Skip to main content
Question

Need a signed BAA

  • May 22, 2025
  • 3 replies
  • 78 views
C
Forum|alt.badge.img

I've tried emailing my rep and filing a support ticket but nobody has gotten back to me.  My client is on Box and needs a signed BAA to present to a client.  I inquired with my rep over a week ago on several occasions without any luck.  I also filed an urgent ticket with no response either.

Does anybody work at Box anymore?  Pre-sales was on the ball answering any question we had, but now I can't get anybody to respond.

    3 replies

    C
    Forum|alt.badge.img

    Hi Ryan, 

    Welcome to the Box Community! 

    Have you checked this article on Box HIPAA and HITECH Overview and FAQ ?

    There's a section in the article discussing on how to request for a signed a HIPAA BAA from the app:

    Can I request a HIPAA Business Associate Agreement (BAA) from within the app? 

    "Yes, if you're an enterprise admin or co-admin.  To do this, from the Box Admin Console, click Account & Billing, and scroll down (if necessary) to the HIPAA Compliance section.   Then click Request a HIPAA BAA.  Box displays a form asking for information about your organization, the BAA signer, whether you're storing Personal Health Information (PHI) in Box, and whether you’re a HIPAA covered entity (CE) or business associate (BA).  Complete the form and click Continue.  In 3-5 business days the Box Legal Operations team emails you the addendum."

    Also, I went ahead and created a support ticket for you to help connect you with the proper department about this request. Please check your email for updates.

    C
    Forum|alt.badge.img

    Did you ever get a resolution on this issue? I am still waiting on mine as well going on months.

    C
    Forum|alt.badge.img

    "Box signs BAA addendums to with its customers who have an Enterprise or Elite account " https://support.box.com/hc/en-us/articles/360044194833-Box-HIPAA-and-HITECH-Overview-and-FAQ

    This is industrial-strength stupid, because HIPAA compliance only requires that Box do what they do for their free users, plus provide a BAA describing their ordinary security measures.   This doesn't require CIA-level security.

    A computer with data files in clear, locked in the doctor's office, can satisfy HIPAA. There are better solutions available, but HIPAA was designed to be flexible and promote usability, not an obstacle to health care.

    Unfortunately, many stupid lawyers have misinterpreted it and created vast problems.

    By adopting bad policies Box has eliminated itself from consideration.

    Not a contender.

     

     

    Terms of ServiceAccessibility statement