The Best HIPAA-Compliant Cloud Storage in 2025: Storing Medical Data
HIPAA compliance is a must for healthcare providers operating in the United States, and storing patient data in the cloud requires special considerations. That’s why you need to make sure you’re using the best HIPAA-compliant cloud storage available. Keep reading for our full list, as well as tips on what to look for in a cloud storage service.
Written by Aleksandar Kochovski (Writer)
Reviewed by Aleksander Hougen (Co-Chief Editor)
Last Updated:
All our content is written fully by humans; we do not publish AI writing. Learn more here.
Healthcare workers spend a lot of time handling sensitive patient data. However, storing that data locally on physical computers isn’t always the smartest choice, especially with the onslaught of ransomware attacks that can cripple a healthcare institution. If you’re a healthcare professional, backing up your organization’s data to a HIPAA-compliant cloud storage service is a must.
HIPAA (or the Health Insurance Portability and Accountability Act of 1996) is a law that regulates how healthcare organizations handle their patients’ data, ensuring doctor-patient confidentiality. However, cloud services very rarely offer the level of security and privacy needed to keep such sensitive data safe.
Key Takeaways:
- The increased use of cloud computing in healthcare means there is a rising need for HIPAA-compliant cloud storage services, but finding the right one can be tricky.
- Sync.com is the best HIPAA-compliant cloud service, offering a triple threat of zero-knowledge encryption, access control and a low price point.
- Google Drive, OneDrive and Dropbox all technically offer HIPAA compliance, though their history of mishandling user data means you’d be wise to stay away from them.
In this article, we’ll list several HIPAA-compliant cloud storage services and explain what it takes to comply with HIPAA. Our top pick is the ultra-secure Sync.com for Teams, which offers zero-knowledge encryption and advanced user management features. We’ll also shed light on a few cloud services to avoid, so be sure to stick around.
-
06/25/2022
Updated Sync.com’s Teams pricing.
-
07/30/2022
Updated to reflect an increase in IDrive’s free plan to 10GB of storage.
-
01/01/2024
Updated IDrive’s pricing information.
-
08/31/2024
Added video reviews for cloud storage providers in the list.
-
04/27/2025 Facts checked
We updated the article to rearrange the provider order.
The Top VPNs for HIPAA
- 1
- :
- : Unlimited GB
- :
- :
- :
- :
- 2
- :
- : 5 GB
- :
- :
- :
- :
- 3
- :
- : 100 GB
- :
- :
- :
- :
- 4
- :
- : 150 GB
- :
- :
- :
- :
- 5
What Makes the Best HIPAA-Compliant Cloud Storage?
The Best HIPAA-compliant cloud storage needs to meet encryption standards and have the correct policies and procedures for data access management. Here are the five best HIPAA cloud storage services.
- Sync.com for Teams — Secure and affordable HIPAA-compliant cloud
- Tresorit — Secure, business-oriented cloud storage
- Box Business — Unlimited secure storage
- Egnyte Connect — Granular user management and data access controls
- IDrive for Business — Zero-knowledge online backup service with cloud storage functionality
What Is Protected Health Information (PHI)?
The term “protected health information,” or PHI, refers to patient data that’s covered by HIPAA. This could include your medical history or prescriptions, as well as personally identifying data, like your ethnicity, gender and birthday.
A HIPAA-covered entity must make sure that this data isn’t disclosed to anyone other than the patient, except for when it needs to be disclosed to provide patient care. In electronic form, this data is referred to as “electronic protected health information,” or ePHI.
HIPAA-covered entities and business associates must follow strict rules regarding the handling of this data. A storage service must provide encryption and protection for PHI while it’s in transit, as well as when it’s on its servers (known as end-to-end encryption). It must also provide strict control and overview of who can access it and provide detailed logs of access attempts.
What Is a Business Associate Agreement (BAA)?
A business associate agreement (BAA) is a document that regulates the relationship between the cloud operator and the healthcare organization. This is a required provision that anyone handling patient information and medical data must have in place.
This is because HIPAA compliance relies on the proper implementation of the cloud service by its user. The cloud service must provide the means to do so, but the BAA ensures both sides know their responsibilities.
The 5 Best HIPAA Cloud Storage Services
These five services provide the best provisions for HIPAA compliance, allowing you to fully embrace every HIPAA rule. Let’s dive into our number-one choice: Sync.com for Teams.
