What is HIPAA-compliant cloud storage?

Key takeaways

• A provider that stores electronic protected health information (ePHI) for you has to sign a business associate agreement (BAA) before any data moves, even if it only holds encrypted data.
• Free and personal plans don’t include a BAA, so they can’t hold patient data.
• A managed provider can take on patching, monitoring, backups, and recovery, but your organization is still responsible for HIPAA compliance.

No vendor can make your organization HIPAA compliant on its own, because compliance is your organization’s responsibility. Vendors often advertise their storage as “HIPAA compliant,” but HHS, the federal agency that writes and enforces HIPAA, doesn’t certify any technology product for HIPAA. When a vendor uses that phrase, it means the vendor will sign a BAA and supply the safeguards HIPAA requires, like encryption and access controls. Your organization still sets up those safeguards, writes the policies, trains staff, and documents the work. 

This guide covers what a vendor handles and what stays with you, from the BAA and encryption to backups, choosing a provider, and common mistakes.

What is HIPAA-compliant cloud storage?

HIPAA-compliant cloud storage is storage from a provider that signs a business associate agreement (BAA) and supplies safeguards for electronic protected health information (ePHI). Your organization is the second party: it sets up and manages those safeguards.

The HHS Office for Civil Rights (OCR), the part of HHS that enforces HIPAA, published guidance in 2016 on how HIPAA applies when healthcare organizations store patient data with cloud providers. It states that OCR doesn’t endorse, certify, or recommend specific technology or products, so no service carries an official  HIPAA stamp. 

A dental office that stores patient files with a vendor that signs a BAA, for example, still has to set up the service correctly and handle its own HIPAA compliance.

Key terms

• PHI and ePHI: Protected health information is health data that identifies a person, and ePHI is that same data in electronic form.
• Covered entity: A health plan, a health care clearinghouse (a company that processes insurance claims), or a health care provider that bills insurance electronically.
• Business associate: A person or company that handles PHI for a covered entity, such as a billing service or a cloud provider.
• BAA: The business associate agreement is a contract that sets how a business associate may use PHI and requires it to protect the data and report breaches.

Who is responsible for HIPAA compliance in the cloud?

Responsibility for HIPAA compliance in the cloud belongs to your organization. A cloud provider is responsible for the parts it runs: it secures its infrastructure, supplies encryption, access controls, and logging, and meets the terms of the BAA. Your organization sets up those tools, writes the policies, and decides how staff handle ePHI.

HHS treats a cloud provider that stores ePHI as a business associate, which makes the provider legally responsible under HIPAA for protecting that data. HHS also expects your organization to run a risk analysis that covers every cloud service you use.

The National Institute of Standards and Technology (NIST), working with OCR publishes SP 800-66 Rev. 2, a guide that walks through each requirement of the HIPAA Security Rule. That’s the federal rule that sets standards for protecting ePHI.

Your organization keeps the risk analysis, written policies, workforce training, access decisions, incident response and breach notification, and the documentation behind all of it, no matter which provider you choose.

OCR enforces these requirements. In April 2026, it announced four ransomware settlements totaling $1,165,000, and in each case it found the organization had failed to conduct an accurate and thorough risk analysis.

A managed partner can take over the day-to-day technical work. In a DIY setup, your team designs the environment and handles patching, monitoring, and backups. With a managed hosting provider, the host’s engineers do that work, set up a HIPAA-ready environment, provide the compliance evidence and reports your auditors ask for, and own the fix when something breaks.

BAA requirements for cloud storage

BAA requirements for cloud storage begin with one rule: a provider that stores ePHI for you signs a BAA before any data moves. HHS applies that rule even if you encrypt the data first and the provider has no way to decrypt it, because a provider that stores your ePHI is a business associate whether or not it can read the data. If a covered entity or business associate puts ePHI in a cloud service without a BAA, it violates HIPAA.

The BAA lays out how a provider can use and share ePHI. It also requires the provider to protect the data and report security incidents and breaches. Personal accounts usually don’t come with a BAA, so staff can’t use them for patient data. That includes personal Dropbox and Google accounts and iCloud.

