Microsoft 365 HIPAA Compliance: The BAA and Setup for 2026

Last updated: October 20, 2026

Microsoft 365 can support HIPAA compliance on paid business plans. The surprise is the Business Associate Agreement (BAA). Microsoft builds it into the standard Product Terms for its paid cloud plans. There is no signing step. Run a paid business or enterprise plan? Then the Microsoft 365 HIPAA base is already in your contract. Google makes admins accept the BAA in its Admin console. Microsoft folds it into terms you have already agreed to. That trips up practices both ways. Some think they still need to sign. They do not. Others think consumer apps are covered. They never are. This guide maps the covered apps, the Copilot rules, and what the BAA leaves out. Then it shows the setup that makes the contract real.

TL;DR: Quick answer

• The Microsoft 365 HIPAA path starts with the BAA in the Data Protection Addendum (DPA), part of the Microsoft Product Terms. Paid business plans include it at purchase. The exceptions are Business Standard and Teams Essentials bought through Simplified Sign-up with an existing email. Those run under consumer terms. Microsoft tells regulated organizations to use a domain account on their own domain instead. Consumer accounts never include it.

• Covered core services: Exchange Online (Outlook), Microsoft Teams, OneDrive for Business, SharePoint Online, Microsoft Intune, Microsoft Entra ID, and Microsoft Purview.

• Microsoft's small business plans dropped the Office 365 name in April 2020, but enterprise plans such as Office 365 E5 still use it. Microsoft's HIPAA page lists core apps such as Exchange Online, Teams, and SharePoint Online under "Office 365".

• Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat are on the covered list. The web search queries Copilot sends to Bing are not covered.

• The contract is the floor. You still enforce MFA and restrict sharing. You still review audit logs and write a risk analysis (45 CFR § 164.308(a)(1)(ii)(A)).

• Free Outlook.com, personal OneDrive, and consumer Teams have no BAA path at any price.

• Checked against Microsoft's own pages on October 20, 2026. Terms change; check again before you rely on them.

The BAA is already in your contract

HIPAA requires a written BAA before a vendor creates, receives, maintains, or transmits ePHI for you (45 CFR § 164.308(b)). Microsoft meets this rule its own way. The BAA sits inside the Microsoft Products and Services Data Protection Addendum (DPA), which is part of the Product Terms. The DPA edition of May 22, 2026 addresses customers who are covered entities or business associates and put PHI in Microsoft's services. For them, executing the agreement "includes execution" of the HIPAA BAA. No request form. No extra fee. The DPA does let a customer opt out by written notice, so confirm nobody at your organization has. That makes the Microsoft 365 HIPAA BAA one of the easiest to hold. It is also one of the easiest to get wrong. The contract covers the listed services for groups that HIPAA covers. Microsoft's own FAQ says using its services "doesn't on its own achieve HIPAA compliance". And it never reaches consumer accounts. Google does it another way. There, an admin must review and accept the BAA in the Admin console (checked October 20, 2026). See Google Workspace HIPAA for Google's side.

Which Microsoft 365 apps are covered?

The pattern matters more than the list. Business versions are covered. Consumer versions never are. That pattern is the core of the Microsoft 365 HIPAA rules. Microsoft's HIPAA page, checked October 20, 2026, lists Exchange Online, Teams, OneDrive for Business, SharePoint Online, and Copilot under "Office 365". Microsoft still uses that name for the cloud service and for enterprise plans such as Office 365 E5. Microsoft Intune has its own entry on the same page. For a side-by-side of the email options, see best HIPAA compliant email.

The Copilot question

Copilot needs its own section. It works across the email, chats, and documents each user can already open. Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, and Copilot Chat moved with it. Both are on Microsoft's HIPAA list of covered services (checked October 20, 2026). Inside Word, Excel, Outlook, Teams, and the rest, prompts and responses stay under the DPA and the Product Terms. That keeps Copilot inside the Microsoft 365 HIPAA boundary. There is one sharp catch. Copilot can send search queries it writes to Bing. Microsoft says the DPA does not apply to those queries, and neither does HIPAA compliance. Admins can turn web search off with the "Allow web search in Copilot" policy in the Cloud Policy service for Microsoft 365. Turn it off for clinical users in any Microsoft 365 HIPAA tenant. Note the AI use in your risk analysis. Other AI tools and add-ins are a separate question, covered below.

