.svg){kind=icon}
FileGrant
RemoteGrant
Connector
AIGrant
EmailGrant
SecretGrant
Most US hospitals share protected health information with labs, insurers, and referring physicians through platforms that stop protecting files the moment they leave the network. The file travels without encryption, access cannot be revoked, and your audit trail ends at the send button. That is the structural gap HIPAA enforcement keeps exposing.
CyberGrant takes a different approach to HIPAA-compliant file sharing: protection lives inside the file from creation through every share, with post-quantum encryption that persists outside your network. This guide compares six platforms built for US hospital environments running Microsoft 365, so you can evaluate which one keeps PHI protected after it leaves your perimeter.
Quick guide: 6 HIPAA file sharing platforms for US hospitals
- CyberGrant FileGrant: The best file-centric encrypted sharing for HIPAA environments on Microsoft 365
- Box: Cloud collaboration with HIPAA support for larger health systems
- Egnyte: Hybrid storage with governance features for mid-size providers
- Kiteworks: Managed file transfer with policy controls for regulated exchanges
- SharePoint (Microsoft 365): Collaboration within the Microsoft ecosystem when configured for HIPAA
- FileCloud: Self-hosted or cloud deployment with DICOM preview for imaging teams
How we chose the HIPAA file sharing platforms for this list
Choosing a file sharing platform for a hospital is not the same as choosing one for a general enterprise. PHI carries specific obligations under the HIPAA Security Rule, and a gap in any one of them can trigger enforcement action. We evaluated each platform against criteria that map directly to the risks you face every day.
- File-level encryption persistence: Does protection stay with the file after it is downloaded, forwarded, or opened on an unmanaged device? This determines whether a stolen laptop or misdirected email becomes a reportable breach.
- Post-share access revocation: Can you cut off access to a clinical record after it has been shared with a lab, insurer, or specialist? Revocability is the difference between control and hope.
- Microsoft 365 compatibility: Most US hospitals run Microsoft 365. The platform should integrate with SharePoint, OneDrive, Outlook, and Teams without forcing a migration or duplicate workflow.
- Audit trail depth: HIPAA requires tracking who accessed PHI, when, and from where. The audit log must capture every file action, including views, downloads, prints, and failed access attempts.
- BAA availability: A signed Business Associate Agreement is a legal prerequisite. We confirmed that each vendor on this list offers a BAA for healthcare customers.
- Deployment flexibility: Some hospitals require on-premise data residency. Others operate fully in the cloud. We included platforms covering both models.
The 6 best HIPAA file sharing platforms for US hospitals
1. CyberGrant FileGrant: Best overall HIPAA file sharing for US hospitals
The core problem with most file sharing platforms is architectural: they protect the channel, not the file. Once PHI reaches the recipient, it sits unprotected. FileGrant from CyberGrant reverses that model. Every file is encrypted at creation with quantum-safe Lock&Go encryption (CRYSTALS-Kyber, NIST FIPS 203), and that encryption persists regardless of where the file travels.
For a hospital sharing radiology reports with an external specialist or sending trial data to a CRO, this means the document remains encrypted on the recipient's device. You retain the ability to revoke access at any time, even after the file has been downloaded. The audit trail records every action: who opened the file, from which IP, at what time.
CyberGrant Connector extends this protection directly into SharePoint and OneDrive, encrypting documents stored in existing libraries without changing permissions or workflows. Your clinical staff keeps working in the same Microsoft 365 environment. The security layer is transparent to them.
CyberGrant FileGrant features
- Post-quantum persistent encryption: Files are encrypted with CRYSTALS-Kyber at creation. That protection follows the document through email, cloud storage, USB drives, and third-party systems, making exfiltrated data unreadable.
- Instant post-share revocation: Revoke access to any shared file at any time. A clinical record sent to the wrong recipient becomes inaccessible within seconds, reducing your HIPAA breach exposure to near zero for that incident.
