HIPAA-Compliant File Transfer: Healthcare Data Guide

HIPAA-compliant file transfers for Protected Health Information require three things: a signed Business Associate Agreement (BAA) with the transfer provider, implementation of the Security Rule's administrative, physical, and technical safeguards (45 CFR 164.308, 164.310, 164.312), and adherence to the Privacy Rule on minimum necessary disclosure (164.502(b)). Technically, that means AES-256 encryption for PHI at rest and in transit, access controls with unique user IDs, audit controls logging all PHI access, and integrity controls preventing unauthorized alteration. Get the BAA missing and every transfer is an automatic HIPAA violation regardless of encryption strength.

The Business Associate Agreement requirement

45 CFR 164.504(e) requires covered entities (hospitals, clinics, insurers) to have a written BAA with any vendor handling PHI. File transfer services are business associates the moment a DICOM file, lab result .pdf, or patient .csv passes through. The BAA must cover: permitted uses and disclosures, safeguard commitments, reporting obligations for breaches within 60 days, subcontractor flow-down (sub-business associates need BAAs too), return or destruction at termination, and termination rights if the BA violates terms. Major providers publish BAAs — Box, Microsoft 365, Google Workspace, AWS. Consumer services (WeTransfer Free, standard Dropbox) typically do not.

The Security Rule's three safeguard categories

45 CFR 164.308 (administrative): security management process, assigned security responsibility, workforce security, information access management, security awareness training, security incident procedures, contingency plan, evaluation, and BAAs. 164.310 (physical): facility access controls, workstation use, workstation security, device and media controls. 164.312 (technical): access control, audit controls, integrity, person or entity authentication, transmission security. File transfer services touch all three — administrative via BAA, physical via data center security, technical via encryption and access logs.

Technical safeguards at the byte level

45 CFR 164.312(a)(2)(iv) mandates encryption and decryption of electronic PHI. HHS guidance (2013) references NIST SP 800-111 for data at rest and FIPS 140-2 validated modules. Practical implementation: AES-256-GCM for file content, TLS 1.3 for transport, FIPS 140-2 Level 2 HSM for key management (AWS CloudHSM, Azure Managed HSM). 164.312(c)(1) requires integrity controls — authenticated encryption like AES-GCM satisfies this because any tampering fails the authentication tag. 164.312(b) audit controls require logging of hardware, software, and procedural mechanisms that record and examine activity.

The 60-day breach notification window

HIPAA's Breach Notification Rule (45 CFR 164.400-414) requires covered entities to notify affected individuals, HHS, and in some cases the media, within 60 days of breach discovery. The threshold is "unsecured PHI" — PHI not encrypted to NIST standards. Encrypted PHI lost to theft generally falls under the Safe Harbor in the HITECH Act — if the encryption meets HHS Guidance (AES at minimum, keys not compromised), notification isn't required. This is why healthcare buyers prioritize provider documentation of encryption standards and key custody — Safe Harbor only applies if you can prove the encryption.

Minimum necessary and file-level access

The Privacy Rule's minimum necessary standard (164.502(b)) requires limiting PHI disclosure to the minimum needed for the purpose. For file transfers, that means not sending the full patient record when only the imaging study is needed. Break large exports into purpose-specific folders. Strip unneeded columns from .xlsx exports. Redact fields in PDFs before sending. Access controls on the transfer tool should support per-recipient scoping — recipient A sees files 1 and 2, recipient B sees file 3 — rather than blanket folder sharing. Services that only offer "send everything to a URL" fail the minimum necessary test at the interface level.

Audit controls and six-year retention

45 CFR 164.312(b) requires audit logging, and 164.316(b)(2)(i) requires retention of required documentation for six years. For file transfers, log: PHI access events (upload, download, preview, delete), actor identity, timestamp, source IP, success/failure. Centralize logs in a SIEM with immutability — AWS CloudTrail Log File Integrity Validation, Azure Sentinel write-once storage, Splunk SmartStore with Object Lock. HIPAA audits ask for specific events; scroll-through text logs don't cut it. Invest in structured logs with queryable fields.

Cloud storage under the HHS guidance

HHS released cloud computing guidance in 2016 and updated in 2022. Cloud providers are business associates even if they only store encrypted PHI with no access to keys — this distinguishes HIPAA from GDPR, where a zero-knowledge provider may not be a processor for encrypted content. A HIPAA BAA is required regardless of encryption posture. Approved cloud storage for PHI: AWS (S3 with KMS, Backup, Glacier), Azure (Blob Storage, Managed Disks), Google Cloud (Cloud Storage), Box for Healthcare, Dropbox Business with HIPAA add-on. Each signs a BAA; each publishes HIPAA-specific configuration guides.

Transmission security for PHI in flight

45 CFR 164.312(e)(1) requires technical security measures for PHI transmitted electronically. Standard interpretation: TLS 1.2 minimum, TLS 1.3 preferred, no weak ciphers (no RC4, no 3DES, no export ciphers). Disable SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 at the load balancer. Enable HSTS with a long max-age. For email transmission, use Direct Secure Messaging (X.509 certificate-based S/MIME) for HIE-to-HIE exchange or TLS 1.2+ with verified certificates. Email attachments sent over generic SMTP without verified TLS are a common violation vector.

Patient rights and access requests

45 CFR 164.524 gives patients the right to access their PHI. Covered entities must respond within 30 days. File transfer tools can be the delivery mechanism — a patient requests their record, the provider uploads to the transfer service, sends a secure link. Requirements: the recipient is verified (verify against patient contact details on file), the link is short-lived (30 days max under most implementations), and the delivery is logged. Charges are limited to HHS-approved fees for labor and supplies. Overcharging or delayed delivery both trigger OCR complaints.

Picking a HIPAA-grade transfer vendor

The shortlist test: (1) will they sign a BAA without negotiation? (2) does their BAA cover all 45 CFR 164.504(e) requirements including sub-business associate flow-down? (3) do they publish HIPAA compliance documentation (SOC 2 Type 2 scoped to HIPAA, HITRUST CSF certification preferred)? (4) can they demonstrate encryption to NIST SP 800-111 and FIPS 140-2 validated modules? (5) do they retain audit logs for six years? (6) do they meet the 60-day breach notification timeline in contract? Services like Paubox, Virtru, and TigerConnect specialize in healthcare. General-purpose providers like HexaTransfer with strong encryption and EU-aligned controls can fit lower-risk scenarios but require careful BAA negotiation for US-based PHI.

A compliance architecture that works

Upload endpoint: TLS 1.3, client-side AES-256-GCM via Web Crypto API, keys derived from a provider-issued token. Storage: S3 bucket in us-east-1 with SSE-KMS and Object Lock, block public access, VPC endpoints. Access: IAM roles with PHI-specific tags, MFA required, session recording enabled. Audit: CloudTrail to a separate account with log file validation, six-year retention, alerting on anomalous access. Network: private VPC with no internet egress from PHI buckets. Breach response: 24-hour detection SLA, 60-day notification workflow documented and tested quarterly.

Healthcare file transfer is unforgiving — every gap is an OCR fine. Build the controls first. Try it at hexatransfer.com — free, no account, 10 GB max.