HIPAA · Covered entities and business associates
Exchange PHI under a signed BAA and keep the record of every transfer
Sharetru signs its own business associate agreement (BAA) and is assessed against the HIPAA Security Rule by A-LIGN every year. Partners, patients and employers join as free guests.
- SignA BAA before the first file moves
- ExchangeLinks for people, SFTP for systems
- ControlRoles, folders and app-code sign-in
- RecordEvery transfer, kept 6 years with the package
30-minute security review · 15-day free trial
- Recipient
- edi@northwindbilling.exampleA registered guest, free on every plan
- Sign-in
- App code requiredMulti-factor, when you require it
- Access
- Group folder permissionsOnly the people your policy names
- Record kept
- 6 yearsWith the HIPAA Support Package · export to CSV
This morning · the record
- Download09:41 · 835-remits-1023.zip · guest edi@northwindbilling.example
- Upload08:55 · 837-claims-1022.x12 · svc-claims · SFTP
- Link sent08:40 · 4 files · claims.ops → edi@northwindbilling.example
Illustrative. The partner, files and times are invented.
Where PHI exchange goes wrong
Where does sharing PHI with another organization go wrong?
At four points: the agreement, the server, the record of who accessed what, and the vendor at the other end. Each has a public HHS source.
Holding a questionnaire from a covered entity? Bring it to a 30-minute security and compliance review; we answer it in writing afterwards.
Request the review-
No agreement first
PHI moves to a vendor before anyone signed a BAA
HHS settled with Advanced Care Hospitalists for $500,000 in December 2018 after it shared PHI with a vendor without a business associate agreement. MedEvolve, a business associate, paid $350,000 in 2023; one finding was that it had no BAA with a subcontractor.
Answered by Sharetru’s own BAA, signed before the first file moves. Sources: ACH (opens in a new tab) · MedEvolve (opens in a new tab).
-
A server open to the internet
A self-run transfer server holds PHI that anyone can reach
In the MedEvolve case an FTP server holding PHI was accessible on the internet from January 2018. It affected 230,572 individuals at two covered entities, and at least one unauthorized person viewed the data.
Answered by The controls below: a named account per person, encrypted connections (TLS or SSH, plain FTP kept off), and no server of your own to patch.
-
No record to show
Asked who opened a file last spring, you can’t say
The Security Rule requires mechanisms that record and examine activity in systems that hold ePHI (45 CFR 164.312(b)), and regular review of those records (164.308(a)(1)(ii)(D)). Email and shared drives rarely produce an answer.
Answered by The record: every sign-in, upload, download, share and permission change, filtered and exported on demand.
-
The vendor holds the volume
The largest breaches happen at the vendor, not the clinic
In 2024 business associates filed 16% of the breach reports of 500 or more people to HHS, and those reports covered 85% of the individuals affected, about 207 million of 243 million.
Answered by Ask the vendor for proof: A-LIGN’s independent assessment, with a summary on the security review call and the full report under NDA in a trial. Source: OCR 2024 report (opens in a new tab).
Their unlimited guest sharing feature has been invaluable for working with external labs.
Who uses it
Which HIPAA organizations exchange files on Sharetru, and what moves?
Clearinghouses, billing companies, plans, pharmacy benefit managers, labs and clinics: any organization that sends or receives PHI as files. Each row names what moves, how, and what stays yours.
Seven kinds of organization
What moves and who decides
| Organization | What moves | How it moves on Sharetru | What stays yours |
|---|---|---|---|
Clearinghouses and claims processors837 claims, 835 remittances, PDFs |
Batch files with payers, providers and billing partners | SFTP or FTPS from your system; a link and a free guest account for the partner who has no system; every transfer recorded | X12 formatting and validation, and payer connectivity |
Billing and revenue-cycle companiesfor medical practices |
Claims files, statements and records, both ways with each practice | A folder per practice, with permissions by group; guests are free, so the practice count never adds to the bill | The billing system and each practice’s data |
Health plans, TPAs and benefits administratorspayers and plan sponsors |
Eligibility, enrollment and claims data feeds with employers and vendors | SFTP for the recurring feeds, links for the one-off requests; a record of each download | File layouts, and the schedule that runs the feeds |
Pharmacy benefit managers and pharmaciesprescription claims |
Prescription claims feeds and reports with plan sponsors and pharmacies | SFTP for feeds, 6 years of logs with the HIPAA Support Package, export on demand | What each sponsor may receive |
Labs and imaging centersresults and studies |
Result batches to partner clinics; imaging studies as ZIP or ISO files | SFTP for batches to many clinics, no per-user fees; large files as files, with no size limit beyond your storage | Interfaces to the lab system or PACS; Sharetru does not speak DICOM |
Clinics, hospitals and health centersproviders |
Records to outside specialists and labs, files to patients and employers, remittances during an EHR move | A link to an outside party, who joins as a guest; SFTP for a system; every view and download recorded | The EHR, and what is the minimum necessary to send |
Vendors that handle PHI for otherstranscription, coding, records release |
Dictation, coded charts and release packages, out and back | A folder per client; Sharetru’s BAA covers Sharetru’s part, and you keep yours with each client | Your BAAs with your own customers |
Looking for the examples? The healthcare page walks through the exchanges by workflow; this page is about the rules and the agreement.
