HIPAA Box Service Page

Availability: UCOP

UCOP is offering a service to collaborate and share files that contain Protected Health Information (PHI) in a UC approved environment designed to meet HIPAA requirements. HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It is a US federal law that protects sensitive patient health information from unauthorized disclosure, ensures continuous health insurance coverage for workers, and standardizes electronic healthcare transactions. The HIPAA Box environment is covered by a systemwide BAA (Business Associate Agreement) with Box.

Requirements for using HIPAA Box instance

  • User education and training

All users must complete annual training on how to properly handle data to meet requirements of the HIPAA Privacy, Security, and Breach Notification rules. UC offers systemwide training through its learning center.

  • UC locations can search their location/campus learning center for Health Care Privacy training courses available to them.
  • UCOP users can visit LMS to access the healthcare privacy training.
  • Restrictions on the use of free or personal Box accounts

Free or personal Box accounts cannot be used to access HIPAA Box. All HIPAA Box accounts must by provisioned by UC and have SSO and MFA enabled.

  • Accept the HIPAA Box Terms of Service

Users and departments must accept the TOS (Terms of Service) prior to use. The agreement covers the BAA, which clarifies responsibilities and protects PHI required by HIPAA regulations.

  • Data classification and storage limitations

Only data classified as PHI is approved for storage in HIPAA Box. Data that does not meet this classification must not be stored in HIPAA Box. As a reminder, data stored within HIPAA Box should not be downloaded locally to any personal devices, personal cloud storage, or local drives.

  • Restricted collaboration and sharing methods

HIPAA Box limits data owners from sending collaboration invites through methods used in a regular Box environment. A formal request process is required to invite a collaborator. For instructions, refer to the user guide.

Security and user expectations

  • Shared links can only be set to “Invited people only” setting. This means that users accessing through shared links will need to already be invited to Folder/File to access.
  • UCOP will maintain quarterly reporting of users access. UCOP will provide these reports to department owners who will be required to review and verify that access is current. As a user of HIPAA Box, you are expected to follow a ‘least privilege’ model and grant access to sensitive data only to individuals who are part of the UC system or to third‑party vendors with an active partnership with UC, and only when those individuals have a legitimate and justifiable need to access the data.
    • You may need to provide justification for request to add collaborators that are not partners that UC works with.
  • A yearly TOS (Terms of Service) will need to be accepted to continue to use this environment.

Cost: Location cost is $300 annually per licensed user. UCOP licensed accounts are centrally funded.

For more information on HIPAA Box, please contact the service desk at servicedesk@ucop.edu.