hipaa.systems
Cloud storage and file sharing · Box

Box: HIPAA status

Enterprise content management and file sharing. Box signs a BAA with customers on its Enterprise tiers, requested through the Admin Console.

BAA ConditionalFacts 8Oldest check 2026-10-06
Visit Box
Signs a BAAConditional

Box signs a Business Associate Agreement only under specific conditions. Only Enterprise, Enterprise Plus and Enterprise Advanced accounts can sign a BAA; admins request it in the Admin Console.

Source: Box Support — Box HIPAA and HITECH Overview and FAQ · checked

Box and HIPAA at a glance

Box signs a Business Associate Agreement only under specific conditions. A BAA alone does not make its use HIPAA compliant: you still need to request the BAA in the Admin Console: Account & Billing > HIPAA Compliance > Request a HIPAA BAA. Box typically responds in 3–5 business days, and have the signed BAA in place before storing any PHI. Facts checked against Box's own documentation on 2026-10-06.

Signs a BAAOnly under conditions
Plans with a BAAEnterprise, Enterprise Plus, Enterprise Advanced
How you get itOnly Enterprise, Enterprise Plus and Enterprise Advanced accounts can sign a BAA; admins request it in the Admin Console.
You still need toRequest the BAA in the Admin Console: Account & Billing > HIPAA Compliance > Request a HIPAA BAA. Box typically responds in 3–5 business days.
Main limitationBusiness and lower plans are not eligible for a BAA.
Last checked2026-10-06

BAA details

Signs a BAAConditionalBox Support — Box HIPAA and HITECH Overview and FAQ
Plans that include a BAAEnterprise, Enterprise Plus, Enterprise AdvancedBox Support — Box HIPAA and HITECH Overview and FAQ

What you still have to configure

  1. Request the BAA in the Admin Console: Account & Billing > HIPAA Compliance > Request a HIPAA BAA. Box typically responds in 3–5 business days. source
  2. Have the signed BAA in place before storing any PHI. source
  3. Configure access restrictions, audit trails, encryption and admin monitoring — Box says customers are responsible for HIPAA-compliant configuration. source

Limitations

  • Business and lower plans are not eligible for a BAA. source

Against our criteria

BAA without a sales processPartial — Requested in the Admin Console; reviewed by Box Legal Operations.Box Support — Box HIPAA and HITECH Overview and FAQ
BAA on entry-level team plansNo — Enterprise tiers only.Box Support — Box HIPAA and HITECH Overview and FAQ

Alternatives