A BAA is available for Microsoft Copilot and Copilot Chat when used with a work account on Microsoft 365 commercial and GCC subscriptions. Web search queries and consumer Copilot with a personal account are outside it.
Is Microsoft Copilot HIPAA compliant? BAA by plan, covered services and exclusions
Conditional BAA available for Copilot and Copilot Chat with a work account on Microsoft 365 commercial and GCC subscriptions; the main exclusion is web search queries sent to Bing, plus consumer Copilot. Verified 2026-10-19. Compare other tools in Is it HIPAA compliant? All vendors.
Short answer: a BAA is available on Microsoft 365 commercial and GCC plans for work-account Copilot and Copilot Chat. Copilot with a personal Microsoft account, including Copilot Pro, has no BAA. Web search queries are not covered even in a work account.
For work-account use, the BAA is included by default in the Online Services Data Protection Addendum (DPA) and Product Terms. It is not a separate document to negotiate.
Which plans include a BAA
Copilot sits on top of an underlying subscription; see Is Microsoft 365 HIPAA compliant? for that layer.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Copilot Business add-on (up to 300 users) | Yes | Included via the DPA and Product Terms | $18.00/user/month paid yearly (promotional; list $21.00), on top of an eligible subscription |
| Business Standard with Copilot | Yes | Included via the DPA and Product Terms | Not published by the vendor |
| Business Premium with Copilot | Yes | Included via the DPA and Product Terms | Not published by the vendor |
| Microsoft 365 Copilot (enterprise add-on) | Yes | Included via the DPA and Product Terms | Not published by the vendor |
| Copilot Chat with business/enterprise subscriptions | Yes | Included via the DPA and Product Terms | Included with business subscriptions |
| Office 365 U.S. Government (GCC) | Yes | Included via the DPA and Product Terms | Not published by the vendor |
| Copilot with a personal Microsoft account (Microsoft 365 Personal/Family, free Copilot app) | No | Consumer service, outside the DPA | Not applicable |
| Copilot Pro (consumer) | No | Consumer service, outside the DPA | Not applicable |
What the BAA covers and what it excludes
Covered, with a work account:
- Copilot in Word, Excel, PowerPoint, Outlook, OneNote and Teams.
- Copilot Chat with enterprise data protection.
- Prompts, responses and Microsoft Graph data, stored under the same commitments as Exchange email and SharePoint files. For the storage layers, see the Outlook HIPAA status and SharePoint HIPAA status.
- Microsoft Copilot for Security.
Excluded:
- Web search queries sent to Bing. Microsoft states that HIPAA compliance doesn't apply to web search queries. These are not covered by the DPA and BAA.
- Third-party agents and Graph connectors, which run under their own terms.
- Consumer Copilot with a personal account.
A front-desk coordinator who asks Copilot Chat to summarize a patient scheduling thread stays inside the work-account commitments. If web search is on and the prompt triggers a Bing query containing that patient's details, that query falls outside the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Covered by Microsoft 365 data residency commitments in the Product Terms since March 1, 2024; EU Data Boundary service for EU customers (Anthropic models excluded) |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Yes |
Microsoft names specific encryption methods (BitLocker, per-file encryption, TLS, IPsec). They are reported only as quoted in Sources.
How to use Microsoft Copilot with PHI
The customer carries these responsibilities:
- Sign or confirm the BAA and DPA terms before any PHI enters Copilot.
- Use work accounts only, and block personal-account Copilot on clinic devices.
- Turn off or restrict web search so queries containing PHI are not sent to Bing.
- Review third-party agents and Graph connectors; each needs its own terms.
- Configure access controls and review audit logs.
- Train staff and set written policies on what may be entered into prompts.
Compliance depends on the signed BAA, configuration and the organization's policies, not on the product alone.
Alternatives with a BAA
Neutral list of other AI options with a published BAA; the order implies no ranking. See HIPAA-compliant AI tools for the full category.
- Amazon Bedrock: yes, all AWS accounts. Is AWS Bedrock HIPAA compliant?
- Microsoft Azure: conditional, all Azure customers under a volume licensing or online subscription agreement.
- OpenAI ChatGPT and API: conditional, ChatGPT for Healthcare.
- Anthropic Claude: conditional, Claude Enterprise. Is Claude AI HIPAA compliant?
- Doximity GPT: yes, Member free.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Office 365 in-scope services) — Trust center, checked 2026-10-19. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams, MyAnalytics"
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance — Trust center, checked 2026-10-19. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat — Help article, checked 2026-10-19. "Microsoft Copilot and Microsoft Copilot Chat support HIPAA compliance for properly configured implementations. HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)."
- Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (What is enterprise data protection) — Help article, checked 2026-10-19. "The use of Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor."
- Data, Privacy, and Security for Microsoft Copilot — Help article, checked 2026-10-19. "Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems."
- Data, Privacy, and Security for Microsoft Copilot (How does Microsoft Copilot protect organizational data) — Help article, checked 2026-10-19. "Microsoft 365 uses service-side technologies that encrypt customer content at rest and in transit, including BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec)."
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Third-party certifications) — Trust center, checked 2026-10-19. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
- Microsoft Copilot Plans and Pricing—AI for Business | Microsoft 365 — Pricing page, checked 2026-10-19. "Microsoft 365 Copilot Business (add-on) AI built for work to help drive productivity, clarity and impact across your existing Microsoft 365 experience Originally starting from $21.00 now starting from $18.00 $21.00 $18.00 user/month, paid yearly (Annual subscription—auto renews)2"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status and the vendor index.
FAQ
Is Microsoft Copilot HIPAA compliant?
Conditional. A BAA is available for Copilot and Copilot Chat with a work account on Microsoft 365 commercial and GCC subscriptions. Web search queries and consumer Copilot are outside it.
Is the free or personal Microsoft Copilot covered by a BAA?
No. Copilot with a personal Microsoft account (Microsoft 365 Personal/Family, the free Copilot app) and Copilot Pro are consumer services outside the DPA.
Are Copilot web search queries covered by the BAA?
No. Microsoft states that HIPAA compliance doesn't apply to web search queries, and Bing queries are not covered by the DPA and BAA.
How do I get a BAA for Microsoft 365 Copilot?
For work-account use, the BAA is included by default in the Online Services DPA and Product Terms. It applies to eligible commercial and GCC subscriptions with Copilot or Copilot Chat.