1. Sync.com for Teams
More details about Sync.com for Teams:
- Pricing: $6 per user per month for 1TB storage
- Provider website: www.sync.com
Pros:
- Zero-knowledge encryption
- Administrator controls
- Offers BAAs
Cons:
- Slow speeds
Sync.com is our favorite cloud storage service overall, and its business version — Sync.com for Teams — tops this list too. We’ve long touted its outstanding security, driven by zero-knowledge encryption. It’s based in Canada, which means that it’s beholden to PIPEDA, a Canadian law protecting data privacy that includes health information.
The service offers control over user permissions, which lets you control who is able to see PHI. It also gives administrators oversight over user activity, including activity logs.
To add to all of this, Sync.com offers some of the best deals in cloud storage, and even offers plans with unlimited cloud storage. You can read our full Sync.com for Teams review for more details or sign up for its 5GB free plan.
- price per user per month, billed annually; minimum 3 users
- 1TB
- Price per user; minimum 3 users
- Unlimited GB
- Minimum 100 users
- Unlimited GB
2. Tresorit
More details about Tresorit:
- Pricing: 14-day free trial; $19 per user per month for 2TB storage
- Provider website: tresorit.com
Pros:
- Zero-knowledge encryption
- Secure file sharing
Cons:
- Expensive
- No online editing
Tresorit offers zero-knowledge encryption for all users and the option to sign a BAA on the Business and Enterprise plans. It includes a secure file sharing feature that allows employees to share documents without them being put at risk. Admins can then manage who users can share documents with and manage active sharing links, to reduce the risk of data breeches.
Enterprise users are also able to manage Tresorit accounts through an api to connect Tresorit to third-party services, such as Microsoft Azure. This is alongside Tresorit’s range of plug-ins for other Microsoft and Google software.
Tresorit isn’t the cheapest, with the 2TB Business plan costing $24 per month per user, or $19 per month on an annual plan. However, it offers a 14-day free trial and Enterprise plans from just 30 users. Read our Tresorit review to learn more.
- 3GB
- 1TB
- 4TB
More plans
- Price per user (billed annually), Storage per user, User count: 3-9
- 1TB
- Price per user (billed annually), Storage per user, User count : 10+
- 2TB
- Price per user (billed annually), Storage per user, User count : 100+
3. Box Business
More details about Box Business:
- Pricing: 14-day free trial; $20 per user per month for unlimited storage
- Provider website: www.box.com
Pros:
- Client-side encryption
- Two-factor authentication for collaborators
- Unlimited storage
Cons:
- Client-side encryption is a paid add-on
- Could be cheaper
Coming in at number two is Box Business. This excellent business cloud service provider is another juggernaut in the enterprise cloud storage sphere and, like the other services on this list, is very secure. Unfortunately, client-side encryption requires an additional purchase, and you can’t even get it on the cheapest plan.
That said, Box is HIPAA compliant and offers advanced user control and activity oversight. Its privacy policy states that it collects quite a large amount of data from its users, but fortunately, it’s nothing that could compromise the privacy of patients’ healthcare data. It also has two-factor authentication for people outside the organization.
Box Business isn’t cheap, though all of its plans come with unlimited storage to make up for it. Despite the price, it’s still a solid service, deserving of the third spot. Check out our Box Business review or sign up for a 14-day free trial.
- Single user
- 10GB
- Single user
- 100GB
- Price per user, minimum of three users
- 100GB
More plans
- Users: No limit
- Unlimited GB
- Users: No limit
- Unlimited GB
- Users: No limit
- Unlimited GB
- Price shown is for one user; minimum 3 users
- Unlimited GB
4. Egnyte Connect
More details about Egnyte Connect:
- Pricing: 15-day free trial; $20 per user per month for 1TB storage
- Provider website: www.egnyte.com
Pros:
- Zero-knowledge
- Very deep access controls
Cons:
- Client-side encryption only on most expensive plan
- Pricey
The third place on this list goes to Egnyte Connect. It’s a stellar business cloud storage solution, and it offers excellent security too. Egnyte Connect has user-management features galore, and it even has intelligent data lifecycle management features.
All of Egnyte’s plans are HIPAA compliant, although only its Enterprise plan carries zero-knowledge encryption. Still, that doesn’t mean Egnyte isn’t secure. In fact, it’s one of the most secure EFSS services we’ve tested. It also offers single sign-on (SSO) to make user management easier.
Egnyte isn’t the cheapest, with its 1TB plan being more than twice as expensive as Sync.com’s. Because of this and the lack of client-side encryption on cheaper plans, Egnyte only manages to hit second place on this list. Read our full Egnyte review for more, or take advantage of its 15-day free trial.
- 1-10 users max.
