Is Dropbox HIPAA compliant?

Yes, for a team on a Standard, Advanced, Enterprise or Education plan that has signed Dropbox's BAA (business associate agreement) before any patient information goes in; a team admin signs it in the admin console. Neither Dropbox HIPAA page names a free or personal account, so those accounts appear to have no BAA.

Which Dropbox plans does the BAA cover?

According to Dropbox's Trust Center compliance page, Dropbox signs BAAs for Standard, Advanced, Enterprise and Education customers who need one for HIPAA/HITECH. Its HIPAA/HITECH help article says its information applies to certain teams on those plans and on Business, Business Plus and Dropbox Sign. The table below lists every plan named on either page, plus free and personal accounts.

Does the Dropbox BAA cover Business, Business Plus or Dropbox Sign?

The Dropbox BAA's coverage of Business, Business Plus and Dropbox Sign is unclear, because only the help article's scope line names them. The Trust Center's BAA sentence leaves all 3 out, and neither Dropbox page explains the difference. A practice on one of those plans should treat its coverage as unconfirmed until Dropbox confirms it.

How does a team sign a Dropbox BAA?

A team admin can sign the Dropbox BAA on the Account page in the admin console. The help article says team admins can sign a BAA themselves, and Dropbox's Trust Center limits e-signing in the admin console to US-based customers. Customers outside the United States cannot use that e-signing path. Until a team admin signs, no BAA is in place, and the help article says the BAA must be in place before patient information goes into the account.

What does the Dropbox BAA leave out?

Dropbox's BAA leaves out third-party apps and integrations and Dash, and signing a BAA as a team rules out reseller support for that team. The help article describes third-party apps and integrations as outside Dropbox's included services, so patient information that passes through an outside app has no BAA coverage from Dropbox. Dash, including Dash in Dropbox, is not supported for HIPAA compliance, so a team should keep patient information out of it. A team that gets support through a reseller should weigh that before signing.

Can a free or personal Dropbox account hold patient information?

A free or personal Dropbox account should not hold patient information, because neither Dropbox HIPAA page describes a BAA for one. That conclusion is an inference, since both pages describe BAA signing in terms of team plans or team admins and Dropbox does not state the rule. A practice that wants patient information in Dropbox needs a team plan, and Dropbox directs customers who want a team plan to its sales team.

What must a practice set up before putting patient information in Dropbox?

A practice must have a BAA in place before patient information goes into its Dropbox account. The setup has 3 steps:

1. Get a team plan. Customers who want a team plan are directed to Dropbox sales.
2. Have a team admin sign the BAA on the Account page in the admin console. E-signing there is limited to US-based customers.
3. Put patient information into the account only after the BAA is in place.

A practice on Business, Business Plus or Dropbox Sign should settle its coverage with Dropbox before step 3, because only the help article names those plans.

Does Fax Pigeon sign a BAA for faxed patient documents?

Yes, Fax Pigeon signs a BAA at signup on every plan, so a practice can fax patient documents under a signed BAA. A PDF, a Word, Excel or PowerPoint file, or a phone photo uploads as it is. For the rule behind a fax BAA, read whether a fax service needs a BAA. For Dropbox fax, see whether Dropbox fax is HIPAA compliant.

* Dropbox's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Dropbox.