Many providers also offer a service level agreement (SLA) alongside the BAA. HHS says an SLA often covers how reliably the service stays up, backups and recovery, how you get your data back if you leave, who handles security, and how long the provider keeps your data and who it can share it with. 

The provider signs the BAA and meets its terms. Your organization chooses an eligible plan, signs before any ePHI moves,and makes sure the SLA doesn’t conflict with the BAA.

HIPAA cloud storage encryption requirements

HIPAA cloud storage encryption requirements call for protecting ePHI both while it’s stored on a provider’s servers and while it’s moving between your devices and the cloud. The Security Rule calls encryption “addressable.” That means you either use it or write down why it isn’t reasonable for you and what you do instead.

That flexibility may not last. HHS proposed a Security Rule update in January 2025 that would require encryption and multi-factor authentication (a second login step, like a code sent to your phone). The update isn’t final, and HHS’s current target for finishing it is July 2027. Until then, OCR enforces the current rule.

Encryption also helps if patient data is stolen. If the data was encrypted the way HHS recommends, the attacker can’t read it, and you usually don’t have to report a breach. If the attacker also steals the key to unlock the data, you do.

HHS notes that encryption alone can’t satisfy the Security Rule, because it doesn’t keep your systems running during an outage or replace other protections, like staff training and limits on who can enter the server room.

A provider supplies encryption. Your organization turns it on where it’s optional, confirms the settings, and protects ePHI that leaves the platform through downloads and email attachments.

Access controls and audit logs for HIPAA cloud storage

Access controls and audit logs for HIPAA cloud storage limit who can reach ePHI and record what each person does with it. The basics are a separate login for every person, multi-factor authentication, permissions based on each person’s job, and automatic logout after a set period of inactivity.

Shared logins undo all of this, because when five people use one account, no log can show who opened a record. Review the logs on a set schedule rather than waiting for an incident to send you looking.

HHS notes that your organization and the provider can split responsibility for access controls. Write down who handles what in the BAA or another document, including who manages logins and who handles encryption.

A provider supplies the controls and the logs. Your organization decides who can see what, removes access when staff leave, and reviews the logs.

Backup and disaster recovery for HIPAA cloud storage

Backup and disaster recovery for HIPAA cloud storage keep ePHI available and recoverable after hardware failure, human error, or ransomware. The Security Rule’s contingency plan standard (45 CFR § 164.308(a)(7)) calls for a plan to back up data, a plan to recover after a disaster, and a plan to keep essential work going during an emergency.

Storage and backup do different jobs. Storage holds the working copy your team uses every day, while backup holds a separate copy, with older versions saved, that you can restore if the working copy is lost or encrypted. Two targets shape the plan: your recovery point objective (RPO), the most data you can afford to lose, and your recovery time objective (RTO), the longest you can stay offline.

Nexcess offers managed backups and managed disaster recovery powered by Acronis. We keep a standby copy of your systems ready to take over in under two minutes, with a 30-minute RPO, automated testing, and step-by-step recovery plans. Our engineers run the restores.

A provider runs backups, tests the switch to standby systems, and restores your data. Your organization sets recovery objectives, decides what the backups cover, and reviews test results.

Cloud providers that support HIPAA compliance

Cloud providers that support HIPAA compliance share one trait: they will sign a BAA, but the plans and services the BAA covers vary. How much setup work falls to your organization varies too, depending on whether you use a self-service platform or a managed provider. 

Whichever provider you consider, confirm in writing which plans and services its BAA covers before you move any ePHI.

Provider	BAA availability	What your organization sets up
Nexcess Managed Cloud	Yes, Nexcess signs BAAs	Policies, training, risk analysis, access decisions
Box	Eligible plans only; confirm tier	Sharing rules, permissions, audit settings
Google Cloud Platform	Yes, for covered products, including Cloud Storage	Access controls, encryption options, audit log review
Microsoft Azure and OneDrive	Eligible services; confirm agreement	Account settings, access policies, how long data is kept
Dropbox	Eligible business plans only	Sharing limits, admin controls, connected apps
AWS	Yes, for HIPAA-eligible services	Service selection, encryption, logging, networking
Sync and FileCloud	Confirm terms and plans with each vendor	Sharing, access, logging

Nexcess Managed Cloud

Nexcess Managed Cloud signs BAAs and runs the infrastructure that holds your ePHI, on dedicated servers powered by Nutanix. Our 24/7 engineers monitor, patch, and respond to incidents, while your organization keeps its risk analysis, policies, training, and access decisions. Learn more about Nexcess healthcare hosting.