- AI-powered automatic classification: AIGrant classifies clinical documents by sensitivity level without sending data to external AI services. PHI is tagged and policy-enforced at the source, not after it has already been shared.
- Anti-screen capture and anti-AI scraping: Blocks screenshot tools and prevents public LLMs from extracting content from protected files. This addresses a risk category that most competing platforms do not cover at all.
- Granular audit trail with legal timestamps: Every file interaction is logged with IP address, device, and timestamp. The audit log includes legally valid time-stamped certificates, providing evidence that holds up under regulatory review.
- Microsoft 365 native integration: CyberGrant Connector encrypts files in SharePoint and OneDrive while preserving existing libraries, permissions, and co-authoring workflows. No migration, no disruption to clinical teams.
CyberGrant FileGrant pros and cons
| Pros | Cons |
|---|---|
| File-centric encryption persists outside your network and after sharing, which means PHI remains protected even on unmanaged endpoints | Initial rollout requires coordination with your Microsoft 365 admin team to configure the Connector for existing SharePoint libraries |
| Post-share revocation gives you real-time control over who can access clinical documents, reducing breach notification obligations | On-premise deployment, while available for data residency requirements, adds infrastructure planning compared to a pure-cloud option |
| Zero-knowledge key management ensures your hospital retains exclusive control of encryption keys, with no vendor access to your PHI | Advanced features like AI classification and anti-scraping protection are available on the enterprise tier |
2. Box: Cloud collaboration with HIPAA support for health systems
Box offers a cloud content management platform that includes HIPAA compliance features on its healthcare-specific plans. It provides a BAA, role-based access controls, and detailed audit logs. Box also includes a DICOM viewer and watermarking, which can be relevant for imaging workflows.
Hospitals already using Box for general collaboration can enable HIPAA-compliant settings on qualifying plans. The platform integrates with clinical and administrative applications through its extensive partner ecosystem. Box applies encryption to data at rest and in transit using AES-256 and TLS protocols.
Box features
- HIPAA-ready plans with BAA: Box signs a BAA on eligible plans and provides a compliance dashboard. Administrators can configure retention policies and sharing restrictions to align with HIPAA requirements.
- Watermarking and version tracking: Sensitive documents can carry visible watermarks to discourage unauthorized distribution. Version history tracks every change to a clinical file over time.
- Application ecosystem: Box integrates with over 1,500 applications, including clinical workflow tools. This breadth of integration can reduce the number of separate sharing channels your teams use.
Box pros and cons
| Pros | Cons |
|---|---|
| Large integration ecosystem connects Box to clinical and administrative apps your teams already use | HIPAA compliance features are only available on higher-tier plans, which limits access for smaller departments or satellite clinics |
| Watermarking and granular permission settings help reduce unauthorized distribution of sensitive clinical files | Encryption protects data at rest and in transit, but does not persist with the file once it is downloaded to a local device |
| Familiar cloud interface reduces onboarding friction for non-technical staff across hospital departments | File access cannot be revoked after a document has been downloaded, leaving a gap in post-share control for PHI sent externally |
3. Egnyte: Hybrid storage with governance for mid-size providers
Egnyte provides a content governance platform that supports HIPAA compliance through access controls, file classification, and audit reporting. It signs a BAA and offers both cloud and hybrid deployment models. Egnyte's data classification engine can scan files for PHI identifiers and flag documents that need additional protection.
For mid-size healthcare providers managing files across multiple office locations, Egnyte's hybrid architecture allows local file caching while maintaining centralized governance. The platform supports compliance with HIPAA, GDPR, and other regulatory frameworks through automated policy enforcement and reporting.
Egnyte features
- PHI classification engine: Egnyte scans stored files for patterns matching personal health identifiers and flags them for policy enforcement. This automated detection helps prevent accidental exposure of unclassified clinical documents.
- Hybrid cloud architecture: Files can be cached locally at hospital sites for performance while remaining governed centrally. This model supports organizations with multiple clinic locations and varying connectivity.
