If you work in healthcare, you've probably used an online PDF tool to merge lab results, compress radiology reports, or convert discharge summaries. But did that tool upload your files to a server? If so, you may have just violated HIPAA.

Private File Apps

Process medical documents locally in your browser. Private & secure:

View Private File Apps →

The Problem: Most PDF Tools Violate HIPAA

HIPAA's Security Rule requires covered entities and business associates to implement safeguards for Protected Health Information (PHI). When you use a traditional online PDF tool — iLovePDF, SmallPDF, Adobe Acrobat Online — your files are uploaded to their servers for processing.

That upload creates three HIPAA problems:

1
PHI leaves your control
The moment a file containing patient names, diagnoses, or SSNs hits a third-party server, you've disclosed PHI to that vendor.
2
You need a BAA
Any vendor that handles PHI must sign a Business Associate Agreement. Most free PDF tools don't offer BAAs — and if they do, they're on paid tiers ($7-20/month).
3
Breach liability
If that vendor gets breached, your organization is liable for notification and penalties — even though you used their tool, not your own server.

What to Look for in a Private PDF Tool

The most privacy-preserving approach is to keep files off vendor servers entirely. A private PDF tool should:

Requirement	Why It Matters
No file upload	If files stay on your device, PHI can't be disclosed to a third party
No account required	No credentials = no credential breach vector. No user data stored.
No server processing	Processing happens in-browser in your browser — no server to compromise
Works offline	Air-gapped environments in hospitals can still use the tool
Verifiable architecture	Open browser DevTools → Network tab → confirm zero file transfers

Comparison: Privacy Posture by Tool

Tool	Uploads Files?	Account Required?	Cost
MiOffice	No (local tools)	No	Free
iLovePDF	Yes	Limited	$7/mo
SmallPDF	Yes	Yes	$12/mo
Adobe Acrobat	Yes (cloud)	Yes	$20+/mo

Common Healthcare PDF Workflows

Merging patient intake forms

Combine multiple intake pages, insurance cards, and consent forms into one PDF for the chart. Use Merge PDF.

Compressing radiology PDFs for email

Radiology reports with embedded images can be 50MB+. Compress to under 10MB for secure email. Use Compress PDF.

Converting discharge summaries

Convert Word discharge summaries to PDF before adding to the EHR. Use Word to PDF.

Password-protecting records

Encrypt patient records before emailing to referring physicians. Use Protect PDF.

How to Verify a Tool Is Actually Safe

Don't take anyone's word for it — including ours. Here's how to verify:

Open the PDF tool in your browser
Press F12 to open Developer Tools
Click the Network tab
Process a file (merge, compress, convert)
Check: were any files sent to a server? With MiOffice, the answer is zero outbound file transfers

Bottom Line

If your PDF tool uploads files to its servers, your sensitive documents leave your control. The simplest pattern is to use a tool that never uploads files in the first place. For local-only workflows, MiOffice processes files in your browser — your data stays on your device. Always confirm with your compliance officer that any specific workflow meets your organization's requirements.

How to Choose a HIPAA-Compliant PDF Converter in 2026

Start Processing Now

Private File Apps

The Problem: Most PDF Tools Violate HIPAA

PHI leaves your control

You need a BAA

Breach liability