Microsoft 365 HIPAA Compliance: The BAA, Copilot and Required Settings

Microsoft 365 HIPAA compliance starts with that BAA. Microsoft’s Data Protection Addendum says that when a covered entity or business associate puts PHI in the service, executing its customer agreement includes executing Microsoft’s HIPAA BAA. Configuring the tenant is your job.

We checked Microsoft’s pages in September 2026 and rechecked the BAA terms, the in-scope service list, the November 2026 Data Protection Addendum, Copilot’s data protection terms and HHS’s guidance on November 7, 2026. This is general information, not legal advice. Our Microsoft 365 security hardening service covers tenant security for any business; this post maps those controls to HIPAA.

Does Microsoft sign a BAA?

Yes, and there is nothing separate to sign. Microsoft’s HIPAA and HITECH page says its BAA is available through the Data Protection Addendum “by default to all customers who are covered entities or business associates under HIPAA.” The Data Protection Addendum, in its November 2026 version, says executing the customer’s agreement includes executing the BAA, points to the full text at aka.ms/BAA, and lets a customer opt out by written notice. Microsoft adds that it cannot use a customer’s own BAA, because its services are standardized.

The full BAA sits on Microsoft’s Service Trust Portal, which did not display the document to our reader, so this summary comes from the addendum and Microsoft’s HIPAA page. Microsoft is direct about the limit: asked whether its BAA ensures HIPAA compliance, its answer is no, and your organization stays responsible for its compliance program.

What does HHS say about cloud services like Microsoft 365?

HHS’s guidance on HIPAA and cloud computing treats a cloud provider that stores ePHI as a business associate, even one that holds only encrypted data without the key, so a BAA has to be in place first. It also says encryption alone cannot meet the Security Rule’s demands for confidentiality, integrity and availability, and that some safeguards, such as unique user identification and authentication, can fall to the customer while the provider handles others. That is the split with Microsoft 365: Microsoft runs the service under its BAA, and the tenant’s sign-ins, sharing, devices and backups are yours.

Is the HIPAA Security Rule changing?

Not yet. In January 2025 HHS proposed rewriting the Security Rule (90 FR 898), including making encryption and multifactor authentication required rather than addressable, with limited exceptions. As of November 7, 2026 the Federal Register lists only the proposed rule, and the government’s Unified Agenda shows final action as a long-term item for July 2027. The current rule applies until then. Setting up Microsoft 365 to the stricter reading now avoids a second project later, and our post on proposed HIPAA Security Rule changes tracks the rule.

Which Microsoft 365 services are in scope?

For commercial tenants, Microsoft’s in-scope list includes Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Forms, Planner, Stream, Office Online and Office Pro Plus, Microsoft Entra ID, Defender for Office 365, the Microsoft Purview portal, Power Apps, Power BI, and Microsoft Copilot and Copilot Chat. Microsoft Intune and Windows 365 appear on its list of in-scope cloud services as well.

Some things sit outside it. Copilot’s web search queries go to Bing under separate terms and are not covered by the addendum or the BAA. Models Microsoft labels Anthropic models with Data Retention fall under Anthropic’s terms, not Microsoft’s, and stay off until an administrator opts in. Third-party apps and agents follow their own terms, and a personal Outlook.com or OneDrive account is not on the list.

Is Copilot HIPAA compliant?

Microsoft says Microsoft Copilot and Copilot Chat, formerly Microsoft 365 Copilot, support HIPAA compliance for properly configured implementations, and that web search queries are not covered by the Data Protection Addendum or the BAA (see Microsoft’s enterprise data protection notes, checked on November 7, 2026). The configuration that matters most is permissions. Copilot respects each user’s identity and access, inherits sensitivity labels and applies retention policies, so a SharePoint site shared too widely becomes one Copilot will summarize for everyone it is shared with. Fix SharePoint oversharing before Copilot, decide whether web search stays on for staff who handle PHI, and confirm Anthropic models with Data Retention are still off. How Copilot compares with ChatGPT and Claude is in our AI tools BAA comparison.

Which Microsoft 365 settings does HIPAA require?

HIPAA names safeguards, not settings. This is how the technical safeguards in 45 CFR 164.312 map to the Microsoft 365 controls we use:

Two administrative requirements complete the picture: regular review of audit logs and access reports (164.308(a)(1)(ii)(D)) and a data backup plan with retrievable exact copies of ePHI (164.308(a)(7)(ii)(A)). Retention policies preserve data for compliance, but they are not a restore plan, so we pair tenants with independent Microsoft 365 backup.

Which Microsoft 365 plan or version is HIPAA compliant?

No Microsoft 365 version is HIPAA compliant by itself; Microsoft’s HIPAA page notes that HHS approves no certification standard for demonstrating HIPAA compliance. The plan decides which controls you can turn on, and most of the table above assumes Microsoft 365 Business Premium or an E3 or E5 plan. Microsoft says Business Premium includes Entra ID P1, full Intune and Defender for Business for organizations of up to 300 users, and its message encryption FAQ lists Business Premium, E3 and E5 among the plans with Purview Message Encryption. Business Basic and Business Standard can add Azure Information Protection Plan 1 for encryption, but Conditional Access needs at least Entra ID P1. Our HIPAA email guide covers the encryption rules in detail, and our Business Basic vs Standard comparison covers how the lower plans differ.

