Old Republic Replaced Box with Files.com During Its PHI Backend Migration to Azure

Old Republic International is a specialty insurance group organized around deliberately decentralized operating companies, each a specialist in its market with decision-making placed close to the customer and the risk. Old Republic General Services (ORGS) is the shared-services organization that provides IT and corporate services to those operating companies.

The group launched Old Republic Accident & Health, a new underwriting subsidiary focused on employer stop-loss coverage that protects self-funded employers against catastrophic or higher-than-expected medical claims. That business runs on healthcare data. Hospital partners send Accident & Health the files its underwriting and claims work depends on, and those files carry PHI regulated under HIPAA. For this subsidiary, taking in regulated files from outside partners was never a side channel. It was the front door of the business. ORGS would use Files.com as a fixed, governed SFTP perimeter for hospital PHI while the processing environment behind it moved from an on-prem shared drive to Azure.

PHI Came In Through Box and Disappeared Onto a Shared Drive

The intake path Accident & Health started with was manual end to end. Hospital partners deposited files into Box.com. Staff then hand-carried each file out of Box and onto an on-prem shared network drive, where the actual processing happened.

The cost was a chain of custody that broke at exactly the moment it mattered. Once a PHI-bearing file landed on the shared drive, there was no audit trail and no governance over where it went next. Nobody could establish who owned the file, where it currently sat, or who had touched it. For a division whose entire intake is regulated hospital data, that was not a paperwork gap. It was the wrong posture for the whole life of every file the business received. And every transfer consumed staff effort, because people were the mechanism moving files between the drop point and the processing environment.

A New IT Department and an Estate Already in Motion

The obvious fix, modernizing the infrastructure that received the files, was already underway and could not be rushed. ORGS had stood up its own independent IT department in mid-2024, taking over infrastructure previously run by another subsidiary's IT group, and the estate it inherited was entirely on-prem and co-located, in the middle of a migration to Azure. Waiting for that migration to finish meant leaving hospital PHI flowing through Box and an ungoverned drive in the meantime. Building an interim path on the on-prem estate meant asking 15 hospital partners to adopt something that would be torn out again before the migration was done.

What the fix had to do was clear. It had to give hospitals a compliant place to send regulated files immediately: covered by a HIPAA business associate agreement, reachable over SFTP so partners could use the transfer clients they already run, recording custody of every file from the moment of arrival, and able to deliver files onward to the on-prem systems doing the work today without tying the design to that infrastructure. ORGS selected Files.com to be that governed intake layer.

A Fixed Intake Point in Front of a Moving Estate

Files.com became the perimeter for Accident & Health's regulated files: the fixed point hospitals connect to, independent of the storage behind it.

ORGS stood up a dedicated Files.com child site for Accident & Health, giving the division an appropriately bounded environment with administrative credentials that extended no further than necessary.

“This is perfect because now you can be more restrictive with who gets certain administrative credentials.”

Hospitals connect over SFTP, the protocol their systems already speak. ORGS piloted the intake with a single hospital partner, then widened it to all 15. On the delivery side, ORGS used the Files.com Agent inside its own environment to move inbound files onward to the on-prem systems over an outbound-only connection, with no inbound firewall changes required. And because hospitals connect to Files.com rather than to the storage behind it, the intake endpoint holds still while the infrastructure behind it moves to Azure.

Every file that arrives carries its history with it. Files.com records each upload, move, and delivery in an audit trail tied to the file, under a HIPAA BAA, from the moment a hospital's transfer lands.

Custody of Every File, at 500 GB a Month

With the Files.com intake in production, Accident & Health replaced a relay built on Box and hand-carrying with a governed SFTP path that holds custody of every file from arrival.

• Regulated files have a complete custody and audit history. Who owns a file, where it sits, and who has touched it is a lookup in the log, not a reconstruction. The old workflow had no record at all once a file left Box.
• The manual relay is gone. No one at Accident & Health carries files between Box and a network drive; files arrive over SFTP and are delivered onward automatically.
• All 15 hospital partners send through the same governed path, moving roughly 500 GB a month and growing.
• Adding the next hospital partner is a credential and a folder on the same site, not a new workflow.

“We have a complete record. We know who owns that file at all times and where it's at and who's touched it.”

The Perimeter Went In First

When a compliance gap sits on top of aging infrastructure, the instinct is to fix the infrastructure first and the intake second. ORGS did it in the other order. Files.com went in as the governed perimeter while the on-prem-to-Azure migration continued behind it, and the hospitals never had to care which side of that migration their files landed on. Today, an Accident & Health analyst starts work on a hospital file that arrived with its custody history already attached, and when anyone asks where a regulated file went, the answer comes out of the Files.com log rather than out of anyone's memory. The backend did not have to be modernized before the regulated intake could be secured. The perimeter went first, and the estate keeps moving behind it.