If your practice handles patient records, imaging, or anything else classified as Protected Health Information (PHI), the file-sharing tool you use isn't just a convenience question it's a compliance question. And the short answer for WeTransfer is no, it isn't HIPAA compliant, for a specific, checkable reason that has nothing to do with how good its encryption is.
Why WeTransfer isn't HIPAA compliant
WeTransfer will not sign a Business Associate Agreement (BAA). As a Dutch company, WeTransfer has said it isn't bound by US HIPAA law in the first place, and for its paid Business plan it offers a Data Processing Agreement (a GDPR-style document) rather than a BAA. A DPA and a BAA are not interchangeable only a signed BAA creates the legal relationship HIPAA requires between a healthcare provider and anyone handling PHI on its behalf.
The BAA is the actual test not encryption, not "security"
This is the part that trips people up: a file-transfer tool can have strong encryption, password protection, and a clean security track record, and still not be HIPAA compliant. HIPAA compliance isn't a technical property of the software, it's a signed legal commitment from the vendor to handle PHI under HIPAA's rules and be liable if it doesn't. No signed BAA means no HIPAA compliance, full stop regardless of what the marketing page says about security.
What about Dropbox, Google Drive, and the rest?
It depends entirely on the plan, not the brand name. Dropbox will sign a BAA, but only on Dropbox Business Advanced and above not on Dropbox Basic, Plus, or Family. Google will sign a BAA under Google Workspace, but again only on business-tier plans with the right admin configuration, not a free personal Gmail account. The pattern across every major provider is the same: consumer and free tiers are never covered, and compliance has to be explicitly turned on at the business-plan level, with a signed agreement to back it up.
Healthcare files aren't small, either
Whatever tool a practice settles on also has to deal with the file sizes involved. A single CT scan study runs around 1.5 GB, and an MRI study is commonly 2–3 GB before accounting for a multi-study patient history. A compliant tool that chokes on files that size, or forces heavy compression, isn't actually solving the problem.
What to check before you send PHI through anything
- Will the vendor sign a BAA? If the answer is no, or "only informally," the tool isn't an option for PHI regardless of its other features.
- Is the BAA tied to your actual plan? A vendor offering BAAs on its enterprise tier doesn't cover you on its free or personal plan.
- Does it handle real imaging file sizes? Multi-gigabyte CT, MRI, and pathology files need a tool built for that, not a document-sharing tool stretched to fit.
- Who else at the vendor can access the data? A BAA should specify this, not leave it implied.
