Hi ​@ojiang, 

Welcome to Box Community, and we’d love to assist! 

If your organization is required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates, must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA). To comply with HIPAA they must configure Box and enforce policies within their organizations to meet HIPAA requirements.

Meanwhile, Box still applies the same security and privacy controls for all of its customers, regardless of your account type (Personal, Starter, Business, Enterprise, Enterprise Plus, or Enterprise Advanced accounts.)

For more details, it’d be helpful if you could visit the Box HIPAA and HITECH Overview and FAQ article. 

Thanks for posting, and please let us know if you have questions!