Dropbox and HIPAA/HITECH

What is HIPAA/HITECH?

HIPAA/HITECH refers to two laws: the Health Insurance Portability and Accountability Act (1996); and the Health Information Technology for Economic and Clinical Health Act (2009).

These laws aim to encourage the proliferation of technology in the health care industry, while building protections for the security and privacy of health information. Organizations like hospitals, doctors' offices, and dental practices, as well as individuals who interact with protected health information (PHI) may be subject to HIPAA/HITECH. This may also extend to companies that work with these businesses and come into contact with PHI on their behalf.

HIPAA/HITECH Key Terms

Protected Health Information (PHI)

Individually identifiable information that relates to someone's past, present, or future:

• medical or psychological condition.
• provision of medical service.
• payments for medical service.

Covered entity

A covered entity is a health plan, health care clearinghouse, or health care provider. These categories include hospitals, clinics, doctors, and others who create, receive, or transmit PHI. Because of their contact with PHI, covered entities are responsible for the privacy and security of that information under HIPAA/HITECH.

Business associate

A business associate is an entity which creates, receives, maintains, or transmits PHI on behalf of a covered entity and is therefore also subject to HIPAA/HITECH rules.

Business associate agreement (BAA)

A BAA is a contractual assurance from the business associate to the covered entity that they follow HIPAA's requirements. This agreement must be in place before the transfer of PHI from the covered entity to the business associate.

Is Dropbox HIPAA/HITECH Certified?

There is no official HIPAA/HITECH certification. To help you understand how we're meeting our responsibilities under HIPAA/HITECH, you can request a third-party assurance report evaluating our controls for the HIPAA/HITECH Security, Privacy, and Breach Notification rules, as well as a mapping of our internal practices and recommendations for customers who are looking to meet the requirements of the HIPAA/HITECH Security and Privacy Rules with Dropbox business.

How can I use Dropbox business in a way that's compliant with my obligations under HIPAA/HITECH?

We want to make it as easy as possible for you to learn how to keep your account secure and meet your legal requirements. While ultimately it's up to you make sure that you're complying with your regulatory obligations, we've put together some recommendations to help you keep your data safe and your accounts secured.

First, take a look at our Getting Started with HIPAA guide for tips on how to set up your account to keep data like PHI secured. The framework provides a variety of suggestions covering a variety of topics, including:

• Configuring sharing permissions
• Disabling permanent deletions
• Monitoring account access and activity
• Understanding the role of 3rd party apps

Upon request, we'll provide a mapping of our internal practices and recommendations for customers who are looking to meet the requirements of the HIPAA/HITECH Security and Privacy Rules with Dropbox business.

For customers subject to HIPAA/HITECH, remember that a BAA must be in place before you transfer PHI into your Dropbox account. To learn more about purchasing Dropbox business, contact our sales team. If you're currently a Dropbox business team admin, you can sign a BAA electronically from the Account page in the Admin Console.

How do I set up a business associate agreement with Dropbox?

To learn more about purchasing Dropbox Business, contact our sales team. If you're currently a Dropbox Business team admin, you can sign a BAA electronically from the Account page in the Admin Console.

Are third-party apps and integrations covered under my BAA with Dropbox Business?

There is a robust ecosystem of third-party apps that you can link to your Dropbox Business account to gain added functionality. Integrations that provide services such as SIEM, DLP, and identity management can be powerful tools in strengthening your existing security practices.

While these third-party apps and integrations can be great complements to your account, it's important to remember that they're not part of our included services. Therefore, they're not covered by your Dropbox terms of use, including a BAA that you might sign with Dropbox. You're responsible for evaluating these apps to determine if using them is consistent with your legal and regulatory requirements. Keep in mind that some apps link to individual accounts, while others can be linked by an admin to your entire team.