The agreement
Is Sharetru a business associate, and what has A-LIGN assessed?
Yes: Sharetru stores and transmits your PHI, so a signed BAA comes before the first file. A-LIGN assesses the Sharetru service against the HIPAA Security Rule every year.
- CE
- 45 CFR 160.103 (opens in a new tab)Covered entity. A health plan, a health care clearinghouse, or a health care provider that sends health information electronically in connection with a standard transaction.
- BA
- 45 CFR 160.103 (opens in a new tab)Business associate. A person or company that creates, receives, maintains or transmits PHI for a covered entity, and a subcontractor that does so for another business associate. If you are a clearinghouse or a billing company, you may be one yourself.
- BAA
- 45 CFR 164.308(b), 164.502(e), 164.504(e) (opens in a new tab)Business associate agreement. The written contract that must be in place before a business associate handles PHI for you. A file service that stores your encrypted PHI is still a business associate, even without the key (HHS cloud guidance).
- ePHI
- 45 CFR 160.103 (opens in a new tab)Electronic protected health information. PHI in electronic form: the claim file, the lab result, the scanned record. It is what the Security Rule’s safeguards protect.
A-LIGNEvery yearReport under NDAScope: the Sharetru service on Sharetru Commercial. Report type: HIPAA Type 1. Sharetru Commercial is the standard platform; Sharetru Federal is the separate FedRAMP Moderate environment for federal work, and it is not part of the HIPAA assessment. HHS does not certify or endorse products, so no vendor can be “HIPAA certified”; what you can ask a vendor for is a signed BAA and an independent assessment you can read.
Sharetru’s SFTP capabilities allow us to securely transfer large batches of lab results to dozens of partner clinics without worrying about file size limitations or per-user fees.
The rules behind the exchange
Which HIPAA rules reach a file you send to a partner, and what does Sharetru provide for each?
The BAA rules and five Security Rule standards: access, audit, authentication, transmission and documentation. The table shows what each asks, what Sharetru provides and what stays yours.
- 1
You are a covered entity or a business associate.
Either way, the Security Rule applies to the ePHI you create, receive, maintain or transmit.
- 2
Anyone who handles that PHI for you needs a BAA first.
That includes a file service. Sharetru signs its own.
- 3
The Security Rule sets safeguards for the ePHI itself.
Some are required, some addressable: you decide, and document why, where a standard is addressable.
- 4
You keep the documentation.
Policies and required documentation are kept six years. Your assessor, your auditor or OCR may ask for them.
