HIPAA’s Security Rule requires seven technical safeguards for ePHI file storage: audit logs (§164.308), access controls (§164.312(a)), integrity protection (§164.312(c)(1)), integrity verification (§164.312(c)(2)), user authentication (§164.312(d)), AES-256 encryption (§164.312(e)), and 6-year document retention (§164.530). Self-hosted Gavety meets all seven on hardware you own: local access logs, per-folder permissions, AES-256 encrypted tunnel, LUKS at-rest encryption, and unlimited local storage retention you control.
Why HIPAA Compliance Matters for File Storage
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 sets the US federal standard for protecting sensitive patient health information. Its Security Rule, codified at 45 CFR Part 164, mandates specific technical safeguards for any organisation that stores, transmits, or processes electronic protected health information (ePHI).
HIPAA applies broadly. Covered entities include healthcare providers (doctors, hospitals, clinics, therapists), health plan providers (insurance companies), and — critically — their business associates: any third-party vendor that handles ePHI on their behalf. This includes IT providers, data storage vendors, billing companies, and overseas contractors working with US-based healthcare entities.
According to the HHS Office for Civil Rights, which enforces HIPAA, more than 93 million healthcare records were exposed or stolen in 2023 alone — the highest figure ever recorded. The civil penalty schedule reaches $50,000 per violation for wilful neglect, with a maximum of $1.9 million per year per violation category. Wilful misuse of ePHI can result in criminal prosecution and jail time.
File storage is the most direct touchpoint with HIPAA’s technical safeguards. Every patient record, intake form, billing document, insurance filing, and clinical note that is stored digitally must meet the §164 requirements. The question for any healthcare-adjacent individual or small team is not whether to comply — it is which storage architecture makes compliance achievable and demonstrable.
HIPAA §164 Requirements Mapped to Gavety Capabilities
The table below maps each HIPAA Security Rule requirement relevant to file storage to the specific capability Gavety provides. This is the same framework used in healthcare IT compliance reviews — applied to a self-hosted setup on hardware you own.
| HIPAA Requirement | Obligation (plain language) | How Gavety meets it |
|---|---|---|
| §164.308(a)(1)(ii)(D) | Implement procedures to regularly review records of information system activity, including audit logs, access reports, and security incident tracking. | Gavety generates local access logs for every ePHI file access event: filename, timestamp, user account, source IP. Exportable for audit purposes. ✓ Meets |
| §164.312(a)(1) | Implement technical policies and procedures to allow access to ePHI only to persons or software that have been granted access rights. | Per-folder read/write permissions. Time-limited token-secured shareable links. Principle of least privilege per folder. Zero inbound ports — no unauthenticated access path. ✓ Meets |
| §164.312(c)(1) | Implement policies and procedures to protect ePHI from improper alteration or destruction. | LUKS full-disk encryption prevents alteration of stored data if device is stolen. Offline 3-2-1 backup copy prevents destruction by ransomware. inotifywait anomaly detection for mass file changes. △ Requires LUKS + rsync |
| §164.312(c)(2) | Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner. | rsync checksums verify file integrity between primary and backup copy. Monthly restore tests confirm backup is restorable and unaltered. Gavety access logs show every modification event. △ Requires rsync + monthly test |
| §164.312(d) | Implement procedures to verify the identity of a person or entity seeking access to ePHI. | Authentication required at app.gavety.com before file access. MFA can be enabled on the Gavety account. Per-folder tokens are scoped and time-limited. ✓ Meets |
| §164.312(e)(2)(ii) | Implement a mechanism to encrypt ePHI whenever deemed appropriate (addressable specification — implementation or documented justification required). | AES-256 encrypted outbound tunnel for all ePHI in transit. Gavety relay cannot read file contents. LUKS adds AES-256 at rest. Both layers documented for your compliance record. ✓ Meets (with LUKS) |
| §164.530(j)(2) | Retain HIPAA-related policies, procedures, and compliance records in written or electronic form for at least 6 years from creation or last effect, whichever is later. | Unlimited storage on your own drive — no cloud storage cap. Define a 6-year retention folder structure. Gavety access logs retained locally under your control. ✓ Meets |
What Is the Compliance Difference Between Cloud and Self-Hosted?
HIPAA does not mandate a specific storage technology. It mandates technical safeguards. Both cloud storage and self-hosted storage can be configured to meet those safeguards — but the compliance architecture and risk profile differ fundamentally.
