Regardless of the source, prior to creating, using, storing, transmitting or sharing Protected Health Information, one must be certain that their activities are permissible in accordance with prevailing laws, regulations, standards and institutional policy.
Penn State Health (PSH) does not currently recognize Box as an authorized repository for creating, using, storing, transmitting or sharing Protected Health Information (PHI). This includes PHI that originates from Penn State Health and PHI that originates from entities external to Penn State Health.
Exceptions to the PSH corporate policy are only permissible when they are authorized in writing by the recognized PSH Information Owner and then, only when information security standards established by the PSH Department of Information Services are properly implemented and maintained.
Questions pertaining to the access and use of Protected Health Information created or maintained by Penn State Health should be directed to your supervisor and then, as appropriate, to the recognized PSH Information Owner via the Service Desk at 717-531-6281.