M+Box Core Apps

Description of Service: 

M+Box is a cloud-based storage solution that allows you to share files with people inside and outside of the university. There are many apps that can be used within M+Box. U-M users can use any of those apps, but only the M+Box Core Apps (Official Box Apps) have been tested and approved by U-M.

Description of Compliance: 

M+Box is a contracted-for service obtained through a partnership with a consortium of higher education institutions. The agreement includes non-disclosure agreements (NDA) and security provisions. M+Box Core Apps (Official Box Apps) provide a secure environment in which to maintain or share the university's sensitive unregulated data, as well as some kinds of sensitive regulated data. See Using M+Box Securely with Sensitive Data for minimum requirements when using M+Box for sensitive university data.

Social Security numbers should only be used where required by law or where they are essential for university business processes. If you must use SSNs, it is preferred that you use institutional resources designed to house this data, such as the Data Warehouse. IIA can help you explore appropriate storage locations or work with you to appropriately encrypt the data if those alternatives will not work for you. (Contact IIA via the ITS Service Center.)

U-M's agreement with Box for M+Box Core Apps includes a Business Associate Agreement. This means individuals may use this service to maintain Protected Health Information (PHI) regulated by HIPAA. Complying with HIPAA's requirements is a shared responsibility. Users sharing and storing PHI in M+Box are responsible for complying with HIPAA safeguards, including:

  • Using and disclosing only the minimum necessary PHI for the intended purpose.
  • Obtaining all required authorizations for using and disclosing PHI.
  • Ensuring that PHI is seen only by those who are authorized to see it.
  • Obtaining all necessary data-sharing agreements and Business Associate Agreements for using and disclosing PHI.
  • Following any additional steps required by your unit to comply with HIPAA.

M+Box may not be used for Export Controlled Research because Box cannot ensure that only U.S. persons have access to or maintain their systems.

Within M+Box, you have the option to create Google Docs and Spreadsheets and files using online Microsoft Office programs, including Word, Excel, and PowerPoint. When you do this, you are using services outside of M+Box and need to be aware of any sensitive data restrictions for those services. When you use online Office programs, you are using a personal account. Personal accounts may not be used to store or maintain sensitive university data. M+Google Drive may not be used for Protected Health Information (regulated by HIPAA).