Best HIPAA Compliant File Sharing Tools

The Health Insurance Portability and Accountability Act or HIPAA lays down stipulations over the protection of sensitive data in the health care sector. This gives rise to the concept of HIPAA compliance. If you want to get business in the health sector, you need to ensure that you protect certain types of information held on your system.

HIPAA compliance isn’t necessary if you provide services to the healthcare industry. It is only concerned with Personally Identifiable Information (PIA) related to patients. Within HIPAA terminology, PII is known as PHI, which stands for “protected health information.” You might also see this referred to as ePHI, where the “e” denotes “electronic” and refers to digitally stored data. The HIPAA regulation extends to the healthcare insurance sector and there are many points of entry into the finance and implementation of healthcare that might involve PIA.

One more point to make about the need for HIPAA compliance is that it only relates to patients in the USA. If your business is engaged in the healthcare sector in any other part of the world, you don’t need to work within the HIPAA standards.

Here is our list of the seven best HIPAA compliant file sharing services:

  1. Serv-U Managed File Transfer Server EDITOR’S CHOICE A file distribution system that is fully HIPAA-compliant. This is an on-premises package that runs on Windows Server or Linux and comes with a 14-day free trial.
  2. (FREE TRIAL) A cloud-based storage and distribution system that can have productivity software added to it.
  3. Google Drive A HIPAA compliant file sharing system that has companion productivity tools included with it. This is a cloud-based system.
  4. ShareFile A cloud file storage system that can be integrated into an email system for easy, secure file distribution.
  5. Tresorit A cloud-based file store and collaboration system that is fully HIPAA compliant and is G-Cloud 9 approved.
  6. Accellion Kiteworks A HIPAA compliant file sharing system with options to use a hosted file storage service or take the software for installation on-premises or on a private cloud.
  7. FTP Today A cloud storage provider that offers HIPAA compliant file sharing in its Premium plan.

HIPAA file sharing

You don’t need HIPAA compliance for all of your file actions. However, singling out HIPAA-sensitive data to channel through one file sharing system and all other files through another would be a waste of time. Your HIPAA compliant file sharing system should be used for all of your data sharing work.

Beyond HIPAA requirements, you need a range of functions from a file sharing system. Cloud-based systems allow your team members to “send” files without actually moving them. Instead of attaching a file to an email, the sender includes a link in the email message. This enables the receiver to view the file without needing to make a copy. However, the option to let a recipient download the file should also be available.

File sharing services that create secure access by imposing encryption in the storage location protect files that might contain sensitive data from being accessed by outsiders. The file sharing mechanism should also keep a version history of the files, recording who made what changes to the document.

The most important features required in HIPAA compliant file sharing systems are that they allow control of access and track changes to documents.

The Best HIPAA compliant File Sharing Tools

In order to comply with HIPAA requirements when implementing file sharing, the managing application must include certain security and logging measures.

We took these requirements into account when looking for the best HIPAA compliant file sharing tools and came up with the following selection criteria:

  • Uses unique user IDs to identify each accessor to documents with changes traceable to the accessor.
  • Allows control over which user accesses each document and offers different levels of access rights.
  • Protects files from tampering or illegal access through encryption at rest and during transmission and access security, preferably with an option for 2FA.
  • Version control with backups that enable earlier versions to be recovered.
  • The provider of the service is willing to provide a signed Business Association Agreement.
  • Free version or free trial for a no-cost assessment.
  • A price level that offers good value with respect to the level of functionality provided.

With these requirements in mind, we assessed the major file sharing services on the market today for suitability. When approaching the concept of “file sharing” there are actually two different strategies to cover. One is a collaboration suite that allows different people to edit the same document and the other is a file distribution system that doesn’t include a common editing function. We decided to explore both of these angles.

1. Serv-U Managed File Transfer Server (FREE TRIAL)

SolarWinds Serv-U mft-secure-file-transfer

Serv-U is a specialist file transfer system that creates a secure environment for frequent file sharing. This software provider has ensured that its file transfer system checks all of the boxes to be HIPAA compliant.

Key Features:

  • Secure file transfer
  • Scripts possible
  • Automated workflow integration
  • Choice of encryption cipher

Why do we recommend it?

