HIPAA Compliant Cloud Storage: Which Providers Sign a BAA

HIPAA compliant cloud storage starts with a provider that signs a business associate agreement (BAA) for the plan you use: Dropbox, Box, Google Drive, Microsoft OneDrive and SharePoint, and Amazon S3 offer one on named business plans or services, while Apple's iCloud terms bar covered entities and business associates from using it for protected health information. The BAA is required, and HHS says you must also otherwise comply with the HIPAA Rules (HHS). Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checked each provider's own page on October 26, 2026.

Book a call. Many clinics that keep patient files in the cloud also run ads, and a storage BAA does not reach your ad tracking. Curve Compliance sends conversions to your ad platforms server-side, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

Which cloud storage providers sign a BAA?

Each row comes from the provider's own page, fetched October 26, 2026. Where the answer is specific plans, the provider offers its BAA only on the plans or products named.

Provider	Signs a BAA?	Plans or products covered	How you get it	Source
Dropbox	Specific plans	Certain teams on Standard, Advanced, Enterprise, Education, Business, Business Plus and Dropbox Sign	A team admin signs it electronically in the admin console, an option only for US-based customers	Dropbox Help Center
Box	Specific plans	Enterprise, Enterprise Plus and Enterprise Advanced accounts	An enterprise admin requests it in the Admin Console; Box emails the addendum in 3 to 5 business days	Box Support
Google Drive	Specific plans	Google Workspace and Cloud Identity accounts; Drive includes Docs, Forms, Sheets and Slides	An administrator accepts it in the Admin console	Google Workspace Help; covered services
OneDrive	Specific plans	OneDrive for Business, in commercial Office 365 and GCC	By default, through the Microsoft Online Services Data Protection Addendum	Microsoft Learn
SharePoint	Specific plans	SharePoint Online, in commercial Office 365 and GCC	The same Microsoft BAA, by default	Microsoft Learn
Amazon S3 (AWS)	Yes	Amazon S3 and Amazon S3 Glacier, on the HIPAA Eligible Services list	Accept it in AWS Artifact in the AWS Management Console	AWS HIPAA; eligible services
iCloud	No	None; the terms bar covered entities and business associates from using iCloud for protected health information	Not offered	iCloud Terms and Conditions

Each provider name links to its BAA Directory entry, with the vendor's own words. The directory also covers Google Workspace, Microsoft 365, Google Docs and Google Sheets.

What makes cloud storage HIPAA compliant

HHS's cloud computing guidance explains the rule. A covered entity or business associate may store electronic protected health information (ePHI) with a cloud provider if it "enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP" and "otherwise complies with the HIPAA Rules." Encryption does not change that: "Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules." Storing ePHI with no BAA means "the covered entity (or business associate) is in violation of the HIPAA Rules" (HHS). See what a business associate agreement is.

There is no HIPAA certification to look for. HHS says "OCR does not endorse, certify, or recommend specific technology or products" (HHS). Check instead that the provider signs a BAA for your plan, which services the BAA names, and how your account is set up.

Provider by provider

Dropbox

On the team plans in the table, an admin "can sign a BAA electronically from the Account page in the admin console," and Dropbox says "a BAA must be in place before you transfer PHI into your Dropbox account." It also says "Dash doesn’t support compliance with HIPAA, including Dash in Dropbox" (Dropbox).

Box

Box says customers required by law to comply with HIPAA "must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA)." Personal, Starter and Business accounts get the same security controls but are not on that list. An enterprise admin or co-admin requests the BAA in the Admin Console. Box adds: "Customers are responsible for configuring Box in a HIPAA compliant manner" (Box).

Google Drive

Google says customers subject to HIPAA who wish to use services on its HIPAA Included Functionality list "must enter a Business Associate Amendment (BAA) with Google," and "Administrators must review and accept a BAA before using PHI in Google services" (Google). The list names "Google Drive (including Google Docs, Google Forms, Google Photos, Google Sheets, Google Slides, and Google Vids)" (Google). Google's page describes no BAA for a personal Google account.

OneDrive and SharePoint

Microsoft says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA," and its in-scope Office 365 table lists "OneDrive for Business" and "SharePoint Online" for the commercial and Government Community Cloud (GCC) environments (Microsoft). The page describes no BAA for personal OneDrive. See the OneDrive and SharePoint entries.

Amazon S3

AWS says: "Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature." Customers "should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services defined in the Business Associate Addendum (BAA)" (AWS). Amazon Simple Storage Service (S3) and Amazon S3 Glacier are on that list, last updated October 15, 2026 (AWS).

iCloud

Apple's terms say a covered entity, business associate or representative of one agrees "that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information”" (iCloud terms). The same terms cover iCloud Backup, which "periodically creates automatic backups for iOS devices." Keep patient files, photos of patient documents and lead lists out of iCloud, including on staff phones that back up to it.