When you use a HIPAA-eligible cloud service, your compliance depends on the provider’s BAA, their security posture, and their technical controls — all of which are outside your direct control and can change. With self-hosted Gavety, the technical safeguards are architectural: your hardware, your encryption keys, your access logs. A change to Gavety’s policies cannot affect the ePHI files on your device. The HIPAA Security Rule’s intent is technical safeguards that actually protect ePHI — architecture provides a stronger guarantee than contract.
How Does Gavety Meet Each HIPAA §164 Requirement?
The following section maps each HIPAA Security Rule technical safeguard to the specific Gavety capability that addresses it — mirroring the structure used in enterprise HIPAA compliance documentation.
rsyslog, logrotate).app.gavety.com with the account credentials associated with your Gavety installation. Multi-factor authentication can be enabled on the Gavety account, adding a second verification layer beyond password. Shared access via generated links uses token-based authentication — the token is the credential, can be revoked at any time, and expires at the date you set. No ePHI is accessible without a valid authentication credential or token.What Does Gavety Not Cover Under HIPAA, and What Fills the Gap?
HIPAA compliance is broader than technical file storage safeguards. Here is an honest breakdown of what Gavety addresses and what remains your obligation as a covered entity or business associate.
| HIPAA Obligation | Gavety provides | What else is needed |
|---|---|---|
| §164.312(c)(1) Integrity protection |
Encrypted tunnel in transit; local access logs | Add LUKS at-rest encryption + 3-2-1 offline backup. Without LUKS, physical theft of device is a reportable breach. |
| Business Associate Agreement | Not required for file contents (Gavety cannot access ePHI) | If your compliance officer determines a BAA is needed for Gavety’s account-level processing, Gavety can provide one. Review Gavety’s data protection page. |
| Risk Assessment §164.308(a)(1)(ii)(A) |
Not provided | HIPAA requires a documented risk analysis of all ePHI storage. You must assess threats to your specific setup and document mitigations. Gavety’s architecture (zero inbound ports, encrypted tunnel) is a mitigation you can document. |
| Workforce Training §164.308(a)(5) |
Not provided | HIPAA requires security awareness training for workforce members. This is an organisational obligation independent of storage technology. |
| Breach Notification §164.400 |
Minimal breach surface (files not on Gavety servers) | If ePHI on your device is compromised, you must follow the breach notification rule: notify affected individuals within 60 days, HHS for breaches affecting 500+ individuals. LUKS encryption reduces what counts as a breach. |
| Sanction Policy §164.308(a)(1)(ii)(C) |
Not provided | HIPAA requires a documented sanctions policy for workforce members who violate ePHI policies. This is an HR and legal obligation, not a technical one. |
Gavety covers the file storage technical safeguards of HIPAA §164: AES-256 encryption in transit, zero inbound attack surface, per-folder access control, local audit logs, and unlimited 6-year retention on hardware you own. Paired with LUKS at-rest encryption and a 3-2-1 backup strategy, it meets all seven §164 technical safeguard requirements. It does not cover the administrative safeguards (risk analysis, workforce training, sanction policy) or the broader HIPAA compliance programme. Those obligations remain yours — and for any covered entity with significant ePHI processing, engagement with a qualified HIPAA compliance consultant is the correct next step alongside setting up the technical controls.
Common Questions About HIPAA Compliant File Storage
HIPAA applies to therapists who are covered entities — specifically, those who transmit health information in electronic form in connection with transactions for which HHS has adopted standards (primarily billing). Therapists in solo private practice who bill manually and do not transmit electronic health information may fall outside HIPAA’s covered entity definition, though they remain subject to state privacy laws which may be more stringent.
Health coaches are generally not covered entities under HIPAA unless they are employed by or contracted with a covered entity. However, any person handling ePHI as a business associate of a covered entity — such as a billing company, IT provider, or data storage vendor working with a healthcare organisation — must comply with the Security Rule. The HHS covered entity determination tool provides a definitive assessment for specific situations.
Under HIPAA, encryption (§164.312(e)(2)(ii) for transmission, §164.312(a)(2)(iv) for storage) is an addressable specification — not a required specification. This means covered entities must either implement it or document why it is not reasonable and appropriate given their specific environment, and implement an equivalent alternative.
In practice, the HHS Office for Civil Rights consistently finds that encryption failure contributed to breaches, and the OCR Phase 2 audit protocol treats lack of encryption as a significant risk finding. The practical standard is: encrypt ePHI in transit and at rest unless you can document a specific justified reason not to. With Gavety providing AES-256 in transit and LUKS at rest, both addressable specifications are met and documentable without ambiguity. See the HHS HIPAA Security Guidance for the full addressable vs required distinction.