Read the rules clause by clauseWhat each asks, what Sharetru provides, and what stays yours
| Rule | What it asks | What Sharetru provides, and what stays yours | Source |
|---|---|---|---|
| Business associate agreement164.308(b) · 164.502(e) · 164.504(e) | A written contract before a business associate creates, receives, maintains or transmits PHI for you. | Sharetru’s own BAA, with the HIPAA Support Package. Yours: the BAAs with your own customers and subcontractors. | 45 CFR 164 (opens in a new tab)Deeper: the security review |
| Risk analysis164.308(a)(1)(ii)(A) | An accurate and thorough assessment of the risks to the ePHI you hold. | A-LIGN’s HIPAA report and the SOC 2 Type II report, under NDA, for the file service’s part. Yours: the analysis itself. | 45 CFR 164 (opens in a new tab)Deeper: Security and audit |
| Access control164.312(a) | A unique identifier for each user. Automatic logoff and encryption are addressable. | A named account for each person, guests included, folder permissions by group, and account lockout policies by username and by IP address, on Core and Complete. Yours: who gets which folder, and the limits. | 45 CFR 164 (opens in a new tab)Deeper: User access management |
| Audit controls164.312(b) | Mechanisms that record and examine activity in systems that hold ePHI. | Every sign-in, upload, download, share and permission change, filtered and exported to CSV, kept up to 6 years with the HIPAA Support Package. Yours: reading it. | 45 CFR 164 (opens in a new tab)Deeper: Security and audit |
| Information system activity review164.308(a)(1)(ii)(D) | Regular review of records of activity, such as audit logs and access reports. | The Logs page, CSV export, syslog to your SIEM (Complete) and view-only auditor roles. Yours: the review, on your schedule. | 45 CFR 164 (opens in a new tab)Deeper: Security and audit |
| Person or entity authentication164.312(d) | Procedures to verify that a person seeking access is the one claimed. | App-code sign-in on the web when you require it, SSH keys over SFTP, and single sign-on on Complete. Yours: requiring it for every user. | 45 CFR 164 (opens in a new tab)Deeper: User access management |
| Transmission security164.312(e) | Guard ePHI against unauthorized access in transit. Integrity controls and encryption are addressable. | TLS or SSH on every protocol except plain FTP, AES-256 at rest, FIPS 140-2 validated modules. Yours: keeping plain FTP off, and encrypting files before upload (PGP) where a partner requires it. | 45 CFR 164 (opens in a new tab)Deeper: Protocols |
| Minimum necessary164.502(b) | Limit the PHI used, disclosed or requested to what the purpose needs. | Folder permissions by group, links bound to one address, expiry up to 365 days. Yours: deciding what each partner needs. | 45 CFR 164 (opens in a new tab)Deeper: Link-based sharing |
| Documentation164.316(b)(2) | Keep policies and required documentation for six years. This covers documentation, not access logs. | The BAA, the reports and an exportable log to file with it. Yours: keeping your own policies and records. | 45 CFR 164 (opens in a new tab)Deeper: the security review |
Nothing here is legal advice; your counsel and your assessor decide how each rule applies to you.
Alongside what you run
Where does Sharetru sit beside your EHR, your clearinghouse and your billing system?
At the edge: your systems stay the record of care and billing, and Sharetru is where files cross to people and partners outside them. It is a file exchange, not an interface engine.
People: a link and a free guest account
A patient, an employer or a partner clinic opens a link, registers once as a guest and gets or sends the file. Guests are free on every plan. Link-based file sharing.
Systems: SFTP, FTPS and the REST API
Your billing system, EHR export or scheduler connects with the client it already has and runs the job on its own schedule; Sharetru is the endpoint. It has no scheduler of its own (your system starts each transfer) and no AS2. Protocols and automation.
Your SIEM and your auditor get the record
Export CSV for an auditor on any plan, and on Complete forward every event by syslog to your SIEM. Security and audit.
See a claims exchange on a live Sharetru site.60 minutes, sample files, your questions.
The evidence pack
What can we hand a covered entity or an auditor, and where does each piece come from?
The BAA, A-LIGN’s HIPAA report, the SOC 2 Type II report and your own log export. The log export is yours from the first day of a trial; the reports come under NDA during the trial.
- BAA
Sharetru’s business associate agreement
The agreement covers Sharetru’s part in handling your PHI. It is Sharetru’s own: it does not sign customer-drafted BAAs. Book the security review and the terms come to you for your counsel; it is signed once you are a customer on the HIPAA Support Package.
Terms on the review call - HIPAA
A-LIGN’s HIPAA Security Rule report
A HIPAA Type 1 report: A-LIGN’s independent assessment of the Sharetru service on Sharetru Commercial, repeated every year. The security review walks through a summary; the full report comes under NDA in a trial.
Summary on the review call - TYPE II
The SOC 2 Type II report
A-LIGN’s attestation on the Sharetru service over the report period, with the subservice organizations named.
With a trial or account · NDA - CSV
The activity log: what happened
One line per event, with date, user, action, file name and result. Filter it and export it, and on Complete send it to your SIEM by syslog.
Yours
The Sharetru Federal platform is not part of the HIPAA assessment. If a questionnaire names it, tell us which platform your site runs on.