- Compliance reporting dashboard: Administrators can generate reports mapping file activity to HIPAA requirements. The dashboard tracks access events, policy violations, and sharing activity across the organization.
Egnyte pros and cons
| Pros | Cons |
|---|---|
| Hybrid deployment supports healthcare organizations with multiple sites that need local file access and centralized control | Encryption applies to data at rest and in transit but does not follow the file once it is shared outside the Egnyte environment |
| Built-in PHI classification helps identify sensitive documents automatically, reducing manual review overhead | Post-share access revocation is not available once a file has been downloaded by the recipient |
| Compliance reporting maps file activity to HIPAA requirements, simplifying audit preparation | The classification engine requires initial tuning to match your organization's specific PHI patterns and naming conventions |
4. Kiteworks: Managed file transfer with policy controls
Kiteworks offers a data control platform focused on secure file exchange for regulated industries. It provides AES-256 encryption for data at rest, SSL/TLS for data in transit, role-based permissions, and comprehensive audit logs. Kiteworks signs a BAA and positions itself as a governance-first platform for healthcare organizations exchanging PHI with business associates.
The platform supports managed file transfer workflows, protected email, and external data exchange through a centralized administrative console. Administrators can set policies governing who may share files, with whom, and under what conditions. Kiteworks also offers remote wipe capability for files stored in its secure mobile container.
Kiteworks features
- Centralized policy enforcement: Administrators define sharing policies from a single console. Rules govern which users, groups, and external parties can access specific files or folders.
- Hardened virtual appliance: Kiteworks deploys as a hardened virtual appliance that reduces the attack surface compared to a standard cloud service. It supports on-premise, private cloud, and hybrid configurations.
- Remote wipe for mobile containers: If a device is lost or compromised, administrators can remotely wipe data stored within the Kiteworks secure container. This provides an additional layer of PHI protection for mobile healthcare workers.
Kiteworks pros and cons
| Pros | Cons |
|---|---|
| Governance-first architecture gives administrators centralized control over sharing policies, user permissions, and file access rules | The platform requires dedicated administrative resources to configure and maintain policies across departments and external partners |
| Hardened virtual appliance deployment reduces the attack surface for organizations that prefer on-premise or private cloud hosting | Encryption protects data at rest and in transit, but does not persist with the file after it has been downloaded outside the platform |
| Remote wipe capability adds a layer of protection for PHI stored on mobile devices used by clinical staff in the field | The administrative console has a learning curve that may require training for IT teams unfamiliar with policy-based file governance platforms |
5. SharePoint (Microsoft 365): Collaboration within the Microsoft ecosystem
SharePoint is already embedded in most US hospital IT environments. When configured correctly within a HIPAA-enabled Microsoft 365 Enterprise plan and paired with a signed BAA from Microsoft, SharePoint supports HIPAA-compliant document collaboration. It offers version control, co-authoring, and integration with Teams, Outlook, and other Microsoft 365 applications.
The challenge with SharePoint is that HIPAA compliance depends entirely on configuration. Microsoft provides the tools, but the hospital's IT team is responsible for restricting sharing permissions, enforcing DLP policies, and training staff. Misconfiguration is the most common source of PHI exposure in SharePoint environments.
SharePoint features
- Native Microsoft 365 integration: SharePoint connects directly with Teams, Outlook, and OneDrive. Clinical staff can collaborate on documents without leaving the Microsoft environment they already use daily.
- Information Barriers and DLP policies: Microsoft 365 compliance tools allow administrators to create DLP policies that scan for PHI patterns and block unauthorized sharing. Information Barriers can segment departments to prevent inappropriate data access.
- Version history and co-authoring: Multiple users can edit a document simultaneously with full version tracking. This supports clinical workflows where care plans and notes require input from several providers.
