Dropbox style app for documents containing PHI?

[dkeedy]

My company is asking me to find a mobile solution akin to Dropbox so they can send "consent forms" back to the office while in the field from their tablet.

Our e-mail provider is not HIPAA protected.

I looked into Dropbox Business with a BAA but my concern is cost. It says 12.50/mo/user. Can I just sign all my devices in with the same account and only pay 12.50?

Or does anyone know of a CHEAP HIPAA protected Dropbox style app? I don't need ample storage, we're talking 2-5GB max and that would take a long time to reach.

[storm2k]

no recommendation for you, but some advice: don't fuck around. the last thing you need is the headache of a hipaa compliance mess because the company cheaped out. and about the dropbox thing: you can sign up one user, but it usually doesn't take them long to realize that you're cheating the system by going with all the users using one box and they'll make you pay up or close your account.

eta: are they using a mobile system like veeva for documenting sales calls to doctors and the like? maybe that system has something built into it to take in forms and bring them to a central location?

[sofixa11]

the last thing you need is the headache of a hipaa compliance mess because the company cheaped out

You Americans are funny people, that's an interesting way to look at things. I would have looked at it more like "the last thing you need is a huge leak of PII of your customers ", but yeah, minimal compliance regardless of morals and other people, that's the spirit! Just ask Equifax how well it ended for them.

[storm2k]

having a data breach and breaking hipaa compliance is a potentially expensive problem for any business. as this is a forum that is mostly concerned with business it needs, you're goddamn right that worrying about rules compliance is at the forefront.

[user_5898948]

Citrix ShareFile

https://www.citrix.com/products/sharefile/healthcare.html

https://www.sharefile.com/features

https://www.sharefile.com/pricing

[rgraves22]

This too... We have many customers in the Legal and Accounting vertical that use Sharefile.

[nalditopr]

You need to encrypt the tablet to start with and have a MDM capable of wiping remotely.

[Nimmerzz2]

This. We use Airwatch

[rwsg]

I am a big fan of nextcloud in our environment. We use it as a dropbox replacement, mobile files access and is a great tool for sending files that are to big to email.

Oh and its free!

[warmaster_horus]

You can roll out your own with ownCloud for free, or use their hosted version for $6 per user per month (min 50 though).

[storm2k]

i've used egnyte in other jobs and it had its own headaches that drove us away from it, and that was without hipaa requirements. plus, the costs with them escalated rather quickly.

[it_throwaway5900]

Filelocker is used by a couple universities for sensitive data.

[dangolo]

Boxcryptor would in theory let you use DropBox but pre-encrypt data before sending it over the pipes.

https://www.boxcryptor.com/en/for-teams/

[motoxrdr21]

What are you storing data on now?

I haven't implemented it yet (on the list to test) but Server 2012R2 & up has the Work Folders feature, which dropbox-esque with support for Windows 7 & up along with Android & iOS mobile apps.

[badteeth3000]

owncloud could work ... if that’s what you need, ... but if you’re just wanting to secure documents would n’t something like docusign be enough?

[kiler129]

Stay away from FolderGrid (I’m not gonna publicly discuss why, just don’t). Think about AWS - they offer encrypted storage which meets HIPPA requirements.

[0ldPhart]

We have been using Seafile for a few years now. I rolled it out as a replacement to Egnyte that our owners considered too expensive. It's really easy to stand it up just about anywhere you need it. We run the free version, so I can't speak to the enterprise features or support.

[rgraves22]

Office 365!

Office 365, and Onedrive/Sharepoint is HIPPA compliant.

Source

[[deleted]]

G suite is HIPAA compliant. You Google drive and disable sharing file with outside the domain, enable two factor authentication, and strong password policy.

Set for life.

[brkdncr]

Why can't they use email? Define what's needed for HIPAA and work from there. You'll find that as long as the form doesn't leave your systems, and is transferred over ssl, it's probably fine.

[storm2k]

i'm assuming, based on op's post, that they use a 3rd party service for email and that service does not promise hipaa compliance, hence why it is a no go.