Is Microsoft 365 HIPAA Compliant?

Home/Is Microsoft 365 HIPAA Compliant?

Short answer: Microsoft 365 can be used in a HIPAA compliant way, but it is not compliant on its own. Microsoft makes its HIPAA business associate agreement available by default through its Data Protection Addendum and covers services like Exchange Online, Teams, SharePoint and OneDrive. Your practice is still responsible for how it is configured and used.

Take the free risk assessment →Talk to an analyst

01

What Microsoft covers

Microsoft offers the HIPAA business associate agreement to covered entities and business associates through the Microsoft Online Services Data Protection Addendum. Microsoft lists in-scope services including Exchange Online, SharePoint Online, OneDrive for Business, Teams, Microsoft 365 apps, Defender for Office 365, Entra ID and Microsoft Copilot.

Microsoft is clear that using its services does not by itself make you HIPAA compliant.

02

What your practice still has to do

  • Turn on multi-factor authentication for every account.
  • Use encryption for email that leaves your organization with patient information.
  • Set retention, audit logging and data loss prevention where your license supports them.
  • Control sharing in OneDrive, SharePoint and Teams so files are not shared with "anyone with the link".
  • Include Microsoft 365 in your HIPAA risk analysis and train staff on correct use.

FAQ

Frequently asked questions

Do we need to sign a separate BAA with Microsoft?

Microsoft provides its HIPAA BAA by default through the Data Protection Addendum for in-scope online services. Keep a record of it with your other business associate agreements.

Is Teams HIPAA compliant?

Teams is an in-scope service under Microsoft's BAA. Whether your use is compliant depends on settings such as access controls, guest access and retention.

Can we use Microsoft Copilot with patient data?

Microsoft lists Microsoft 365 Copilot among in-scope services. Set clear policies on what staff may enter and review your configuration first.

Sources: Microsoft: HIPAA and HITECH offering. This page is general information as of November 2026, not legal advice.

Is your Microsoft 365 set up safely?

Our analysts review your tenant settings as part of a HIPAA risk assessment.

Take the free risk assessment →Talk to an analyst