Morris Hospital Replaced Its Citrix File-Transfer Platform With One HIPAA-Covered Files.com Exchange

Morris Hospital & Healthcare Centers is an Illinois community healthcare system operating a hospital and affiliated outpatient and specialty care sites across 14 locations.

None of that care runs on the hospital’s systems alone. Its electronic health record integration depends on eClinicalWorks, while claims traffic moves to and from Change Healthcare. Outside support vendors need documents sent out and results returned. For a multi-site provider whose clinical and billing systems extend beyond its walls, file transfer is not a convenience. It is standing clinical infrastructure.

A Citrix file-transfer platform carried this traffic, and Morris Hospital decided to retire it. Morris Hospital replaced it with one HIPAA-covered Files.com layer that could handle SFTP, AS2, and PGP, reach its datacenter without inbound internet exposure, and govern transfers between otherwise disconnected external systems.

Patient Data in Transit Is a Standing Condition, Not an Event

Moving production PHI made this HIPAA-scope work. It required a platform covered by a business associate agreement, encrypted transport, and a defensible answer for where patient data sat at every step. If the transfer layer stalled, clinical and billing data stopped moving between the hospital and the external systems its operations depended on.

The estate also spanned systems the hospital did not control. External partners dictated their own protocols and processes; when the hospital connected its EHR feed, eClinicalWorks had to stand up and test SFTP on its side before anything could go live. Other exchanges required PGP encryption, AS2, server-to-server relays, or two-way document exchange with support vendors.

Two Agents Extended Files.com Into the Hospital’s Datacenter

Two on-premises Files.com Agents were deployed inside the hospital’s datacenter and connected outbound to the platform. Internal systems could participate in each workflow, while nothing inside the hospital’s network was opened to inbound traffic.

Clinical data exchange with eClinicalWorks and Change Healthcare was configured over SFTP. PGP protected file contents where partners required it, while AS2 counterparties connected through the same Files.com environment.

A Governed Hop Between Servers That Will Never Talk to Each Other

Files.com also absorbed two exchange patterns that had no natural home in a conventional transfer setup.

Using Remote Server Sync and Remote Server Mount, Files.com connected directly to external SFTP servers. Files were pulled from one external system, landed on the Files.com site, and were pushed to another. Two systems that would never connect directly could exchange data through one governed, logged middle hop instead of a custom integration.

For two-way document exchange with an external support vendor, Morris Hospital used a Files.com share link with an attached inbox. The vendor could download documents and upload results through the same page without an account or integration project.

From Signed BAA to Production Patient Data in the Same Month

The migration established both a rapid go-live and a reusable operating model:

• The HIPAA BAA was signed in March 2021, and production patient data was moving on Files.com that same month.
• EHR and clearinghouse exchange, server-to-server partner relays, and two-way vendor document exchange now run through one platform under one HIPAA boundary.
• Adding another healthcare counterparty now starts with a connection on the existing governed layer—a remote server, an AS2 partner, or a share link—rather than new bespoke plumbing.

One Boundary for Patient Data, Whatever the Partner Dictates

For a community health system whose patient data never stops moving, the change is fundamental — the question a new partner raises is no longer how to build the exchange, only where on Files.com to connect it.