Venice Family Clinic Automates PHI Exchange With Pharmacies and Payers on Files.com SFTP Under a BAA

Venice Family Clinic is a community health center in Los Angeles, providing primary and specialty care to a low-income patient population. Its systems are run by a small application team.

Patient care produces data obligations. Pharmacy and billing workflows mean patient data moving between the clinic and its pharmacies, payers, and other healthcare organizations. Those transfers carry protected health information under HIPAA, and none of it can travel through a channel the clinic cannot vouch for.

Partner Exchange Had to Become Systematic

The clinic wanted one governed path for that data: a standing SFTP endpoint each pharmacy and payer could build a scheduled connection against, with every trading partner isolated from the others and a signed business associate agreement over the whole exchange. System-to-system exchange assumes an endpoint that stays where a partner last found it, and the clinic needed a file-transfer vendor willing to sign a BAA before it could open automated, machine-to-machine PHI exchange with its trading partners.

For a safety-net organization, standing up a HIPAA-grade SFTP estate of its own would have meant servers to patch, per-partner credentials to manage, access controls to enforce, and a vendor willing to sign a BAA. That is the kind of estate a hospital system’s IT department operates, and here it would have fallen to a small application team focused on keeping the clinic’s systems running. Daily, credentialed, automated feeds with pharmacies and payers called for an estate, and the clinic wanted one it did not have to operate.

An SFTP Service of Its Own, With a BAA to Cover It

The service had to be hosted, so there was nothing for the team to run or patch. It had to speak SFTP, because that is the protocol pharmacy and payer systems bring. It had to keep each trading partner in its own lane and control where each could connect from. And the vendor had to sign a business associate agreement, because the platform would carry PHI.

Venice Family Clinic selected Files.com to be that platform, and Files.com signed a BAA covering the exchange.

One Locked-Down Account per Trading Partner

The rollout went partner by partner through the spring of 2024, in working sessions with the Files.com onboarding team. Each trading partner received its own SFTP credential, restricted folder, and approved IP list, isolating one partner’s exchange from another.

A Files.com Automation routed pharmacy intake files to the location the clinic’s processing expected. The clinic’s existing WinSCP job then pulled each file down, and PowerShell processed it into the clinic’s database. Files.com replaced the hosting, not the pipeline behind it, so the downstream processing the team had already built kept working unchanged.

The first pharmacy workflow went live with production data moving between Files.com and the clinic’s partners.

Daily Automated Exchange Since Going Live

With the Files.com exchange in production, Venice Family Clinic runs partner exchange as a standing pattern it owns.

• Pharmacy, billing, and payer data moves through daily automated SFTP transfers covered by a signed BAA. Those exchanges run machine to machine, with no one at the clinic in the loop.
• Every partner connects with its own credential, reaches only its own folder, and can connect only from its approved addresses, with country-level blocking enforced at the platform.
• The configuration has run since going live without intervention. The servers, protocol stack, and endpoint are Files.com’s to operate, so the clinic’s application team carries no file-transfer infrastructure.
• Bringing on the next trading partner repeats a pattern that already exists: a new account, an allowlist, and a folder. The next partner is a template, not a project.

An Exchange Layer the Clinic Owns Without Operating

Venice Family Clinic did not have to build a managed file transfer estate to meet the bar its trading partners set for exchanging patient data. Files.com is that estate, run as a service, which is what put compliant, automated partner exchange within reach of a safety-net clinic’s application team.