Where to get the record
- Logs pagefilter by user, date or event, then export CSV
- SIEMforwarded by syslog, on Complete
- Reportsusers and folder access, each to CSV
What the review gives you
- Written answersto your questionnaire, after the 30 minutes
- The BAA termssent for your counsel to read
- The reportsa HIPAA summary on the call; full reports under NDA in a trial
Swipe sideways to see the whole row →
A slice of the record · illustrative
The partner, files and times are invented. Your log shows your own accounts and files.
…it actually supports the kind of flexibility we need for real-world clinical workflows without getting in the way.
Plans and pricing
What does it cost to exchange PHI on Sharetru?
Your Sharetru plan, plus the HIPAA Support Package at $100 a month, plus your storage. Partners join as guests, so they never add to the bill.
Your plan
Core or Complete
Core grows in matched steps of users and storage: 10 users and 10 GB for $199, 20 and 20 for $249, or 30 and 30 for $299 a month.
Complete: $499 a month with unlimited users and 100 GB, then $100 for each extra 100 GB.
Single sign-on and retention automation on Complete
HIPAA Support Package
The BAA and the long record
Required for Sharetru’s signed BAA and 6 years of logs.
$100 a month on either plan
Storage
Grows with your volume
Core bundles storage with users. Complete runs from 100 GB at $499 to 900 GB at $1,299 a month in $100 steps; 1 TB and beyond is quoted.
Example: a billing company with 8 staff, 2 SFTP accounts and 60 practices as guests has 10 users, so it runs on Core at $199 plus the $100 package, $299 a month. Guests never count as users; SFTP accounts do. A nonprofit? Contact Sharetru for a nonprofit quote. Every plan is a 12-month term, paid monthly or annually; the 15-day trial commits you to nothing but the trial. The estimator on the plan page shows the monthly figure and your written quote confirms it. The trial uses sample files only; Sharetru signs the BAA once you are a customer, and you can end the trial early to sign sooner.
Which Sharetru platform carries PHI?
Run PHI on Sharetru Commercial, the platform A-LIGN assesses against the HIPAA Security Rule. Choose Sharetru Federal when a federal contract also names FedRAMP Moderate or CUI; it is not part of the HIPAA assessment.
| What differs | Sharetru Commercial | Sharetru Federal |
|---|---|---|
| A-LIGN HIPAA assessment | In scope | —Not part of it |
| SOC 2 Type II | Attested | Attested |
| FedRAMP Moderate | —Not certified | Certified (Class C) |
| Activity record | 6 years with the HIPAA package | 12 months |
FAQ
What HIPAA organizations ask before they move PHI
The agreement
Is Sharetru HIPAA compliant?
HHS does not certify products, so no file service is HIPAA certified; what you get is a signed BAA and an annual independent assessment. Sharetru adds a SOC 2 Type II attestation and the controls above. Whether your use is compliant stays your decision, with your counsel.
Will Sharetru sign our BAA?
Yes: Sharetru signs its own BAA, which comes with the HIPAA Support Package at $100 a month. It does not sign customer-drafted agreements, because the BAA extends Sharetru’s Terms of Service.
Book the security review and we send you the BAA terms for your counsel to read before you decide.
When is the BAA signed, and can we test with real PHI first?
The BAA is signed once you are a customer on the HIPAA Support Package, before any PHI moves. The trial uses sample files only, because no BAA exists yet.
If you want the BAA sooner and know you are staying, we can end the trial early and start your plan.
What does the HIPAA Support Package include, and do we need it?
It is $100 a month on either plan, and it is required for Sharetru’s signed BAA and for 6 years of logs. Without it you have the plan alone: no BAA, and logs kept 3 months on Core or 6 on Complete.
Add it when you buy the plan; the BAA is signed once you are a customer.
Can we read the A-LIGN report before we buy?
Yes, in two steps: the security review walks through a summary of the report, and the full report comes under NDA during your trial. It is a HIPAA Type 1 report on the Sharetru service on Sharetru Commercial, repeated every year.
What it is and is not
Does Sharetru replace our EHR, interface engine or clearinghouse?
No: Sharetru is not an interface engine and does not speak HL7, FHIR, X12 or DICOM. It moves the files around them.
It has no scheduler (your system starts each transfer), no AS2 (a messaging protocol some trading partners require) and no file-level encryption of its own (encrypt before upload if a partner requires PGP). A partner that needs AS2 or a SOAP web service needs another endpoint.
Can it carry medical imaging?
