HIPAA compliant file transfer has two directions a small firm has to handle: the client uploading a covered file to the firm, and the firm sending one back. This page says what a HIPAA compliant file transfer service must do for both, why HIPAA secure file transfer and HIPAA file transfer mean a portal rather than an attachment, what HIPAA compliant data transfer requires of the vendor, what the HIPAA compliant file upload a client makes should look like, and where HIPAA compliant collaboration tools stop being the right tool for a firm of ten. Whether a file is covered is the adviser's question. The free document capture worksheet sizes the backlog; Batesio Pro keeps the portal for $19 a month.
The upload in: the client's side of the portal
A HIPAA compliant file upload is a portal page the client reaches from a link tied to their email address, with no account to create, where the file is encrypted on the way in and the upload is logged against the client and the date. The alternative, asking the client to email the file, puts a covered document in two inboxes the firm does not control before the firm has even seen it. The HHS Security Rule page cited below is the standard the vendor's safeguards are measured against; the firm's job is to give the client one obvious place to put the file.
The transfer out: link, expiry, log, withdrawal
HIPAA secure file transfer out of the firm is a portal link to a named person that expires, logs the open and the download, and can be withdrawn. That is what a HIPAA compliant file transfer service does that email cannot, and it is the whole of the difference for the firm's record. HIPAA compliant data transfer in the vendor's own systems, the encryption in transit and at rest and the business associate agreement, is the vendor's side of the same promise, and the firm should ask for the agreement before anything else.
Where collaboration tools stop, and what the record costs
HIPAA compliant collaboration tools built for a clinic or a hospital add messaging, task boards and integrations a small firm will not staff; a firm of ten needs the upload, the link, the log and the retention date. Dropbox publishes its Standard team plan at $15 per user per month as the storage rate. Batesio Pro is $19 a month for the whole firm and keeps the client portal both ways, the Bates number on every page, the access log and the retention record, with an export.
Questions people ask about hipaa compliant file transfer
How should a client send us a covered file?
Through a portal upload page from a link to their email address; never as an attachment to a shared inbox.
What does a HIPAA compliant file transfer service log?
The upload, the open and the download, each against a named person and a date.
Do we need HIPAA compliant collaboration tools?
A firm of ten needs the upload, the link, the log and the retention date; the messaging and task boards are for a clinic.
Does Batesio sign a business associate agreement?
Ask before you rely on it for a covered file, as with any vendor; the portal, the log and the retention record are what it keeps.