What you still configure

The contract is the floor, not the finish. These settings turn Microsoft 365 HIPAA from paper into practice. Enforce MFA in Microsoft Entra ID. Conditional Access needs Microsoft Entra ID P1 licenses or Microsoft 365 Business Premium. Without them, turn on security defaults, which make every user register for MFA at no extra cost. Restrict sharing on OneDrive and SharePoint. An anyone-with-the-link file is a breach waiting for a click. Review Microsoft Purview audit logs on a schedule. Audit (Standard) keeps most records for 180 days by default (checked October 20, 2026). Keeping them longer inside Purview needs Audit (Premium) licensing, and 10 years needs an add-on. You can also export logs through the Office 365 Management Activity API to storage you control. HIPAA's audit controls standard (45 CFR 164.312(b)) sets no retention period for the logs themselves. Many organizations keep logs for six years to line up with the documentation rule; see HIPAA audit logs. Set retention on purpose.

Keep PHI out of any service that is not on the covered list. Defaults will not save you. The same rule runs through every suite and cloud we review. See AWS HIPAA eligible services for the cloud side. Your website and patient apps need the same discipline on their own servers, which is what HIPAA compliant cloud hosting provides under its own BAA.

The traps are the usual drift

A clinician syncs work files to a personal OneDrive. A front desk takes a quick patient call on a free Teams account. A Copilot prompt hits the open web with patient context in it. Each one slips outside the BAA. Often nobody notices. Policy closes the lanes. Covered accounts only. Sharing locked. Web search off for anyone who touches PHI. That is how a Microsoft 365 HIPAA policy stays real between audits. It is the same drift we cover in HIPAA compliant texting and personal video accounts.

What the Microsoft BAA does not cover

The Microsoft BAA covers the services on Microsoft's HIPAA list, and only those. Five gaps sit outside it, based on Microsoft's own terms as checked October 20, 2026. Each one can quietly break a Microsoft 365 HIPAA setup.

• Consumer accounts. Outlook.com, personal OneDrive, free Teams, and Copilot on a personal account run under the Microsoft Services Agreement, not the Product Terms. That consumer agreement even lists Business Basic and Business Standard "until a commercial domain is established". Microsoft's sign-up guide explains why: Business Standard bought through Simplified Sign-up runs under consumer terms until you attach a custom domain. That path signs you in with a personal email, or with a work email whose domain is not used for Microsoft 365 email. Teams Essentials bought with an existing email uses the same path, and Microsoft tells regulated organizations to sign up with a domain account instead. Set up your practice's own domain in the tenant before PHI goes in.

• Copilot web search queries. The queries Copilot sends to Bing fall outside the DPA and HIPAA compliance, by Microsoft's own account. Turn web search off for anyone who touches PHI.

• Preview features. The DPA says its HIPAA terms do not apply to Previews, unless a Preview allows personal data processing. Keep PHI out of preview features.

• Third-party add-ins and AI tools. The DPA says separate terms govern non-Microsoft products. Any add-in, connector, or AI tool that reads your tenant is its own vendor and needs its own BAA. Take n8n: its cloud service offers no BAA, so an n8n HIPAA compliant setup starts with self-hosting it on a BAA-covered server. Your own AI features that touch patient data need a BAA for the model service and one for the hosting around it.

• Your website and forms. The suite covers email, files, meetings, and chat. It does not cover the public side of your practice. The website, intake forms, and booking flow live elsewhere. So does the patient data they collect. That layer needs its own BAA and safeguards.

A Microsoft 365 HIPAA setup stops at the edge of the suite. What the website layer must include is set out in our guide to HIPAA hosting requirements. For the other systems a practice runs, see which practice systems need their own HIPAA host.

We host that website layer. Our HIPAA compliant hosting runs on single-tenant AWS. We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Managed plans start at $229 per month, billed monthly with no long-term contract. The first month includes 4 hours of migration and configuration; after that, it is $175 an hour, quoted before work starts. We sell that layer, so weigh it as a disclosure.