As files, yes: a study as a ZIP or ISO moves like any large file, with no size limit beyond your storage. Sharetru does not take a DICOM push, query a PACS or view images.
Can we exchange X12 claim and remittance files over SFTP?
Yes: 837 and 835 batches move as ordinary files over SFTP or FTPS. Your system or clearinghouse builds and validates them; Sharetru carries them and records the transfer. Each SFTP account counts as a user.
Security and access
How is PHI encrypted, in transit and at rest?
AES-256 at rest, and TLS or SSH in transit, using FIPS 140-2 validated modules. Plain FTP is kept off. If a partner needs file-level encryption such as PGP, encrypt the file before you upload it.
Does Sharetru lock accounts after failed sign-ins?
Yes: account lockout policies work by username and by IP address, on both Core and Complete. Pair them with required multi-factor sign-in for every user.
Can our auditor see the record without administrator rights?
Yes: view-only auditor roles and CSV exports let an auditor read the record without changing anything. Every sign-in, upload, download, share and permission change is in it.
Does Sharetru support single sign-on?
Yes: single sign-on is on Complete, so your staff sign in through your identity provider. Staff on single sign-on use your identity provider’s multi-factor sign-in.
The record
How long are the logs kept, and does HIPAA require that?
6 years with the HIPAA Support Package; without it, 3 months on Core and 6 months on Complete. HIPAA’s six-year rule (45 CFR 164.316(b)(2)) covers policies and required documentation, not access logs by name; the package gives your logs the same six years. Export them at any time.
Sign-in
Does Sharetru support multi-factor authentication, and is it required?
Yes: you can require a code on every password sign-in, guests included: an authenticator app, email or text. For PHI we suggest the authenticator app. HHS proposed in January 2025 to require it in the Security Rule; check the Federal Register for whether that rule is final.
People outside your organization
Can patients, employers and partner clinics receive files?
Yes: each opens a link and registers once as a guest, free on every plan. A guest registers with an email address and a password, then a code if you require one. Every view and download is recorded against that account.
Can we control who opens a shared link and for how long?
Yes: a link can be bound to one recipient address and set to expire, up to 365 days. Every view and download is recorded against the guest’s account.
Is email allowed for PHI?
HIPAA does not ban email, but each copy lands in another mailbox and nothing records who opened it. A link keeps the file on your site, with the record.
Plans and cost
How many users will we need, and do SFTP accounts count?
Anyone with their own credentials is a user, SFTP accounts included; guests who only open links never count. Core grows in matched steps: 10 users and 10 GB, 20 and 20, or 30 and 30. Complete has unlimited users.
A billing company with 8 staff and 2 SFTP accounts has 10 users and fits the smallest Core step, however many practices it serves as guests.
What does storage cost beyond the plan?
Core bundles storage with users; Complete starts at 100 GB for $499 a month and adds 100 GB for $100, up to 900 GB. From 1 TB the price is quoted. The estimator on the plan page shows your monthly figure.
Are we locked into a term?
Every plan is a 12-month term, paid monthly or annually, and annual payment saves 10%. The 15-day trial commits you to nothing but the trial.
Is there a nonprofit discount?
Yes: contact Sharetru for a nonprofit quote. The quote gives one monthly figure for the plan, the HIPAA Support Package and your storage.
Platforms
Does Sharetru Federal carry PHI?
PHI belongs on Sharetru Commercial, the platform A-LIGN assesses for HIPAA. Sharetru Federal is for federal contracts that name FedRAMP Moderate or CUI, and is not part of the HIPAA assessment.
Next step
See a claims exchange, from batch out to remittance back, with the record behind it.
The demo runs 60 minutes on a live Sharetru site with sample files: a claims batch out to a partner, a remittance back, and the log export your auditor would read.
Ready to try it? Start the trial on the plan page. Not a compliance project? Talk through how you move files today.
Sources: 45 CFR Parts 160 and 164 (the HIPAA Privacy and Security Rules); HHS Office for Civil Rights, 2024 Report to Congress on breaches of unsecured protected health information; the HHS resolution agreements with Advanced Care Hospitalists (December 2018) and MedEvolve (March 2023); HHS guidance on HIPAA and cloud computing; the Sharetru Terms of Service and plan page. Customer quotes are from Sharetru customers in healthcare. The partner, files and times in the illustrations are invented. Nothing on this page is legal advice.