Serv-U Managed File Transfer Server is a great tool for moving files securely and it is compliant with HIPAA. This tool is also recommended for businesses that need to comply with PCI DSS, FISMA, SOX, and GDPR as well. This service provides SFTP, FTPS, and HTTPS options for secure file transfers and it provides scripted, scheduled transfers that can be integrated into processing workflows. The tool can also be used for on-demand file transfers.

This is an on-premises software package, which bucks the trend of moving everything to the cloud. Not everyone is comfortable with cloud services, especially where sensitive data is concerned. If you are particularly tasked with providing a file sharing system that is overwhelmingly for internal use then the logic of deploying a cloud service diminishes.

Serv-U Managed File Transfer Server (MFT) is positioned to cater to a number of compliance requirements. As well as HIPAA, it is compliant with PCI DSS and SOX. First of all, this is a secure file transfer system that offers an option of protocol, including FTPS, SFTP, and HTTPS. The system is able to transfer files to mobile devices as well as to desktops and servers. The system also logs all file movements, which provides essential documentation for compliance auditing.

Who is it recommended for?

The price of the Serv-U system might put small business owners off this product. However, it will appeal to mid-sized and large organizations. The ability to integrate secure file transfers into workflows opens up options for automated processes that provide data validation along with file movement.


  • Compliance with HIPAA, PCI DSS, and SOX
  • Ad hoc file sharing or scheduled transfers
  • Automation is possible by sending and invoking batch files
  • Manage files over 3 GB in size
  • Peer-to-peer architecture possible


  • Not a cloud service

The Serv-U MFT software is available for Windows Server and Linux. It includes an attractive browser-based administration console and full file movement tracking. You can try the system out without risk on a 14-day free trial.


Serv-U Managed File Transfer Server is our top pick for a HIPAA compliant file sharing tool because it offers maximum control over where copies of files go and protects all transmissions. This is an on-premises solution that is ideal for system managers who feel uncomfortable about contracting out file management services or storing sensitive data on third-party cloud servers. As storage of the files remains in-house, there is no need for a BAA (Business Associate Agreement) with the software provider.

Get a 14-day free trial:

Operating system: Windows Server or Linux

2. (FREE TRIAL) Dashboard is a cloud-based file distribution service, which operates as a HIPAA compliant file sharing system. Users move their files to the account and then send links to recipients instead of the actual file. Permissions on the file can be set up to allow access for reading or downloading.

Key Features:

  • Cloud platform
  • Email attachment intervention
  • Store large files
  • Good for mass distribution of files

Why do we recommend it? is a secure cloud platform. It cuts down the amount of traffic winging around the internet, which reduces the amount of power used for file distribution, thus helping the planet. You upload files to the platform and then send out links for access. Recipients log into the server to view the file. You can then control what happens to your data, preventing copying and saving and blocking editing.

Reading a file in a browser requires the text to be transferred. However, this process is protected by HTTPS security. Downloads are also carried out over encrypted connections. You can also apply 2FA to all user accounts.

File storage space is fully encrypted and access to it requires user credentials. Each action on a file is recorded, noting the user account and a time stamp. is willing to provide a signed BAA to customers who follow the HIPAA standards.

The service can be used for instant backup of folders and syncing, allowing specific folders to be constantly available on the cloud in an up-to-date state.

Who is it recommended for?

Any business would benefit from the use of because it saves time, space, and money while also improving security. Keeping your sensitive data files within the control of your administrators makes privacy enforcement easier.


  • Cut down file movements by uploading to the file space
  • Mail out links for access instead of sending files
  • Control file access permissions
  • Can be used for backup


  • Free trial only lasts seven days

The service is charged for by subscription. The rate is calculated on a combination of the number of user accounts needed with an allocation of 1,000 GB for the entire multi-user account. It is possible to add connectivity through well-known cloud storage providers for backup and syncing. It is also possible to integrate the service with productivity suites, such as Google Workspace, and collaboration environments, such as Slack. You can get a account on a 7-day free trial. Start 7-day FREE Trial

3. Google Drive

Google Drive Dashboard

Google Drive is available for free with 15 GB of space for each user. However, a HIPAA compliant file sharing system requires a central administration of all user accounts and you need to subscribe to a business package in order to get that.

Key Features:

  • Structured like a PC file directory
  • Version controls
  • User access control

Why do we recommend it?

Google Drive is a great collaboration system because it is really a full set of productivity tools, not just a cloud file storage space. This platform enforces encryption on files at rest and removes the need to transfer files out. This is because colleagues can share files for editing and commenting without moving the data from Google Drive. You can invite outsiders to view a file by sending an access list.

