Dropbox: Microsoft Office 365 Integration with PHI and HIPAA-Regulated Data

Environment

Dropbox, Microsoft 365

Issue

Can I use the Microsoft 365 integration with Dropbox when working with PHI or HIPAA-regulated data?

Resolution

Although storing and collaborating on documents containing PHI or HIPAA data in Dropbox is acceptable, caution needs to be taken when integrating with Microsoft 365. This includes the creation and collaboration of documents online.

U-M Dropbox and Microsoft 365 Online (cloud-based)

• Users should not use the U-M Microsoft 365 Online integrations (Word for the web, Excel for the web, etc.) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox. While the data is stored in Dropbox, if you open a file in cloud-based Microsoft 365, it temporarily sends the document to Microsoft 365 Online for editing and collaboration. This is not permitted.

Dropbox and Michigan Medicine Microsoft 365 Online (cloud-based)

• If you are signed in to the Michigan Medicine Microsoft 365 tenant with your Level-2 credentials, you may use Microsoft Office Online integrations (Word for the web, Excel for the web, etc.) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox.
• The Michigan Medicine Microsoft 365 tenant is HIPAA compliant, so it is safe to use PHI.

Dropbox and Microsoft 365 desktop applications (locally installed Microsoft apps)

• PHI or HIPAA-regulated data stored in Dropbox can be used with locally installed Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, etc.).
• In order to do this, the user must:
  • Install the Dropbox desktop app and ensure it is running locally on their computer.
  • Install the Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, Microsoft PowerPoint).
• Once these conditions are met, the user can open the file in the Dropbox web interface and hand it off to the local Microsoft desktop application.

1. Hover over the file in the Dropbox web interface and click the three-dot icon.
2. Hover over Open in and select Microsoft Excel (or Microsoft Word, PowerPoint, depending on file type).

• DO NOT SELECT "Excel for the web" (or Word for the web, etc.) if using U-M Microsoft 365.
• The document in the web window will then be handed off to the local installation of the Microsoft application for use. When the work is done, you can save the file via the desktop Microsoft application, and it is saved back to Dropbox.

Additional Information

Note: As of January 12, 2024, the ability to access, create, and edit Google files in Dropbox has been removed.

Please refer to the sensitive data guide: https://its.umich.edu/computing/backup-storage/finder

Need additional information or assistance? Contact the ITS Service Center.