What should you do before PHI goes into Microsoft 365?

Use this order for a practice moving patient data into a tenant, or checking one that already holds it:

1. Record the BAA. Save a dated copy of the Data Protection Addendum and list Microsoft’s BAA in your vendor register.
2. Confirm the plan. Put the people who handle PHI on Business Premium, E3 or E5, or add what the lower plans lack.
3. Turn on multifactor authentication for everyone, through security defaults or Conditional Access.
4. Enroll devices in Intune with BitLocker, screen locks and the ability to wipe a lost laptop.
5. Set encryption rules for outside email that contains patient identifiers.
6. Clean up sharing in SharePoint, OneDrive and Teams before anyone turns on Copilot.
7. Check audit logging and retention, and decide who reviews the logs and how often.
8. Back up the tenant with an independent backup and test a restore.
9. Update the risk analysis with each service, setting and gap you found.

Where NetSys fits

Our own stack runs on these tools: Intune and Windows Autopilot for devices, Microsoft Defender for Business, and Microsoft 365 administration, with 24/7 monitoring and support for managed clients. Through our HIPAA compliance work for practices we set these controls, export the evidence and track Microsoft’s BAA in your vendor register. A HIPAA compliance audit shows how far your tenant is from the table above, and our healthcare practice IT page covers the rest of the clinic. For how BAAs work with every other vendor, see our IT provider BAA guide.

Frequently asked questions

Is Microsoft HIPAA compliant?

No vendor is HIPAA compliant on its own, and Microsoft says so: its HIPAA page notes that HHS approves no certification standard for demonstrating compliance, and that having Microsoft’s BAA does not on its own achieve it. What Microsoft provides is a BAA covering in-scope services, available by default through its Data Protection Addendum, and the controls to configure them. Your practice remains responsible for the compliance program and the settings.

Is Microsoft 365 Business Premium HIPAA compliant?

Business Premium can support HIPAA compliance. Its core services are on Microsoft’s in-scope list under the BAA, and it includes the controls the Security Rule calls for: Entra ID P1 for Conditional Access, Intune for device encryption and screen locks, Defender for Business, and Purview Message Encryption for outside email. Those controls still have to be configured and documented in your risk analysis.

Is Office 365 HIPAA compliant?

Office 365 can support HIPAA compliance the same way Microsoft 365 does. Microsoft lists Office 365 among the cloud services covered by its HIPAA BAA, with Exchange Online, SharePoint Online, OneDrive for Business and Teams in scope for commercial tenants. The BAA covers the services; configuring them to meet the Security Rule is still up to you.

Is Microsoft Teams HIPAA compliant?

Teams is on Microsoft’s list of in-scope services, so chats, meetings and files in Teams fall under the BAA when PHI is involved. Compliance still depends on your settings: who can join as a guest, who can record meetings, where recordings and shared files are stored, and how long they are kept.

Do we have to sign anything to get Microsoft’s BAA?

No. Microsoft’s Data Protection Addendum says that for covered entities and business associates that put PHI in their data, executing the customer agreement includes executing the HIPAA BAA. Keep a dated copy of the addendum and the BAA with your HIPAA records, and note that Microsoft allows opting out by written notice.

How long does Microsoft 365 keep audit logs?

Purview Audit (Standard) keeps records for 180 days. Audit (Premium) keeps Entra ID, Exchange, OneDrive and SharePoint records for one year by default, with ten-year retention as a per-user add-on. The Security Rule’s audit controls standard sets no retention period, and its six-year rule covers required documentation, so decide log retention in your risk analysis.

Sources (checked September to November 2026)

• Microsoft HIPAA and HITECH Act offering, Microsoft Learn, including the in-scope service list and the note on certification, checked on November 7, 2026.
• Microsoft Products and Services Data Protection Addendum, November 2026 version, HIPAA Business Associate section, checked on November 7, 2026.
• Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, Microsoft Learn, checked on November 7, 2026.
• Claude models from Anthropic in Microsoft Online Services, Microsoft Learn, checked on November 7, 2026.
• Learn about auditing solutions in Microsoft Purview, Microsoft Learn, checked on November 7, 2026.
• Microsoft 365 Business Premium security FAQ, Microsoft Learn, checked on November 7, 2026.
• Message Encryption FAQ, Microsoft Learn, checked on November 7, 2026.
• Security defaults in Microsoft Entra ID, Microsoft Learn, checked September 2026.
• HHS guidance on HIPAA and cloud computing, checked on November 7, 2026.
• HIPAA Security Rule proposed rule, 90 FR 898, and the Unified Agenda entry for RIN 0945-AA22, checked on November 7, 2026.
• 45 CFR 164.312 and 45 CFR 164.308, HIPAA Security Rule safeguards on the eCFR, checked September 2026.