HIPAA is a US federal law with mandatory compliance for covered entities and business associates. HITRUST (Health Information Trust Alliance) is a private certification framework that maps to HIPAA requirements and other security standards, providing a certifiable assessment of an organisation’s security posture. HITRUST certification is often requested by larger healthcare organisations from their vendors.
Gavety is not HITRUST-certified. For covered entities whose contracting partners require HITRUST certification from vendors, a HITRUST-certified cloud storage provider is the appropriate choice for those specific data flows. For solo practitioners, small clinics, and health-adjacent freelancers who need to meet HIPAA’s technical safeguards for their own file storage without the overhead of enterprise certification, self-hosted Gavety meets the §164 requirements directly and at a fraction of the cost of HIPAA-eligible cloud services.
Frequently Asked Questions
Does storing patient files on Google Drive violate HIPAA?
Not inherently, if you use Google Workspace with a signed Business Associate Agreement and HIPAA-eligible settings enabled. Standard consumer Google Drive (personal accounts) is not HIPAA-eligible and should not be used to store ePHI. Google Workspace Business or Enterprise tiers with a signed BAA can be used for ePHI storage, though Google’s systems will still process file metadata and may scan for malware.
Self-hosted Gavety sidesteps the cloud provider BAA question entirely for file contents — Gavety cannot access your ePHI, so the Business Associate relationship for file content does not exist. Your HIPAA compliance obligation for the file storage layer is met by the technical controls on your device, not a contractual agreement with a cloud provider.
What is a Business Associate Agreement (BAA) and does Gavety provide one?
A BAA is a contract required by HIPAA between a covered entity and any vendor or contractor that creates, receives, maintains, or transmits ePHI on the covered entity’s behalf. The BAA obligates the business associate to protect ePHI and report breaches.
For Gavety file storage: because your ePHI files are stored on your device and never pass through Gavety’s servers in readable form, Gavety does not create, receive, maintain, or transmit your ePHI. Gavety processes account-level data (email, billing) separately. Your compliance officer should review whether a BAA is required for your specific configuration. Gavety can provide a BAA for account-level processing; see the data protection page.
What counts as a HIPAA breach and when must it be reported?
A HIPAA breach is the unauthorised acquisition, access, use, or disclosure of unsecured ePHI that compromises the privacy or security of the information. The key word is “unsecured” — HIPAA defines unsecured ePHI as information that has not been rendered unusable, unreadable, or indecipherable to unauthorised persons. ePHI encrypted per HHS guidance (AES-256) is considered secured, meaning loss or theft of an encrypted device may not constitute a reportable breach.
Affected individuals must be notified within 60 days of breach discovery. If the breach affects 500 or more individuals in a state, the HHS Secretary and local media must also be notified promptly. Breaches affecting fewer than 500 individuals are reported to HHS annually. With Gavety + LUKS encryption, physical theft of your device is less likely to trigger breach notification requirements.
How does Gavety’s outbound tunnel affect HIPAA compliance?
Gavety’s outbound tunnel creates an encrypted connection from your device to app.gavety.com without opening any inbound ports. For HIPAA, this directly addresses two safeguard requirements: §164.312(a)(1) access control (no unauthenticated network path to ePHI exists) and §164.312(e)(2)(ii) transmission security (AES-256 encryption of ePHI in transit). The outbound-only architecture also means your device is not discoverable by network scanners — a significant reduction in attack surface compared to traditional self-hosting with port forwarding, which HIPAA’s risk analysis requirement would flag as a threat requiring mitigation.
How long do I need to keep patient records under HIPAA?
HIPAA §164.530(j)(2) specifies a 6-year minimum retention for HIPAA-related compliance documentation: policies, procedures, authorizations, risk assessments, and similar records. For the medical records themselves (clinical notes, patient files, treatment records), HIPAA defers to state law and applicable federal programme requirements (Medicare, Medicaid, FDA). Most state laws require 5–10 years of medical record retention; some require lifetime retention for paediatric records. HIPAA recommends consulting state regulations and programme-specific requirements when defining medical record retention schedules. Gavety provides unlimited local storage retention on hardware you own, with no platform decision that can force earlier deletion.
HIPAA technical safeguards by architecture, not just a BAA.
Gavety stores ePHI on hardware you own, encrypts access in transit with AES-256, generates local audit logs, and gives you per-folder access control. Zero inbound ports — no unauthenticated network path to your patient files. Works on any Linux device, no port forwarding required.
Read the setup guide → Free for LAN use · $100 one-time licence · $20/user/year for remote access