SharePoint pros and cons
| Pros | Cons |
|---|---|
| Included in most hospital Microsoft 365 subscriptions, which avoids additional licensing costs for basic file collaboration | HIPAA compliance depends on manual configuration by the hospital's IT team, and defaults are not HIPAA-ready out of the box |
| Tight integration with Teams, Outlook, and OneDrive means clinical staff can share files within familiar workflows | Files shared externally through SharePoint links lose protection once downloaded, with no option for post-share revocation |
| DLP policies and Information Barriers provide configurable controls for PHI scanning and department-level access segmentation | Audit capabilities require additional Microsoft compliance licensing (Microsoft Purview) for advanced monitoring and alerting |
6. FileCloud: Self-hosted or cloud deployment with DICOM support
FileCloud provides a file sharing platform with flexible deployment options: self-hosted, cloud, or hybrid. For hospitals with strict data residency requirements, the self-hosted model allows PHI to remain entirely on infrastructure the organization controls. FileCloud signs a BAA and includes a built-in HIPAA compliance center that maps security settings to specific HIPAA requirements.
A distinguishing feature for imaging-heavy departments is FileCloud's native DICOM image preview, which allows clinicians to view X-rays, CT scans, and MRIs directly within the platform. This reduces the need for separate imaging viewers and keeps radiology workflows inside a governed environment.
FileCloud features
- Built-in DICOM preview: Clinicians can view medical imaging files in DICOM format directly within FileCloud. This eliminates the workflow step of downloading images to a separate viewer, keeping PHI within the governed platform.
- HIPAA compliance center: A dedicated dashboard maps FileCloud's security settings to HIPAA requirements. Compliance officers get visibility into potential infractions, configuration gaps, and recommended actions.
- Self-hosted deployment option: Hospitals can deploy FileCloud on their own servers, keeping all PHI within their physical infrastructure. This model appeals to organizations with policies that prohibit cloud storage of clinical data.
FileCloud pros and cons
| Pros | Cons |
|---|---|
| Self-hosted deployment gives hospitals complete control over where PHI is stored, addressing strict data residency requirements | Self-hosting requires dedicated server infrastructure, ongoing maintenance, patching, and internal IT resources to keep the platform current |
| Native DICOM preview supports radiology and imaging workflows without requiring a separate viewer application | Encryption covers data at rest and in transit, but file protection does not persist once a document is downloaded outside the FileCloud environment |
| HIPAA compliance center provides a clear mapping between security configuration and regulatory requirements | Advanced security features like Smart DLP require higher-tier plans, which may not be included in base deployments |
Comparison table: HIPAA file sharing platforms for US hospitals
| Platform | Post-share revocation | Persistent file encryption | Post-quantum encryption |
|---|---|---|---|
| CyberGrant FileGrant | ✓ | ✓ | ✓ |
| Box | ✗ | ✗ | ✗ |
| Egnyte | ✗ | ✗ | ✗ |
| Kiteworks | ✗ | ✗ | ✗ |
| SharePoint | ✗ | ✗ | ✗ |
| FileCloud | ✗ | ✗ | ✗ |
What does the HIPAA Security Rule require from file sharing platforms?
The HIPAA Security Rule defines technical safeguards that any platform handling PHI must support. Understanding these requirements helps you evaluate whether a vendor's compliance claim translates into actual protection for your patients' data.
Four categories of technical safeguards apply directly to file sharing: access controls that limit PHI access to authorized users, audit controls that log every interaction with protected files, integrity controls that verify files have not been altered in transit, and transmission security that encrypts data during transfer.
A Business Associate Agreement is required whenever a vendor creates, receives, maintains, or transmits PHI on your behalf. Without a signed BAA, using a platform for PHI violates HIPAA regardless of the platform's technical capabilities. Every platform in this guide offers a BAA, but the scope and conditions vary. Review the BAA language before assuming coverage extends to all features and deployment options.
How does file-centric encryption reduce HIPAA breach exposure?
