YMCA of Greater Dayton Handles County Biometric Data With Files.com’s HIPAA BAA—Without Building Healthcare Infrastructure

The YMCA of Greater Dayton is a nonprofit health and human services organization with branches across Ohio’s Greater Miami Valley and roughly 2,200 employees, providing fitness, child care, camps, and community health programs.

Less visible than the pools and gymnasiums is a clinical-data operation. The Y runs health screenings with area employers and in partnership with local government. That government partnership brought a hard requirement: Screening data is protected health information, and it had to move securely between a county government and the Y.

A Health Program With No Compliant Way to Move Its Data

The county partnership was designed to run one way: The county produced biometric screening data, and YMCA staff took delivery of it. The Y needed its transfer of that protected health information to meet HIPAA requirements. Without a compliant channel, the Y had no proper way to receive the county’s files, and the screening partnership depended on receiving them.

The county was the sharpest case of a wider need. Other Ohio YMCAs, a credit union partner, and vendors returning W-9s also needed a straightforward alternative to exchanging documents by email.

The Channel Had to Carry the Compliance Without Burdening Senders

The YMCA is not a healthcare IT shop. Its employees run branches, camps, child care, and screening events, so building and operating HIPAA-grade transfer infrastructure in-house was not the answer.

The channel had to do two things at once. On the Y’s side, it had to be accountable under HIPAA: covered by a business associate agreement, with access scoped to each counterparty. For the county, that meant per-user accounts and a designated folder. Other partners needed an easier path: A vendor returning a tax form could upload it from a browser without installing anything or managing an account.

The YMCA of Greater Dayton selected Files.com to be that channel.

What changed is what the Y can agree to. Files.com gave the organization a way to meet the data-handling requirements of a government health partnership without building healthcare transfer infrastructure of its own.

A BAA, Scoped Folders, and an Upload Page Anyone Can Use

Files.com covered the site under a HIPAA business associate agreement, making the platform an accountable link in the exchange.

For the county, the Y set up a designated folder, with per-user accounts and permissions scoping the county to its own space. County staff drop screening files in, folder-level upload notifications email YMCA staff the moment a file lands, and staff download it.

For everyone else, Files.com share links send documents out and a Files.com Inbox takes them in. Other Ohio YMCAs, the credit union, and vendors returning W-9s open a link in a browser and upload. There is no account to create and nothing to install, and each submission lands in a folder the Y controls instead of one person’s mailbox.

In one initial setup meeting, the Y created the accounts and folders, assigned permissions, and configured notifications.

The Screening Partnership Runs, and Email Is Out of the Loop

With the site live, the YMCA replaced a compliance gap and email-based document exchanges with one governed exchange point for its partners. County biometric data moves into a BAA-covered, scoped folder, while W-9s and other partner documents arrive through links and the Files.com Inbox.

Adding another non-technical partner requires no sender onboarding or installed software. The Y can provide a share link or Inbox URL and keep the submission in a folder it controls.

A Compliance Bar Met Without Building Anything

Today, when a round of screenings finishes, a county employee drops the file, YMCA staff get an email, and the data comes down from a governed folder. Before Files.com, there was no compliant way for that handoff to happen.

An organization whose staff run gyms and summer camps can support a government health partnership and meet the data-handling bar that comes with it. Files.com’s BAA, scoped access, and notifications provide the controlled exchange the workflow requires, while the county simply drops a file.