Is iCloud HIPAA compliant?

No. Apple's iCloud terms say a covered entity or business associate will not use any component, function or other facility of iCloud to create, receive, maintain or transmit any protected health information, or use iCloud in any manner that would make Apple its business associate. The BAA Apple presents is for the Health app's Share with Provider feature.

Does Apple sign a BAA that covers iCloud?

Apple's iCloud terms show no BAA for iCloud, and they bar a covered entity or business associate from using iCloud in any manner that would make Apple its business associate. The agreement Apple does present is a HIPAA Business Associate Agreement for the Health app's Share with Provider feature, and Apple's Health Records registration page asks registrants to respond to it. That agreement belongs to the Health app feature.

Apple's iCloud terms settle the question for iCloud itself: they bar a covered entity or business associate from putting protected health information in it.

Which iCloud accounts and features have a BAA?

Only the Health app's Share with Provider feature is shown with a BAA, and no iCloud account is shown with one.

The table sorts Apple's terms by account and feature.

Of the 4 rows, only the Health app row says yes, and it names a single feature.

What does the iCloud restriction leave out?

The iCloud restriction leaves no part of iCloud out, because it applies to any component, function or other facility of iCloud. In Apple's iCloud terms, a covered entity or business associate, or a representative of one as defined at 45 C.F.R. 160.103, will not use iCloud to create, receive, maintain or transmit any protected health information. The same clause bars using iCloud in any manner that would make Apple its business associate.

Are iMessage and FaceTime covered by a BAA?

Apple's iCloud terms show no BAA for iMessage or FaceTime. iMessage appears in those terms only as a channel for Apple's notices, and FaceTime does not appear in them. Neither has a BAA or protected health information term there, so a practice should not treat either as covered on the strength of those terms.

Can a free or consumer iCloud account hold patient information?

No, a free or consumer iCloud account should not hold patient information, because the terms that allocate each account 5GB of iCloud storage also contain Apple's restriction on covered entities and business associates. The restriction therefore applies to a free or consumer account as it does to any other.

Does Apple's Health app BAA make iCloud usable for patient information?

Apple's Health app BAA does not appear to make iCloud usable for patient information, because the agreement is titled for one feature and the iCloud terms keep their own restriction for covered entities and business associates. Apple's Health Records registration page asks registrants to respond to that agreement. A practice therefore has no basis in the iCloud terms for putting patient information in iCloud.

What must a practice set up before using iCloud for patient information?

No setup step in Apple's iCloud terms makes iCloud usable for patient information, because those terms restrict that use.

• Do not create, receive, maintain or transmit protected health information in iCloud, since the terms bar covered entities and business associates from doing so.
• For the Health app's Share with Provider feature, respond to the Business Associate Agreement that Apple's Health Records registration page presents.

Can a practice fax patient documents from a phone instead?

Yes, a phone photo uploads to Fax Pigeon as it is, with an optional cover sheet, and Fax Pigeon signs a BAA at signup on every plan. Every delivered fax gets delivery proof. For the phone steps, see how to fax from your phone under HIPAA, and for the BAA rule, see whether you need a BAA with your fax service.

* Apple's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Apple.