- 1TB
- Price per user; Secure collaboration; Privilege management; Ransomware protection
- 1TB
- Everything in Business; 3rd-party source support; Content lifecycle management; Threat detection
- 1TB
- Everything in Enterprise Lite; Privacy & compliance; Advanced ransomware protection & recovery; Content safeguards
- 1TB
5. IDrive for Business
More details about IDrive:
- Pricing: 10GB free; $69.65 per year for 5TB, 5 users and 5 devices
- Provider website: www.idrive.com
Pros:
- Zero-knowledge
- Inexpensive
Cons:
- Cloud storage isn’t its primary purpose
IDrive for Business isn’t a cloud storage service per se, focusing on online backup instead. It comes with cloud storage and sync capabilities, and it can be used in a HIPAA-compliant manner, offering a BAA for interested parties.
When it comes to backup, IDrive offers a ton of functionality, and it also offers user and access management features for the purposes of HIPAA. When it comes to PHI privacy, we have no complaints, as it comes with zero-knowledge encryption out of the box.
In terms of pricing, IDrive is relatively cheap for the storage it offers, although Sync.com still provides more value with its unlimited plan. If you need its backup capabilities, IDrive is a worthy service, but because cloud storage is its secondary function, we’ve relegated it to fourth place.
- No credit card required.
- 10GB
- One user.
- 100GB
- One user, multiple computers. Plans starting from 5TB up to 100TB. Big discount for first-time signup.
- 5TB
More plans
- 5 computers, 5 users. Starting at 5TB up to 500TB. Big discount for first-time signup.
- 5TB
- Monthly Plan storage starts at 1.25TB up to 50TB Unlimited users, multiple computers and servers. NAS devices. 250GB storage. Starting at 250GB up to 50TB. Large discount for first-time signup.
- 250GB
- 5TB
Other Services That Offer a Business Associate Agreement
Although some cloud services can be used in compliance with HIPAA and let you sign a BAA with them, we still do not recommend using them if they don’t offer zero-knowledge encryption.
Zero-knowledge encryption (or client-side encryption) means that your organization is the only one with access to its encryption keys.
If a service is able to decrypt your files, then it can access them despite a signed BAA. This includes disclosing user data to law enforcement under a court subpoena, which can include your patients’ PHI. The following services let you sign a BAA, but don’t offer client-side encryption.
1. Microsoft OneDrive
OneDrive offers HIPAA compliance to businesses and lets you sign a BAA, but it’s not without its issues. It only recently adopted encryption for its cloud storage (an absolutely basic security feature), which is telling of Microsoft’s attitude toward privacy. Not only that, but the service is not zero-knowledge and Microsoft is known for harvesting user data, much like the next service on this list.
2. Google Drive
Google’s cloud storage also offers HIPAA compliance via its Google Workspace suite, but has the same issue as OneDrive. Although Google Drive has always had encryption, it doesn’t offer client-side encryption and it scans every file you upload to it for viruses and copyrighted content. So, although it technically could be considered HIPAA compliant, we still wouldn’t recommend it for storing PHI.
3. Dropbox Business
![Video thumbnail for the video: Should You Still Use Dropbox in 2024? [Updated Review]](https://img.youtube.com/vi/bwy8HZ1Uvnk/maxresdefault.jpg)
Following the same pattern as the previous two (though to a lesser degree) is Dropbox Business. It’s willing to sign a BAA with healthcare providers, but doesn’t offer zero-knowledge encryption. Learn more in our ‘Is Dropbox HIPAA-compliant‘ guide.
While it’s not in the marketing business like Microsoft and Google are, it’s been in hot water before for numerous data leaks, including one from 2018 where it willingly gave user data to a third party.
Final Thoughts
That’s it for our countdown of the best HIPAA-compliant cloud storage services. We hope you found it useful. Sync.com came out on top, offering zero-knowledge encryption and unlimited storage at a bargain-bin price.
Do you agree with our list? What’s your favorite HIPAA-compliant cloud storage? Would you put your trust in a service that’s not zero knowledge? Let us know in the comments below. As always, thank you for reading.
FAQ
A HIPAA-compliant cloud infrastructure refers to a cloud service that fulfils the requirements set up in HIPAA rules. This includes signing a business associate agreement (BAA), end-to-end data encryption and strict access control and oversight over every data access attempt.
Strictly speaking, it is, as it offers a BAA and can be used in a HIPAA-compliant manner. However, we wouldn’t trust Google to keep any sort of information private, let alone sensitive PHI.
Yes, Box is HIPAA-compliant and offers zero-knowledge encryption for all data on its more expensive plans.
Yes, Backblaze is a HIPAA compliant service and lets you sign a BAA. There’s a snag with its implementation of zero-knowledge encryption, but we trust it to keep protected health information (PHI) encrypted and secure.