Google Drive is included in Google Workspace (the new name for G-Suite). So, effectively, it isn’t possible to subscribe to just Google Drive because Google gives the productivity tools to all Google Drive customers for free.

The Workspace editor facilities and Google Drive itself have excellent version control functions, recording every alteration to a file and storing previous versions that can be brought back to the current version at any time.

Users share files by passing on a link. The sender can choose to set access rights for each user, allowing read-only access or full editing rights. It is also possible to allow or block downloading. The storage space is protected by encrypting as a transfer for viewing or downloading.

Who is it recommended for?

Google Drive is free for individuals, so small businesses will like this tool. It also cuts out the cost of buying Microsoft 365 because it includes a sequence of file editors that mirror the facilities in the MS package. Mid-sized and large organizations will rank Google Drive as a good option.


  • Lets each user decide on the access level on a file to grant to other
  • Easy to send out a link for access
  • Enables collaboration through commenting


  • Difficult to back up

The cherry on the top for HIPAA compliance is that Google will provide a signed BAA for its business plan subscribers.

4. ShareFile

ShareFile Dashboard

Citrix ShareFile is a cloud-based file storage service that has the right features to classify it as a HIPAA compliant file sharing system.

Key Features:

  • Signed BAA
  • HIPAA compliant
  • Strong encryption

Why do we recommend it?

ShareFile from Citrix works in a similar way to the system in that you upload files to the ShareFile Cloud platform and then invite viewers by sending an access link. A plug-in for Outlook means that this tool is able to scan outgoing emails and strip out attachments. These files are automatically uploaded to the ShareFile system and replaced by an access link that points to the stored document.

ShareFile integrates easily with email systems and the mechanism to grant individual access to a document involves adding that person’s email address to a list of authorized viewers. There is an Outlook plug-in for ShareFile that makes integration easy.

Each user that accesses your ShareFile storage area needs to be given an individual account, which creates the accountability needed for HIPAA. The file space and transfers are protected by AES-256 encryption and users need to use a ShareFile app on the accessing device, which ensures end-to-end security and also allows device-linked 2FA.

Who is it recommended for?

ShareFile is not free, so small businesses would have to find a very good reason to choose this service over Google Drive. Mid-sized and large organizations should trial both this system and because both packages are equally suitable.


  • Desktop file synching option
  • Secure access through a mobile app or with a browser
  • AES-256 encryption to protect files at rest


  • Mobile device access could be a security risk

Actions on files are all logged and ShareFile also offers an eSignature facility that creates legally binding agreements. Citrix will also provide a signed BAA. You can try the ShareFile system on a 30-day free trial.

5. Tresorit

Tresorit Dashboard

Tresorit is a HIPAA compliant file sharing cloud-based service that is G-Cloud 9 approved. This tool takes a slightly different approach to file security. It encrypts each file on the user’s device before it is transferred to the cloud storage space. This gives the files stored on the system individual protection rather than just account-wide encryption – which is applied additionally.

Key Features:

  • BAA possible
  • Enduring per-file encryption
  • Device security assessment

Why do we recommend it?

Tresorit provides HIPAA-compliant file movements that goes one step further than its rivals on this list when applying encryption. The Tresorit platform provides encryption for an account space. Like its rivals, Tresorit also encrypts each file individually to enforce access rights. What makes this system different is that it implements a persistent encryption system that applies to files on the devices of users at the point that an upload to the platform commences. That same encryption endures on the file when it is stored on the Tresorit system.

Once a file is on the Tresorit server, it can be accessed through any standard browser or the Tresorit apps for mobile devices. That file is permanently encrypted before it even gets onto the server. However, all transfers to devices for reading are also protected with additional encryption. Device identification provides a 2FA step and it is possible to block access from previously approved devices.

The standard way to share a file is to send the recipient a link to view the file in its Tresorit location rather than mailing it as an attachment. Permissions can be time-limited and they can also be permanently withdrawn. Users can be granted read-only access or editing rights. It is also possible to block downloads. All access events are logged.

Who is it recommended for?

Tresorit is a cloud-based subscription service and it is available in plans for individuals as well as businesses. These factors make the tool very appealing to small businesses. It is also good for mid-sized and large organizations. Businesses that have a geographically dispersed workforce or multiple sites would particularly benefit from the Tresorit system.


