Microsoft makes a HIPAA BAA available to Azure customers under their licensing agreement, but it covers only the services in the HIPAA BAA audit scope. Azure services outside that scope, and your own applications, are not covered.
Published by Chanty, Inc., which owns this directory. Chanty has no relationship with Microsoft or Azure.
Is Azure HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available to all Azure customers under a volume licensing or online subscription agreement (there are no plan tiers), but only for in-scope services. Services not listed in the HIPAA BAA audit scope are excluded, and Microsoft does not inspect or approve customer applications.
Verdict date: 2026-10-19.
Short answer
- The BAA is available by default through the Microsoft Product Terms and the Data Protection Addendum. There is no separate signature.
- Only services listed in Appendices A and B of Microsoft Azure Compliance Offerings, in the HIPAA BAA column, are covered.
- The public HIPAA pages do not state whether Azure OpenAI is covered. Confirm it in the appendix before any PHI touches it.
- On this site the wording is "BAA available for services Y," never "HIPAA certified."
For other vendors, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All Azure customers under a volume licensing or online subscription agreement | Yes | By executing the licensing agreement that incorporates the Product Terms and the Data Protection Addendum. The BAA text is on the Service Trust Portal (aka.ms/baa). | Not published by the vendor |
No excluded plans are listed. Minimum seats are not published.
What the BAA covers and what it excludes
Covered
- Azure and Azure Government in-scope services
- Azure DevOps Services
- Dynamics 365
- Office 365 (it has a separate service-level answer: Is Office 365 HIPAA compliant?)
- Power Platform cloud services
- Microsoft Intune
- Windows 365
Excluded
- Azure services not in the HIPAA BAA audit scope. A clinic that stores imaging files in a service missing from the HIPAA BAA column has no BAA coverage for that data, even though the same subscription covers other services.
- Customer applications deployed on Azure. Microsoft does not inspect or approve them.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Yes |
Per Microsoft's pages, Azure and Azure Government are ISO/IEC 27001 certified and have held HITRUST CSF certification since Nov-2016.
How to use Azure with PHI
Microsoft states that customers are wholly responsible for their own compliance with applicable laws. Compliance depends on the signed BAA, your configuration and your policies, not on Azure alone. For BAA and shared-responsibility terms, see the HIPAA glossary.
- Confirm the licensing agreement that incorporates the Product Terms and Data Protection Addendum is in place.
- Check every service you use against the HIPAA BAA column in Appendices A and B.
- Keep PHI off services that are not in that column.
- Configure access controls and logging yourself.
- Secure your own applications, since Microsoft does not inspect or approve them.
- Record each service and its BAA status in your vendor inventory.
- Train staff and set policies on where PHI may be stored.
Alternatives with a BAA
This is a neutral list of vendors with a BAA. It implies no ranking.
- Amazon Web Services: conditional. A BAA is available to all AWS accounts, with no plan tiers.
- Amazon Bedrock: yes. A BAA is available to all AWS accounts.
- Anthropic Claude: conditional. Applies to Claude Enterprise with HIPAA enabled by the Primary Owner.
- Atlantic.Net: conditional. Applies to the HIPAA Developer plan.
- OpenAI ChatGPT and API: conditional. Applies to ChatGPT for Healthcare.
Category pages: HIPAA-compliant hosting and HIPAA-compliant AI tools. Databases and software development categories are also covered in the directory.
Sources
- HIPAA – Azure Compliance | Microsoft Learn — BAA page, checked 2026-10-19. "There is no separate contract to sign to enter into a HIPAA Business Associate Agreement (BAA) with Microsoft because the HIPAA BAA is available via the Microsoft Product Terms (formerly Online Services Terms) by default to all customers who are covered entities or business associates under HIPAA."
- HIPAA – Azure Compliance | Microsoft Learn — BAA page, checked 2026-10-19. "The Microsoft Product Terms references the Microsoft Products and Services Data Protection Addendum (DPA), which states that "execution of customer's volume licensing agreement includes execution of the HIPAA Business Associate Agreement"."
- HIPAA – Azure Compliance | Microsoft Learn — BAA page, checked 2026-10-19. "Microsoft doesn't inspect, approve, or monitor your applications deployed on Azure. You're wholly responsible for ensuring your own compliance with all applicable laws and regulations."
- HIPAA – Azure Compliance | Microsoft Learn — BAA page, checked 2026-10-19. "Both Azure and Azure Government align with the NIST CSF and are certified under ISO/IEC 27001."
- HIPAA & HITECH Act – Microsoft Compliance | Microsoft Learn — Trust center, checked 2026-10-19. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- HIPAA & HITECH Act – Microsoft Compliance | Microsoft Learn — Trust center, checked 2026-10-19. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
- Azure and other Microsoft cloud services in compliance audit scope | Microsoft Learn — Trust center, checked 2026-10-19. "See Appendices A and B in Microsoft Azure Compliance Offerings for detailed insight into which cloud services are in scope for the following compliance offerings: CSA STAR, ISO/IEC, SOC, GSMA, HIPAA BAA, HITRUST"
- HITRUST – Azure Compliance | Microsoft Learn — Trust center, checked 2026-10-19. "Microsoft Azure is one of the first hyper-scale cloud services platforms to receive a formal certification for the HITRUST CSF in Nov-2016. Azure has maintained the HITRUST CSF certification since then."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does Microsoft sign a HIPAA BAA for Azure?
A BAA is available to Azure customers by default. It is incorporated through the Microsoft Product Terms and the Data Protection Addendum, and the BAA text is on the Service Trust Portal (aka.ms/baa). It applies to in-scope services only.
Do I need a separate contract or plan to get the Azure BAA?
No separate signature is needed. The BAA is available to all Azure customers under a volume licensing or online subscription agreement, with no plan tiers. Extra cost and minimum seats are not published by the vendor.
Which Azure services are covered by the BAA?
Services listed in the HIPAA BAA column of Appendices A and B of Microsoft Azure Compliance Offerings. The BAA also extends to Azure DevOps Services, Dynamics 365, Office 365, Power Platform cloud services, Microsoft Intune and Windows 365. Azure OpenAI is not stated on the public HIPAA pages, so check the appendix before use.
Does the BAA make applications I run on Azure HIPAA compliant?
No. Microsoft does not inspect or approve customer applications. You remain responsible for configuring access and logging, securing your application, and setting staff policies.