Venice Family Clinic Replaced UCLA-Hosted SFTP with Automated PHI Exchange on Files.com

Venice Family Clinic is a community health center in Los Angeles, providing primary and specialty care to a low-income patient population. Its IT historically depended on infrastructure hosted within UCLA’s systems.

Patient care produces data obligations. Pharmacy and billing workflows mean patient data moving between the clinic and its pharmacies, payers, and other healthcare organizations. Those transfers carry protected health information under HIPAA, and none of it can travel through a channel the clinic cannot vouch for.

Patient Data on Borrowed Servers

For years, that movement ran on manual and ad-hoc processes. When a partner needed billing or pharmacy data, someone at the clinic handled the exchange by hand. The SFTP hosting behind it was borrowed: servers run inside the university’s infrastructure, prone to cycling their IP addresses. System-to-system exchange assumes an endpoint that stays where a partner last found it, and an address that keeps changing is an address no partner can build a scheduled connection against. The clinic also needed a file-transfer vendor willing to sign a business associate agreement before it could open automated, machine-to-machine PHI exchange with its trading partners.

The arrangement survived because, for a safety-net organization, borrowing was rational. Standing up a HIPAA-grade SFTP estate of its own would have meant servers to patch, per-partner credentials to manage, access controls to enforce, and a vendor willing to sign a BAA. That is the kind of estate a hospital system’s IT department operates, and it would have fallen to a small application team focused on keeping the clinic’s systems running. Borrowed hosting was the sensible answer right up until partner exchange had to become systematic. Opening daily, credentialed, automated feeds with pharmacies and payers required exactly what the borrowed arrangement could not provide.

An SFTP Service of Its Own, With a BAA to Cover It

The service had to be hosted, so there was nothing for the team to run or patch. It had to speak SFTP, because that is the protocol pharmacy and payer systems bring. It had to keep each trading partner in its own lane and control where each could connect from. And the vendor had to sign a business associate agreement, because the platform would carry PHI.

Venice Family Clinic selected Files.com to be that platform, and Files.com signed a BAA covering the exchange.

One Locked-Down Account per Trading Partner

The rollout went partner by partner through the spring of 2024, in working sessions with the Files.com onboarding team. Each trading partner received its own SFTP credential, restricted folder, and approved IP list, isolating one partner’s exchange from another.

A Files.com Automation routed pharmacy intake files to the location the clinic’s processing expected. The clinic’s existing WinSCP job then pulled each file down, and PowerShell processed it into the clinic’s database. Files.com replaced the hosting, not the pipeline behind it, so the downstream processing the team had already built kept working unchanged.

The first pharmacy workflow went live with production data moving between Files.com and the clinic’s partners in June 2024.

Daily Automated Exchange Since June 2024

With the Files.com exchange in production, Venice Family Clinic replaced improvised, manual partner transfers with a standing pattern it owns.

• Pharmacy, billing, and payer data moves through daily automated SFTP transfers covered by a signed BAA. Those exchanges no longer require someone at the clinic to move patient data by hand.
• Every partner connects with its own credential, reaches only its own folder, and can connect only from its approved addresses, with country-level blocking enforced at the platform.
• The configuration has run since going live without intervention. The servers, protocol stack, and endpoint are Files.com’s to operate, so the clinic’s application team carries no file-transfer infrastructure.
• Bringing on the next trading partner repeats a pattern that already exists: a new account, an allowlist, and a folder. What used to be an improvisation is now a template.

The Exchange Layer Is Now the Clinic’s Own

Venice Family Clinic did not have to build a managed file transfer estate to meet the bar its trading partners set for exchanging patient data. Files.com is that estate, run as a service—which is what put compliant, automated partner exchange within reach of a safety-net clinic’s application team.