BAA guide
Is Box HIPAA compliant?
Plan by plan, from Box's own pages.
Only on a plan where the vendor signs a BAA. Box is not HIPAA compliant on its own. Enterprise, Enterprise Plus, and Enterprise Advanced: Box says an enterprise admin or co-admin requests the BAA from the Admin Console, and the BAA should be signed before any PHI is stored. Personal, Starter, and Business: no BAA. Box says customers who must comply with HIPAA need an Enterprise, Enterprise Plus, or Enterprise Advanced account.
Checked against Box's own pages, linked in the table.
Which Box plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Enterprise | BAA only if the condition is met | Box says an enterprise admin or co-admin requests the BAA from the Admin Console, and the BAA should be signed before any PHI is stored. | Box signs BAA addendums to with its customers who have an Enterprise, Enterprise Plus, or Enterprise Advanced account and want to be HIPAA compliant.support.box.com |
| Enterprise Plus | BAA only if the condition is met | Box says an enterprise admin or co-admin requests the BAA from the Admin Console, and the BAA should be signed before any PHI is stored. | Box signs BAA addendums to with its customers who have an Enterprise, Enterprise Plus, or Enterprise Advanced account and want to be HIPAA compliant.support.box.com |
| Enterprise Advanced | BAA only if the condition is met | Box says an enterprise admin or co-admin requests the BAA from the Admin Console, and the BAA should be signed before any PHI is stored. | Box signs BAA addendums to with its customers who have an Enterprise, Enterprise Plus, or Enterprise Advanced account and want to be HIPAA compliant.support.box.com |
| Personal | No BAA | Box says customers who must comply with HIPAA need an Enterprise, Enterprise Plus, or Enterprise Advanced account. | However, customers who are required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates, must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA).support.box.com |
| Starter | No BAA | Box says customers who must comply with HIPAA need an Enterprise, Enterprise Plus, or Enterprise Advanced account. | However, customers who are required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates, must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA).support.box.com |
| Business | No BAA | Box says customers who must comply with HIPAA need an Enterprise, Enterprise Plus, or Enterprise Advanced account. | However, customers who are required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates, must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA).support.box.com |
Training, retention, and access logs
- Access logs
- Box lists reporting and audit trail of account activities on both users and content among its product features.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Box sign a BAA?
Yes. Box says it signs BAA addendums with customers who have an Enterprise, Enterprise Plus, or Enterprise Advanced account.
How do we request a BAA from Box?
Box says an enterprise admin or co-admin can request one in the Admin Console under Account and Billing, in the HIPAA Compliance section. Box says its Legal Operations team emails the addendum in 3 to 5 business days.
Can we use Box Personal, Starter, or Business with PHI?
Box says customers who are required by law to comply with HIPAA must have an Enterprise, Enterprise Plus, or Enterprise Advanced account and sign a BAA. Personal, Starter, and Business are not on that list.
Does signing the BAA make our Box account compliant on its own?
No. Box says customers must also configure Box and enforce policies within their organizations to meet HIPAA requirements.
Related
- Is Google Drive HIPAA compliant?
- Is Dropbox HIPAA compliant?
- Is Zoom HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Microsoft Teams HIPAA compliant?
- Is Microsoft 365 HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: Box's own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free