Dropbox: Google Drive and Microsoft Office Integrations with PHI and HIPAA-Regulated Data

Environment

Dropbox / Google Drive / Microsoft 365 / Dropbox Paper

Issue

Using Google Drive or Microsoft Office integrations with Dropbox when working with PHI or HIPAA regulated data.

Resolution

Although storing and collaborating on documents containing PHI or HIPAA data in Dropbox is acceptable, caution needs to be taken when integrating with U-M Google or U-M Microsoft 365. This includes the creation and collaboration of documents online. 

Dropbox and U-M Google (Cloud-Based)

Users should not use the Google Drive integrations (Google Docs / Google Sheets / Google Slides) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox. While the data is stored in Dropbox, if you open a Google file, it temporarily sends the document to Google for editing and collaboration. This is not permitted.

Dropbox and U-M Microsoft Online (Cloud-Based)

Users should not use the Microsoft Office Online integrations (Word for the web, Excel for the web, etc.) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox. While the data is stored in Dropbox, if you open a file in cloud-based Microsoft Office, it temporarily sends the document to Microsoft Office online for editing and collaboration. This is not permitted.

Dropbox and Microsoft 365 Desktop Applications (Locally Installed MS Apps)

PHI or HIPAA-regulated data stored in Dropbox can be used with locally-installed Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, etc.).

In order to do this, the user must:

  • Install the Dropbox desktop client and make sure it is running locally on their computer
  • Install the Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, Microsoft PowerPoint)

Once these conditions are met, the user can open the file in the Dropbox web interface and hand it off to the local Microsoft desktop application.

  1. Hover over the file in the Dropbox web interface, then click the More icon (three horizontal dots) on the far right 
  2. Click Open
  3. Click Microsoft Excel (or Microsoft Word, etc.)
  4. DO NOT SELECT "Excel for the web" (or Word for the web, etc.) or "Google Sheets" (or Google Docs, Google Slides, etc.)

Screenshot when the four steps above are complete with arrows pointing to the More icon, the Open menu item, and Microsoft Excel in the pop-out menu

The document in the web window will then be handed off to the local installation of the Microsoft application for use. When the work is done, you can save the file via the desktop Microsoft application, and it is saved back to Dropbox.


Dropbox Paper and PHI or HIPAA-Regulated Data

Dropbox Paper can also be used to store and collaboratively edit sensitive data, including PHI.

  1. In Dropbox, click the Create pulldown menu
  2. Click Document
  3. Click Dropbox Paper and a new Paper document will be available to edit

Screenshot of steps 1, 2, and 3 with arrows pointing to the create menu, then the Document menu, then Dropbox Paper on the far right

Additional Information

Please refer to the sensitive data guide: https://its.umich.edu/computing/backup-storage/finder

Need additional information or assistance? Contact the ITS Service Center.

0% helpful - 1 review

Details

Article ID: 4870
Created
Wed 4/14/21 6:22 PM
Modified
Thu 6/10/21 5:11 PM