ShareFile

HIPAA Support

October 31, 2024

Contributed by:

J C

Overview

Important:

For HIPAA Audit Reports and Compliance, visit the ShareFile Trust Center for more information.

The Health Insurance Portability and Accountability Act of 1996, or “HIPAA,” is a U.S. federal law that required the creation of national standards to protect patient health information. This includes, for example, obligations around the confidentiality and security of such data.

ShareFile supports these obligations when storing and sharing data, and provides various tools to supplement a customer’s compliance efforts under HIPAA. However, it is the customer’s responsibilty to configure and operate its ShareFile environment appropriately. Additionally, ShareFile is not a substitute for a customer’s broader compliance obligations. Customers must have their own an adequate HIPAA program, along with appropriate processes and controls to ensure compliance throughout their organization.

Adding ShareFile with HIPAA Support

ShareFile with HIPAA support is available only with a ShareFile Premium, VDR, Industry Advantage Account. Additionally, customers must accept the ShareFile Business Associate Agreement (BAA). In such case, ShareFile operates as a “Business Associate” of customer, generally a “Covered Entity.” For more information on these roles, visit The U.S. Dept. of Health and Human Services.

Accepting the Business Associate Agreement

New accounts

A ShareFile customer’s administrator can enable HIPAA and accept the BAA by following the given steps below:

Login to ShareFile Account. Then go to Settings > Admin Settings > Admin Overview.
From the Admin Overview, select Enable HIPAA and the Warning and Notes page is displayed.
Click the Checkbox to enable the option BAA and click the Enable button to continue.
The Success message is displayed on the top right corner.

Existing accounts

Once a ShareFile account is converted to a Premium, VDR or an Industry Advantage Account with HIPAA support, administrators can click on Admin Setting -> Admin Overview page, within their ShareFile account. A statement regarding BAA acceptance will be highlighted where the BAA can be reviewed and accepted directly within the account.

Administrators can access and review their executed ShareFile BAA at any time via the same Admin Overview page.

HIPAA Features

Upon in-product acceptance of the ShareFile BAA, customers can immediately feel confident using ShareFile to process protected health information (PHI) in the HIPAA-supported version of their ShareFile account. Not only do world-class security measures come standard in our products, ShareFIle also automatically adjusts various features to help support customer’s enhanced obligations under HIPAA.

Public share links - To prevent customers from inadvertently sharing PHI publicly, this feature is disabled. Administrators may enable this feature.
Co-edit with Microsoft - This feature requires customer data to be transferred to your Microsoft environment. ShareFile does not have an agreement with Microsoft and cannot control what happens to your data once it leaves ShareFile’s system. Administrators may enable this feature.
3rd Party integrations and connectors - This feature requires customer data to be transferred to your environment which is hosted by a third party provider of the integration or connector. ShareFile does not have an agreement any third party providers of integrations or connectors, and cannot control what happens to your data once it leaves ShareFile’s system. Administrators may enable this feature.
Notifications - Activity notifications (view/download/upload) will not include the file name went sent via email. This is to prevent sharing of PHI that may be inadvertently contained in a file name. Such notifications will include the file type extension (ex: .doc, .pdf)

Additionally, the following products are not supported for HIPAA product plans:

On Prem or “Self-hosted” - ShareFile does not have access to PHI when customers deploy an on-premises version of the product. For this reason, ShareFile cannot act a business associate of the customer.
Customer Managed Encryption Key for Cloud Storage - ShareFile does not have direct access to PHI where product encryption keys are maintained by the customer. For this reason, ShareFile cannot act a business associate of the customer.
Request Lists - This feature is not currently supported for HIPAA accounts.
Custom Workflows - This feature is not currently supported for HIPAA accounts.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

HIPAA Support

October 31, 2024

Contributed by:

J C

October 31, 2024

Contributed by:

J C

HIPAA Support

Overview

Adding ShareFile with HIPAA Support

Accepting the Business Associate Agreement

New accounts

Existing accounts

HIPAA Features

In this article