Dropbox: Google Drive and Microsoft Office Integrations with PHI and HIPAA-Regulated Data

Environment

Dropbox / Google Drive / Microsoft 365

Issue

Using Google Drive or Microsoft Office integrations with Dropbox when working with PHI or HIPAA regulated data.

Resolution

Although storing and collaborating on documents containing PHI or HIPAA data in Dropbox is acceptable, caution needs to be taken when integrating with U-M Google or U-M Microsoft 365. This includes the creation and collaboration of documents online. 

Dropbox and U-M Google (Cloud-Based)

• Users should not use the Google Drive integrations (Google Docs / Google Sheets / Google Slides) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox. While the data is stored in Dropbox, if you open a Google file, it temporarily sends the document to Google for editing and collaboration. This is not permitted.

Dropbox and U-M Microsoft 365 Online (Cloud-Based)

• Users should not use the U-M Microsoft 365 Online integrations (Word for the web, Excel for the web, etc.) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox. While the data is stored in Dropbox, if you open a file in cloud-based Microsoft Office, it temporarily sends the document to Microsoft Office online for editing and collaboration. This is not permitted.

Dropbox and Michigan Medicine Microsoft 365 Online (Cloud-Based)

• If you are signed in to the Michigan Medicine 365 tenant with your level-2 credentials, you may use Microsoft Office Online integrations (Word for the web, Excel for the web, etc.) within Dropbox to interact with PHI or HIPAA-regulated data stored in Dropbox.
• The Michigan Medicine 365 tenant is HIPAA compliant, so it is safe to use PHI.

Dropbox and Microsoft 365 Desktop Applications (Locally Installed MS Apps)

• PHI or HIPAA-regulated data stored in Dropbox can be used with locally-installed Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, etc.).

In order to do this, the user must:

• Install the Dropbox desktop client and make sure it is running locally on their computer
• Install the Microsoft 365 desktop applications (Microsoft Word, Microsoft Excel, Microsoft PowerPoint)

Once these conditions are met, the user can open the file in the Dropbox web interface and hand it off to the local Microsoft desktop application.

1. Hover over the file in the Dropbox web interface, then click the More icon (three horizontal dots) on the far right 
2. Click Open
3. Click Microsoft Excel (or Microsoft Word, etc.)
4. DO NOT SELECT "Excel for the web" (or Word for the web, etc.) if using U-M Microsoft 365 or "Google Sheets" (or Google Docs, Google Slides, etc.)

The document in the web window will then be handed off to the local installation of the Microsoft application for use. When the work is done, you can save the file via the desktop Microsoft application, and it is saved back to Dropbox.

Additional Information

Please refer to the sensitive data guide: https://its.umich.edu/computing/backup-storage/finder

Need additional information or assistance? Contact the ITS Service Center.