Most file sharing platforms encrypt data at rest on their servers and in transit between endpoints. That encryption disappears the moment a file is downloaded. If an employee forwards a clinical report to the wrong address, or a laptop containing downloaded PHI is stolen, the file sits unprotected.
File-centric encryption changes the equation. When protection is embedded in the file at creation, the document remains encrypted regardless of where it ends up. A stolen device yields unreadable data. A misdirected email contains a file that cannot be opened without authorization.
Under HIPAA's Breach Notification Rule, encryption that renders PHI "unusable, unreadable, or indecipherable" to unauthorized individuals can qualify the incident as a non-reportable event. CyberGrant FileGrant applies this principle at the architectural level: every file is encrypted with zero-knowledge keys that stay with your hospital, and access can be revoked even after the file has been downloaded. The practical result is a smaller attack surface and fewer incidents that trigger notification obligations.
Why CyberGrant FileGrant is the best HIPAA file sharing platform for US hospitals
The difference between CyberGrant FileGrant and the other platforms on this list is structural, not incremental. Every competing platform protects files while they sit on the vendor's servers. FileGrant protects files wherever they go, including devices and networks you do not control.
For a hospital CISO evaluating file sharing for HIPAA compliance, this distinction has direct operational consequences. Post-share revocation means you can cut access to a clinical document after it has been shared with an external lab or insurance partner. Zero-knowledge key management means CyberGrant never has access to your encryption keys or your PHI. Post-quantum encryption (CRYSTALS-Kyber, approved by NIST) protects files against future decryption threats, a consideration that matters when clinical records must remain confidential for decades.
CyberGrant also addresses risks that traditional file sharing platforms do not touch. Anti-screen capture blocks unauthorized screenshots during video calls on Zoom, Meet, and Teams. Anti-AI scraping prevents public LLMs from extracting content from protected documents. These are not theoretical concerns: healthcare organizations face real exposure from staff using public AI tools with clinical data, a scenario the ENISA Healthcare Procurement Guidelines (2026) explicitly address.
If your hospital runs Microsoft 365, CyberGrant Connector encrypts files in your existing SharePoint and OneDrive libraries without requiring migration or workflow changes. Your clinical teams continue working in the same environment. The encryption is transparent to them and invisible to attackers. Request a free assessment to see how FileGrant fits your current infrastructure.
FAQs about HIPAA-compliant file sharing for hospitals
What makes a file sharing platform HIPAA compliant?
A HIPAA-compliant platform must support access controls, audit logging, data integrity verification, and transmission encryption as defined by the Security Rule. It must also sign a Business Associate Agreement with your organization. CyberGrant FileGrant goes further by adding persistent file-level encryption and post-share revocation, which reduce your breach notification obligations.
Can SharePoint be used for HIPAA-compliant file sharing?
SharePoint supports HIPAA compliance when used within a qualifying Microsoft 365 Enterprise plan, configured with appropriate DLP policies and access restrictions, and covered by a BAA with Microsoft. The responsibility for correct configuration falls on your IT team. CyberGrant Connector adds persistent encryption to SharePoint files without changing your existing setup.
Why does post-share revocation matter for hospitals?
Hospitals routinely share clinical records with external parties: labs, specialists, insurers, and CROs. If a file is sent to the wrong recipient or a business relationship ends, post-share revocation lets you block access immediately. CyberGrant FileGrant revokes access in seconds, even after a file has been downloaded, turning a potential HIPAA violation into a controlled incident.
What is the average cost of a healthcare data breach?
According to IBM's 2025 Cost of a Data Breach Report, healthcare data breaches cost an average of $7.42 million, making healthcare the most expensive industry for breaches for 14 consecutive years. File-centric encryption that persists outside your network can reduce both the likelihood and the regulatory cost of a breach.
Does CyberGrant support on-premise deployment for hospitals?
Yes. CyberGrant offers on-premise deployment with zero-knowledge key management, meaning encryption keys never leave your infrastructure. This model supports hospitals with strict data residency policies and provides full control over where PHI is stored and processed.
