Using Box at Yale with sensitive data (HIPAA, FERPA, FISMA)


Box at Yale consists of two instances: regular Box at Yale and Secure Box.

When is Secure Box required?

If you handle any kind of High Risk Data, including HIPAA data, in your Box account, or were hired into a Covered Entity you must use our Secure Box instance.

For the definition of a covered entity and a list of covered departments, see: https://hipaa.yale.edu/policies-procedures-forms/hipaa-glossary-terms

How do I know if I am on Secure Box?

If you are unsure if you are on regular Box at Yale or the Secure Box instance, please see our help article: How can I tell if I am using regular Box or Secure Box?

How to I switch to/request Secure Box?

If you handle any kind of High-Risk Data in Box, and you are currently using regular Box, you will need to request to be moved to Secure Box. Please contact your IT support provider or the ITS Help Desk to request this switch.