What a BAA covers, and what it does not

HHS says the BAA "establishes the permitted and required uses and disclosures of ePHI by the business associate" and requires it "to appropriately safeguard the ePHI." The provider must report security incidents to you, and the BAA must require it to "return or destroy all PHI at the termination of the BAA where feasible" (HHS). Four things sit outside it:

• Your own setup. HHS says covered entities and business associates "must conduct risk analyses," and "A CSP is not responsible for the compliance failures that are attributable solely to the actions or inactions of the customer" (HHS).
• Apps you connect. Dropbox says third-party apps are "not covered by your Dropbox terms of use, including a BAA that you might sign with Dropbox," and Google says "Third-party applications including add-ons are not included in the Included Functionality covered by the BAA" (Dropbox; Google).
• Mobile devices. For mobile access to ePHI in a cloud, HHS expects safeguards and "appropriate BAAs are in place with any third party service providers for the device and/or the cloud that will have access to the e-PHI" (HHS).
• Ad platforms. A lead list that leaves Drive or Dropbox for Meta or Google Ads goes to a company outside your storage BAA, and Curve's BAA Directory lists Meta and Google Ads as not signing one. See which ad platforms sign a BAA.

Personal accounts versus business plans

Most storage questions turn on the account type. Personal Google accounts, personal OneDrive, Dropbox accounts outside the team plans it lists, and Box Personal, Starter or Business accounts sit outside the BAA offers above. Files staff save to those accounts fall outside the BAA your organization signed, so keep PHI in the covered business account.

Settings to check after you sign

• Sharing. Google's implementation guide covers "sharing with specific recipients as opposed to anybody with the link" (Google).
• Deletion and access. Dropbox's recommendations cover "Configuring sharing permissions," "Disabling permanent deletions" and "Monitoring account access and activity" (Dropbox).
• Audit trail. Box lists "Reporting and audit trail of account activities on both users and content" among its customer controls (Box).

Lead lists, patient documents and your ads

Marketing files often land in the same storage: exported lead lists, intake PDFs and conversion spreadsheets waiting for an ad platform upload. The storage BAA does not follow a file to Meta or Google Ads; see why customer list uploads are a health privacy risk. For documents patients send you, an upload field on a form hosted under a BAA keeps the file out of email; see form builders that sign a BAA. Which rules apply depends on your setup, so talk to your counsel.

How Curve Compliance helps

Your storage BAA covers your files. Curve Compliance covers your ad tracking, under the BAA it signs on every plan. Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Outcomes reach Curve from booking systems and CRMs through incoming webhooks, or as offline conversion uploads from a CRM or EHR, and Curve credits each to the original ad click. See how to measure ads without tracking pixels.

Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For patient documents, Curve Forms adds file upload fields on forms Curve hosts under the same BAA.

Sources, checked October 26, 2026: HHS guidance on HIPAA and cloud computing; Dropbox and HIPAA/HITECH; Box HIPAA and HITECH Overview and FAQ; HIPAA Compliance with Google Workspace and Cloud Identity; Google's list of HIPAA covered services; Microsoft, HIPAA and the HITECH Act; AWS HIPAA Compliance; AWS HIPAA Eligible Services Reference; iCloud Terms and Conditions.

Frequently Asked Questions

Which cloud storage is HIPAA compliant?

Storage whose provider signs a BAA for your plan, set up to the HIPAA Rules: certain Dropbox team plans, Box Enterprise plans, Google Drive in Google Workspace, OneDrive for Business, SharePoint Online and Amazon S3 offer a BAA, and iCloud does not. HHS says the BAA has to come with compliance with the rest of the HIPAA Rules (HHS).

Is Google Drive HIPAA compliant?

It can be, inside Google Workspace, once an administrator accepts Google's BAA in the Admin console; Drive, including Docs, Sheets and Forms, is on Google's covered list (Google; covered services; Directory entry). Google's page describes no BAA for a personal Google account.

Is Dropbox HIPAA compliant?

It can be, for certain teams on Standard, Advanced, Enterprise, Education, Business, Business Plus and Dropbox Sign, once a team admin signs the BAA and before any PHI goes in. Dropbox says Dash doesn't support HIPAA compliance and linked third-party apps are not covered by the BAA (Dropbox; Directory entry).

Is OneDrive HIPAA compliant?

OneDrive for Business can be. It is on Microsoft's in-scope list for the HIPAA BAA that Microsoft makes available by default through its Online Services Data Protection Addendum to covered entity and business associate customers (Microsoft). Microsoft's page describes no BAA for personal OneDrive; see the OneDrive entry.

Is Box HIPAA compliant?

It can be, on Enterprise, Enterprise Plus and Enterprise Advanced accounts with a signed BAA, which an enterprise admin requests in the Admin Console. Box says customers are responsible for configuring Box in a HIPAA compliant manner (Box; Directory entry).

Is iCloud HIPAA compliant?

No. Apple's iCloud terms say a HIPAA covered entity or business associate will not use iCloud to create, receive, maintain or transmit protected health information, or in a way that would make Apple its business associate (iCloud terms; Directory entry).

Does signing a BAA make cloud storage HIPAA compliant on its own?

No. HHS allows cloud storage of ePHI when the covered entity signs a BAA with the provider "and otherwise complies with the HIPAA Rules," including its own risk analysis (HHS). Microsoft says "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft).

How can patients send documents through a clinic website?

One route is an upload field on a form hosted under a BAA, so the file never travels as an email attachment. Curve Forms has file upload fields, and every Curve Form is hosted by Curve under the BAA Curve Compliance signs on every plan.

Talk to Curve Compliance

Book a call. Your storage BAA covers your files. Curve Compliance covers your ad tracking under the BAA it signs on every plan, with conversions sent server-side and PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.