  • Combines authorization for users and the devices through which access the cloud system
  • Encryption for files begins on the endpoint before upload and continues during storage
  • File access through link invitation


  • Not possible to host on-premises

Tresorit provides a BAA to its business customers and you can test the system on a 14-day free trial.

6. Accellion Kiteworks

Accellion Kiteworks Dashboard

Accellion Kiteworks is termed a “content firewall.” It is a cloud platform that offers a range of data security services, including a HIPAA compliant file sharing system.

Key Features:

  • A cloud file space
  • Controlled sharing
  • Copy watermarking

Why do we recommend it?

Accellion Kiteworks gives you two tools to control access to data when performing file sharing. One option is to upload the file to the Accellion cloud server storage space of your account and mail out access links. The access granted by these links can be controlled to prevent alteration, downloading, or text copying. The other option is to watermark digital documents so that if a copy turns up in the hands of an unauthorized person, you will know exactly who leaked it.

Kiteworks used a 256-bit AES cipher for file protection both in the storage drive and during transfers. The Kiteworks system has ISO 27001 certification and is validated to the FIPS 140-2 Level 1. Both the file owner and administrator receive notification of any access events on files and these all get logged in a central audit file.

The Kiteworks system offers shared folders for group use and private spaces for each user. Users are individually identified by user accounts and all file actions are logged. There is also a collaboration feature attached to the file viewers, which enables authorized accessors to communicate ideas about the content through commenting and messaging.

The administrator can choose to impose automatic watermarking on all files held in the system or the file owner can apply that per file on demand. The owner can also decide on the level of access that should be allowed to collaborators. And each downloaded version can be stamped for identification to aid data leak investigations.

Files held on Kiteworks can be accessed through an app or through a plug-in that integrates the file system with Microsoft 365 components, including Outlook.

Who is it recommended for?

The watermarking option makes this package very suitable for legal firms and other types of businesses that do actually need to send out copies of documents and can’t just rely on sharing access to cloud-hosted files.


  • Stores files for access by invitation, logging all access events
  • Watermarking to identify who is responsible for a data disclosure
  • Integration with Microsoft 365


  • No free trial

Kiteworks is charged per user per month. Accellion offers a BAA for those customers that use the hosted service. There are also options to get the file management software and host it privately on-premises or on a cloud server. You can get a demo to examine the system.

7. FTP Today

FTP Today Dashboard

FTP Today is a cloud-based secure file storage system that offers a number of plans. You need to get its Premium plan to ensure that you have a HIPAA compliant file sharing system. Although all of the FTP Today plans are secure and offer many features, the company only offers a signed BAA for HIPAA to its Premium plan customers.

Key Features:

  • Integration with SSO
  • Managed IDS

Why do we recommend it?

FTP Today is a cloud platform, just like all of the other options on this list except for Serv-U. What makes FTP Today a little different is that it includes an intrusion detection system to protect all of the data held on the FTP Today cloud server. This security service is managed by FTP Today technicians, so you don’t need to do anything to watch over it. The main method of secure file sharing is by emailing an access link.

The Premium plan of FTP Today adds on more access controls to the file storage accounts, which are already very secure. Those extra features include IP address restrictions to ensure that only authorized devices can access the file space plus multi-factor authentication. The Premium plan allows unlimited user accounts and access rights can be integrated into your Single Sign-On environment.

The Premium account gets 50 GB of storage space, which can be extended. That file space is protected by encryption and there is a choice of file transfer methods that can be used that includes SFTP, FTPS, FTPES, and SCP. The service uses 2048-bit RSA encryption for transfers and 128-bit AES encryption in the storage area.

The system comes with its own apps for user devices and these can be white-labeled for use by managed service providers. On the cloud, the file space is protected by a managed intrusion detection system that includes hacker blacklisting for extra protection. It is also possible to impose geo-fencing that automatically blocks access to users when they are outside of the USA.

Who is it recommended for?

The FTP Today service is suitable for all business types and sizes. However, its cloud location makes it particularly useful for multi-site operations and businesses that have a lot of remote workers.


  • BAA available with the Premium plan
  • Access through desktop and mobile apps
  • Encryption for file movement and storage


  • AES encryption only with a 128-bit key

The FTP Today system is certified under ISO 27001 and its data centers are SSAE18 SOC2 audited. It is possible to see a live demo version of the system. FTP Today is also available for a 14-day free trial but you have to contact the Sales Department to request it.