Is Box HIPAA compliant?

Yes, for a Box Enterprise, Enterprise Plus or Enterprise Advanced account that has a signed BAA before any patient information is stored. An Enterprise admin or co-admin requests the BAA in the Admin Console. Box's FAQ names no other account for signing, so Personal, Starter and Business accounts appear to have none.

Which Box accounts can sign a BAA?

Box offers a BAA to customers on the Enterprise, Enterprise Plus and Enterprise Advanced accounts that want HIPAA compliance. According to Box's HIPAA and HITECH Overview and FAQ, covered entities and business associates must hold one of those 3 accounts with Box and sign a BAA. The table below sets out each account type on those terms.

Do all Box account types have the same security controls?

Yes, Box's HIPAA and HITECH Overview and FAQ says all account types, from Personal through Enterprise Advanced, get identical security and privacy controls. Only the 3 Enterprise tiers are named for signing a BAA, so BAA eligibility follows the account tier. A practice that wants a BAA therefore starts by choosing an Enterprise-tier account.

What does the Box BAA leave out?

Box's BAA leaves out partner products and OneCloud apps unless a BAA covers them, because the FAQ says they are not automatically HIPAA compliant. A practice that connects a partner product to Box should keep patient information out of it until that partner's BAA is in place.

Does Box sign a BAA for partner products?

Box says it can sign a direct BAA with a partner, and separately with the partner's customer when needed. A partner that handles patient information must sign its own BAA with the customer, and the customer should also have a BAA with Box.

Which Box features does the BAA cover?

Box's HIPAA and HITECH Overview and FAQ does not list which Box services or features the BAA covers or excludes. It describes controls and features only in general terms, so a practice cannot read a feature-by-feature scope from it. A practice that depends on a specific Box feature for patient information has no list in the FAQ to check it against.

What must a practice set up before storing patient information in Box?

A practice must hold an Enterprise-tier Box account, and a signed BAA should exist before patient information is stored on Box. The setup has 4 steps:

1. Hold an Enterprise, Enterprise Plus or Enterprise Advanced account with Box.
2. An Enterprise admin or co-admin opens Account & Billing in the Admin Console, goes to the HIPAA Compliance section, and chooses the request option.
3. Complete the BAA request form, which collects details on the customer's organization and on who will sign, so decide the signer before starting.
4. Store patient information on Box only after the signed BAA exists.

Can a free or Personal Box account hold patient information?

A Personal Box account should not hold patient information, because only the 3 Enterprise tiers are named for signing a BAA. Box's FAQ does not use the word free, and it does not say whether Personal is a free tier. Box does not state that Personal, Starter and Business accounts cannot sign a BAA; that follows by inference from the 3 Enterprise tiers being the only accounts named for signing. A practice on one of those accounts would need an Enterprise-tier account before it can sign.

Where can a practice fax patient documents under a BAA?

A practice can fax patient documents under a BAA with Fax Pigeon, which signs a BAA at signup on every plan. Every delivered fax gets delivery proof. The general rule is covered in whether a fax service needs a BAA, and which online fax services sign a BAA covers other vendors.

* Box's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Box.