How to choose HIPAA-compliant cloud storage for your organization

To choose HIPAA-compliant cloud storage for your organization, start with your size, your workload, and the operational work your team can take on. A small practice often has one person handling IT alongside other duties, so the less that person has to set up and maintain, the better. 

A large hospital network needs a risk analysis covering every system that touches ePHI, so each provider has to fit into that analysis. Match the tool to the job: cloud storage for daily files, a cloud drive or sync service for shared editing, and backup for recovery.

Questions to ask a provider

• Which plans and services does the BAA cover?
• How is data encrypted when it’s stored, when it’s moving, and in backups, and who holds the keys?
• Which access controls and audit logs exist, and how often does the provider test restores?
• How does the provider return data if you end the contract?

What your organization needs in place with any provider

• A completed risk analysis that includes the service
• Written policies
• Workforce training
• A regular review of who has access
• An incident response plan
• Documentation kept for at least six years

Common challenges with HIPAA-compliant cloud storage

Common challenges with HIPAA-compliant cloud storage start with assumptions about what the provider covers.

• Treating the label as proof. A vendor that calls its service HIPAA compliant is describing what it offers, and your own setup and policies still decide whether you comply.
• BAAs that stop at the plan or product. Many providers sign BAAs only for certain plans or services, so a feature or add-on outside that list can’t hold ePHI.
• Misconfigured sharing. Public links, broad permissions, and accounts that stay active after an employee leaves can expose ePHI without anyone noticing.
• Consumer tools used on the side. Staff who save work files to a personal Dropbox, Google, or iCloud account move ePHI outside any BAA.
• Unsupported systems and surprise costs. Servers still running CentOS Linux or older Windows versions no longer receive security patches, and data transfer fees from large public cloud providers can push costs past budget.

What happens when ePHI sits in the cloud without a BAA

In 2016, Oregon Health & Science University (OHSU) paid $2.7 million to settle with the HHS Office for Civil Rights. Investigators found that OHSU stored the ePHI of more than 3,000 individuals on a cloud-based server without a BAA, among other findings, and OHSU agreed to a three-year corrective action plan. Read the HHS resolution agreement.

Each of these challenges gets harder when one person handles IT alongside other duties. A managed provider can take on much of that operational work.

Where managed cloud fits for HIPAA workloads

Managed cloud fits HIPAA workloads best when you want an expert provider to run your systems and servers while your organization stays responsible for HIPAA compliance. Nexcess Managed Cloud is for organizations that need a secure cloud with predictable costs but don’t want to build and run it themselves. 

We run your technology. You run your business.

• 24/7 experts: Engineers who know your environment and answer when you call.
• Migration without fear: We review your current setup, plan each step of the move, and handle the switch, including moves off systems that no longer get security updates.
• Compliance support: We manage security for your environment and provide compliance evidence and reports.
• One partner, one SLA: Fixed-cost billing and one team that answers for the outcome.

Your organization still writes its policies, trains staff, completes its risk analysis, and decides who sees ePHI. Nexcess Managed Cloud runs the infrastructure underneath, for less risk, predictable cost, and expert-managed support.

Next steps

The next steps for HIPAA-compliant cloud storage start with deciding which responsibilities your team keeps and which a partner takes on.

1. List where your ePHI is stored and confirm your risk analysis covers each system.
2. Check that a BAA covers each provider, plan, and service you use.
3. Talk to a Nexcess expert about the operational work you want to hand off.

If you’re weighing a specific provider, the FAQs below cover Dropbox, Google, Box, Microsoft, and iCloud.