If your site already collects patient data, ask about our client-side compliance review. Tell us what your practice runs and you will get a straight answer. For the hosting side of the stack, HIPAA hosting cost shows current prices.

Frequently asked questions

Is Microsoft 365 HIPAA compliant?

It can be, on paid business plans. The BAA is built into the Product Terms through the Data Protection Addendum. The core services are covered. Add MFA, sharing limits, audit review, and a written risk analysis. Then your tenant is a real Microsoft 365 HIPAA setup.

Is Office 365 HIPAA compliant?

It can be, on the same terms. Microsoft's small business plans dropped the Office 365 name in April 2020, but enterprise plans such as Office 365 E5 still use it. Microsoft's HIPAA page lists Exchange Online, Teams, OneDrive for Business, and SharePoint Online under "Office 365". The BAA in the DPA covers them. The setup work is the same as any Microsoft 365 HIPAA tenant.

Does Microsoft sign a BAA?

Yes, but you do not sign it separately. Microsoft offers its HIPAA BAA by default to customers who are covered entities or business associates. It comes through the Product Terms and the Data Protection Addendum, which business customers accept at purchase. The full BAA text is on Microsoft's Service Trust Portal. Download a copy and keep it with your Microsoft 365 HIPAA records.

Is Microsoft Teams HIPAA compliant?

Business and enterprise Teams sits under the same BAA. It can carry patient calls and chat. The exception is Teams Essentials bought with an existing email, such as Gmail, Yahoo, or Hotmail, which runs under consumer terms instead of the DPA. First set your tenant up for Microsoft 365 HIPAA use. Free and consumer Teams accounts are never covered. They have no BAA path.

Is OneDrive HIPAA compliant?

OneDrive for Business is covered. Lock down sharing, enforce MFA, and keep audit logging on. A personal OneDrive is never covered. Syncing work files to one moves PHI outside the BAA.

Is Microsoft Copilot HIPAA compliant?

Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat are on Microsoft's HIPAA list for business tenants. The web search queries Copilot sends to Bing are not covered. Block web search for staff who touch PHI. Note the AI use in your risk analysis.

Recap: Microsoft 365 HIPAA compliance

To recap, Microsoft 365 HIPAA starts with the contract you already have. Paid business plans carry the BAA in the Product Terms. The core apps are covered: Outlook, Teams, OneDrive for Business, SharePoint. Microsoft Copilot rides the same BAA, minus web search queries. Consumer accounts and third-party add-ins sit outside it. Then do your side: MFA, sharing limits, audit review, retention, and a written risk analysis. The suite covers the office. Your website still needs its own covered home.

This article is general information, not legal advice. Microsoft's Product Terms, Data Protection Addendum, covered lists, and Copilot rules are as checked on October 20, 2026. They may change. Confirm current terms with Microsoft. Consult qualified counsel. Base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed October 2026.

Sources

• Microsoft: HIPAA and the HITECH Act compliance offering (in-scope services, checked October 20, 2026)

• Microsoft: Product Terms

• Microsoft: Products and Services Data Protection Addendum (May 22, 2026 edition, incl. the HIPAA Business Associate section)

• Microsoft Learn: Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat

• Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot

• Microsoft Learn: Manage audit log retention policies (Microsoft Purview)

• Microsoft Learn: Learn about auditing solutions in Microsoft Purview (180-day default and the Office 365 Management Activity API)

• Microsoft Learn: Security defaults and Conditional Access (Microsoft Entra ID)

• Microsoft: Microsoft Services Agreement (consumer terms, effective September 30, 2026)

• Microsoft Learn: Sign up for Microsoft 365 Business Standard (Simplified Sign-up versus a custom business domain)

• Microsoft Learn: Sign up for Microsoft Teams business subscription (Teams Essentials versus Business Basic)

• Microsoft 365 Blog: New Microsoft 365 offerings for small and medium-sized businesses (Office 365 plan renames, March 30, 2020)

• Google Workspace Help: HIPAA compliance with Google Workspace and Cloud Identity

• HIPAA Journal: How to Make Microsoft Office 365 HIPAA Compliant (2026 Update)

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov

• 45 CFR § 164.312 (technical safeguards): ecfr.gov

• 45 CFR § 164.316 (six-year documentation rule): law.cornell.edu