Is Dropbox HIPAA Compliant for Therapists?
Quick Answer
No, not on Dropbox Plus, Essentials, or any personal/free account. Dropbox does offer a Business Associate Agreement, but only on paid team/business-tier plans, requested through your admin console — it is not automatically included just because you're on a paid plan. File-sharing links and most third-party app integrations are not covered by the BAA even after you sign one.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified October 2026 against Dropbox's official HIPAA compliance help documentation
BAA Available?
Yes
On Which Plan
Paid Dropbox team/business plans only — confirm your exact current tier's eligibility directly with Dropbox before relying on it
If you store client files in Dropbox, you need a paid team-level plan (not personal Plus) and a BAA requested through your admin console or Dropbox sales — it is not automatic. Dropbox's exact plan names have changed over the past few years, so verify the current tier name directly with Dropbox rather than relying on an older blog post, including this one after enough time has passed.
What to Use Instead for Client Work
Most solo therapists don't need Dropbox at all for clinical files — your EHR's built-in document storage (SimplePractice includes this) is already covered under the same BAA as the rest of your account, with no separate agreement to track.
Affiliate link — we may earn a commission at no extra cost to you.
Personal Dropbox Is Never Covered
Dropbox Plus and Essentials — the plans most individuals already pay for — are excluded from the BAA program entirely. Only paid team/business-tier plans qualify, and even then the BAA must be specifically requested, typically through an admin console or a sales conversation, not something that happens automatically when you upgrade.
The BAA Doesn't Cover Everything You Do in Dropbox
Even with a signed BAA, two common Dropbox habits fall outside its protection: sharing a file via a public link, and connecting third-party apps (like e-signature tools or automation integrations) to your Dropbox account. Both of these need their own compliance review — a signed BAA with Dropbox itself doesn't automatically extend to how you use the files afterward.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Dropbox and HIPAA
Is Dropbox Plus or Essentials HIPAA-compliant for a solo therapist?
No. Personal Dropbox plans (Plus, Essentials) are excluded from Dropbox's BAA program. Only paid team/business-tier plans are eligible, and the BAA must be requested — it's not automatic.
Does signing a BAA with Dropbox cover everything I do with my files?
No. Public sharing links and most third-party app integrations connected to Dropbox are not covered by the BAA, even after you've signed one. Treat those as separate compliance risks.
Do I even need Dropbox if I already have an EHR?
Probably not for clinical files. Most EHRs, including SimplePractice, include document storage already covered under your existing BAA — adding Dropbox on top just means tracking a second BAA for no real benefit.