Healthcare file transfer protocols
Secure healthcare file transfer beyond email and SFTP.
Send patient files to people outside your organization—without managing SFTP accounts or shared-folder access.
Review HIPAA file sharing and BAA detailsBusiness is eligible for the standard BAA process; your organization needs the appropriate BAA, settings, and safeguards for ePHI. Free and Standard are not approved by SendThisFile for ePHI.
SendThisFileProtectedStart with the actual handoff
The protocol is only one part of the decision.
A secure connection answers how data moves between endpoints. A dependable healthcare file-transfer process must also answer who receives the file, how that person is verified, how long access remains available, what the sender can see afterward, and which agreements and organizational practices apply.
Encryption does not, by itself, make a workflow HIPAA compliant. HIPAA compliance depends on the organization, people, policies, safeguards, configuration, and agreements around the transfer.
Six practical approaches
Choose the method that fits the healthcare workflow.
Email, server protocols, shared folders, portals, and browser-based delivery solve different jobs. Compare the operational path—not just the encryption acronym.
| Method | Useful for | What to evaluate |
|---|---|---|
| SendThisFile BusinessPractical external handoff | Person-to-person external healthcare handoff of patient files through a protected browser download. | Encrypted transfer and temporary storage, recipient protections, a 30-day availability window, Activity visibility, and access to the standard BAA process. |
| Email attachments | Small routine files within both organizations' approved email policies. | Attachments hit size limits and offer little control after delivery. Business uses a controlled download link with a defined availability window and download outcome in Activity. |
| FTP | Legacy system-to-system transfers that still depend on FTP tooling. | Standard FTP is unencrypted; secure variants add administration. For person-to-person delivery, Business offers an encrypted browser handoff without managing an FTP server. |
| SFTP | Scheduled integrations with managed accounts, keys, and servers. | SFTP secures transport over SSH but requires transfer infrastructure. For person-to-person delivery, Business avoids provisioning SFTP recipient accounts and keys or managing a transfer server. |
| Shared drives and cloud folders | Ongoing collaboration among a known working group. | Shared folders require ongoing external-permission governance. Business addresses a recipient for a defined window and shows the download outcome in Activity instead of maintaining persistent folder access. |
| Healthcare or patient portals | Structured clinical, patient, or referral workflows. | Portals can remain the system of record. Business complements them for one-off external recipients outside the portal flow when an approved handoff path is needed. |
Where SendThisFile Business fits
A controlled handoff without running a file-transfer server.
Use SendThisFile when a staff member needs to deliver healthcare files to a patient, provider, payer, lab, or outside partner through a browser-based download.
Prepare
Add the intended recipient and only the healthcare files that need to be shared.
Protect
Use recipient verification and a separate download password when your organization's workflow requires them.
Check
Review the transfer and download outcome in Activity, and end access sooner when it should no longer remain available.
Keep the boundary clear: SendThisFile is an external file-handoff service. It is not an EHR, patient portal, shared working folder, clinical system of record, or SFTP/FTP hosting service.
Protocol versus compliance
HIPAA is a workflow and governance question—not a protocol label.
SFTP, HTTPS, and encrypted email can protect data in transit. None of those labels tells you whether the recipient was correctly identified, whether access lasts longer than needed, whether activity is visible, whether staff followed policy, or whether a BAA is required and in place.
The dedicated HIPAA page explains how SendThisFile Business supports patient file sharing, which plan is eligible, and how the standard BAA process works.
Review the HIPAA and BAA pathCommon questions
Questions healthcare and IT teams ask before choosing.
Is SFTP alone sufficient for healthcare data?
No protocol alone establishes a complete healthcare or HIPAA workflow. SFTP can protect transport over SSH, but your organization must also address recipient access, server and key administration, availability, activity evidence, organizational practices, and any required agreement.
Is encrypted email automatically HIPAA compliant?
No. Encryption is one safeguard, not a complete compliance determination. Your organization must approve the service, configuration, recipients, handling practices, retention, recordkeeping, and any required Business Associate Agreement.
How does SendThisFile Business protect a healthcare file handoff?
Files are encrypted while they travel between the user's browser and SendThisFile and while temporarily stored awaiting download. Business can require recipient verification and a separate download password, applies a 30-day availability window, and shows the transfer and download outcome in Activity.
Does SendThisFile provide a Business Associate Agreement?
Business is eligible for SendThisFile's standard BAA process. Review the HIPAA file-sharing page for the current eligibility, request, review, and signature path before using the service for ePHI.
Does SendThisFile replace an EHR, patient portal, or SFTP server?
No. SendThisFile fits the external file handoff: a person sends files and an intended recipient downloads them. It is not an EHR, clinical system of record, shared working folder, or SFTP/FTP hosting service.
A practical Business path
Make the next healthcare file handoff easier to manage.
Compare Business plans for the recipient protections, availability, and Activity tools described here. Review the HIPAA page before your organization sends ePHI.