchange Point

With the site live, the nonprofit has one governed exchange point for every partner, from the county health program to a vendor returning a W-9. County biometric data moves into a BAA-covered, scoped folder, while W-9s and other partner documents arrive through links and the Files.com Inbox.

Adding another non-technical partner requires no sender onboarding or installed software. The nonprofit can provide a share link or Inbox URL and keep the submission in a folder it controls.

A Compliance Bar Met Without Building Anything

Today, when a round of screenings finishes, a county employee drops the file, the nonprofit’s staff get an email, and the data comes down from a governed folder. Every step of that handoff sits under the BAA, inside a folder scoped to the county.

An organization whose staff run gyms and summer camps can support a government health partnership and meet the data-handling bar that comes with it. Files.com’s BAA, scoped access, and notifications provide the controlled exchange the workflow requires, while the county simply drops a file.