HIPAA Compliance Overview

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for the protection of individually identifiable health information, known as Protected Health Information (PHI) or electronic PHI (ePHI). Covered entities -- healthcare providers, health plans, and healthcare clearinghouses -- and their business associates must comply with HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule.

The HIPAA Security Rule specifically governs the protection of ePHI and requires covered entities to implement administrative, physical, and technical safeguards. AXIS CloudSync addresses the technical safeguard requirements directly through its platform architecture.

How AXIS CloudSync Supports HIPAA

AXIS CloudSync is a HIPAA-compliant cloud storage, online backup, and secure file transfer solution. Key platform capabilities that support HIPAA compliance include:

• 256-bit AES encryption for all data in transit and at rest.
• Two-factor authentication (2FA) to prevent unauthorized access.
• Granular access controls to limit ePHI access to authorized users only.
• Comprehensive audit logs of all file access, sharing, and administrative actions.
• Ransomware protection via the Snapshot rollback feature.
• Remote device wipe to revoke access from lost, stolen, or terminated-employee devices.
• Business Associate Agreement (BAA) available for all customers.
• SOC 2 certified infrastructure.
• 99.999% uptime SLA to support availability requirements.

Encryption

All data transmitted between AXIS CloudSync clients (desktop, mobile, web) and the cloud is encrypted using TLS (Transport Layer Security) with algorithms that comply with HIPAA requirements. Data stored in the cloud is encrypted at rest using 256-bit AES encryption -- the same standard used by the U.S. government for classified information.

• In transit: TLS encryption on all connections. It would take over 10,000 years to break through this encryption with current technology.
• At rest in the cloud: 256-bit AES encryption. Encryption keys are managed by Axcient and are themselves stored encrypted.
• On endpoints: Your organization is responsible for enabling full-disk encryption on all desktops, laptops, and mobile devices that access ePHI.

Access Control

HIPAA requires that access to ePHI be limited to authorized users with a legitimate need. AXIS CloudSync provides several mechanisms to enforce this:

• User accounts: Each user has a unique username and password. Administrators control who has access to the system.
• Team Shares: Share folders only with specific users or groups. Access can be revoked at any time.
• Secure Share links: Password-protected links with optional expiration dates. Never use anonymous public share links for ePHI.
• Active Directory integration: Sync users and groups from your AD/LDAP directory for centralized access control.
• Remote wipe: Administrators can remotely wipe AXIS CloudSync data from any device -- including former employees' computers.
• Two-factor authentication: Administrators can require 2FA for all users in the organization.

Audit Logging

HIPAA requires covered entities to maintain audit controls that record and examine activity in systems containing ePHI. AXIS CloudSync maintains a comprehensive audit log of all activity, including:

• File uploads, downloads, edits, deletions, and restorations.
• Sharing events -- who shared what with whom, and when.
• Login and authentication events, including failed login attempts.
• Administrative actions -- account creation, policy changes, permission modifications.
• Device registration and remote wipe events.

Audit logs are viewable from within AXIS CloudSync and can be exported for compliance reporting. Access logs are kept for all authenticated and anonymous users who download data from the web portal or mobile apps. See the Audit Log Reports guide for instructions on generating and exporting reports.

Business Associate Agreement (BAA)

Under HIPAA, any vendor that handles ePHI on behalf of a covered entity is a Business Associate and must sign a Business Associate Agreement (BAA). AXIS CloudSync provides a BAA to all customers who handle ePHI.

1. 1Contact your AXIS CloudSync account manager or sales team to request a BAA.
2. 2Review the BAA with your legal and compliance team.
3. 3Sign and return the BAA. Keep a copy on file.
4. 4Once the BAA is in place, you may use AXIS CloudSync to store and transmit ePHI.

HIPAA Configuration Checklist

Before going live with ePHI in AXIS CloudSync, verify that the following items are configured:

• Signed BAA with AXIS CloudSync / Axcient.
• Two-factor authentication enabled and enforced for all users.
• Strong, unique passwords configured for all accounts.
• Full-disk encryption enabled on all endpoint devices (desktops, laptops, mobile).
• Mobile device management (MDM) solution in place for all mobile endpoints.
• Anonymous share links disabled for any folders containing ePHI.
• Active Directory integration configured (if applicable) for centralized access control.
• Audit log review process established -- who reviews logs, how often, and what triggers investigation.
• Remote wipe procedures documented and tested.
• User training completed on HIPAA requirements and AXIS CloudSync security features.

2026 HIPAA Security Rule Changes

The U.S. Department of Health and Human Services (HHS) has finalized significant updates to the HIPAA Security Rule, with new requirements taking effect in 2026. Key changes include mandatory risk analysis documentation, enhanced technical safeguards, and stricter audit controls.