Encrypted Google Drive alternative for healthcare teams

Patient data is other people's risk When a clinic or a practice loses control of a document, the harm lands on patients who never chose the vendor. That asymmetry is why "the provider promises not to look" is a weaker answer in healthcare than anywhere else.

What to require from a drive holding patient data - **Client-side encryption.** Content sealed on the device before upload, with keys derived locally. - **Per-member access with real revocation.** When a locum, student or contractor leaves, keys rotate. - **Short-lived external sharing.** Referrals and reports shared through passphrase-gated links with enforced expiry, never a permanent URL in an email thread. - **Metadata-only audit trail.** Immutable records of access events, without exposing content. - **Independent encrypted backups.** Restorable copies held separately from the primary provider. - **Strong authentication.** Hardware-backed passkeys or TOTP, not SMS alone.

What zero-knowledge does and does not do for compliance It removes the provider from the set of parties able to read patient content, which materially simplifies vendor risk assessment and data processing analysis. It does not by itself make you compliant: you still need lawful basis, retention rules, patient rights processes, staff training, endpoint security and documented procedures. Any vendor that claims a product alone makes you compliant is selling the wrong thing.

Practical structure for a practice - One team folder per department or care pathway, keys sealed to the members who need it. - Referral and report sharing through 24-hour passphrase-gated links, passphrase communicated separately. - Devices enrolled, disk-encrypted, and locked with hardware-backed keys. - Recovery kits stored under the same physical controls as other sensitive practice records. - Quarterly review of who holds which folder keys.

Where DRIVUNO fits Files encrypted on the device with XChaCha20-Poly1305 under Argon2id-derived keys; Team Drive folder keys sealed per member with X25519 and rotated on removal; blind-index search that never exposes names to a server in plaintext; passphrase-gated links with a hard 24-hour maximum lifetime; hardware-backed passkeys and TOTP; a metadata-only immutable audit trail; and hourly encrypted snapshots to independent immutable storage with tested restore.

The conversation with your DPO Bring three facts: the provider cannot read content, access is per-member and revocation is cryptographic, and backups are encrypted and independently restorable. Those three change the shape of a risk assessment more than any certificate on a marketing page.