A BAA is available for Microsoft Forms on Office 365 / Microsoft 365 commercial and GCC subscriptions, and personal Microsoft accounts are outside it. Whether a given intake form is acceptable depends on your tenant type, the signed terms and how you configure and use Forms.
Conditional Verified 2026-10-20: BAA available on Office 365 / Microsoft 365 commercial and GCC subscriptions for Forms; the main exclusion is consumer (personal) Microsoft accounts.
Short answer
Microsoft includes a BAA by default through the Microsoft Online Services Data Protection Addendum (DPA) for customers that are covered entities or business associates. Forms is listed as an in-scope service for Commercial and GCC.
Consumer and non-enterprise accounts are not covered. A BAA alone does not make a form workflow compliant: you still decide who can build forms, what they ask and who sees the responses. For terms such as BAA, PHI and covered entity, see the HIPAA glossary (BAA, PHI, covered entity). For other tools, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Office 365 / Microsoft 365 commercial subscriptions | Available | Included by default via the Online Services DPA for covered entities and business associates | None stated |
| Office 365 GCC | Available | Included by default via the Online Services DPA for covered entities and business associates | None stated |
| Consumer (personal) Microsoft accounts | Not covered | Not published by the vendor | Not published by the vendor |
Minimum seats and pricing for the BAA: Not published by the vendor. For the wider suite, see Microsoft 365 HIPAA status.
What the BAA covers and what it excludes
Covered services listed by Microsoft:
- Forms (Office 365 Commercial)
- Forms (Office 365 GCC)
Excluded: the vendor lists no excluded Forms features on the page checked. Consumer (personal) Microsoft accounts are outside the BAA.
This page does not extend coverage to any other Microsoft service. Check each one separately.
Security controls the vendor publishes
These are Microsoft's own statements, not an audit by this wiki. The wiki reports published vendor terms only.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Most Office 365 services enable customers to specify the region where their customer data is located |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Yes |
Microsoft states that services covered under the BAA are audited for ISO/IEC 27001 and HITRUST CSF. On data residency, Microsoft states that most Office 365 services let customers specify the region of customer data. The sources checked do not state the region options for Forms specifically.
"Not published by the vendor" means the sources checked on 2026-10-20 do not state it. It does not mean the control is absent.
How to use Microsoft Forms with PHI
Compliance depends on the signed BAA, your configuration and your policies. Work through this checklist before a form goes live:
- Confirm the account type. The tenant must be an Office 365 / Microsoft 365 commercial or GCC subscription. A front-desk staffer building a registration form under a personal Microsoft account puts PHI outside the BAA.
- Confirm the BAA applies to you. Check that the Online Services DPA terms apply to your organization as a covered entity or business associate.
- Restrict who can create and view forms and responses. A new-patient intake form should not be editable or readable by every employee in the tenant.
- Collect the minimum necessary. A post-visit satisfaction survey rarely needs a diagnosis, date of birth or full name.
- Set staff policies and training. Staff should know which forms may collect PHI, where responses may be exported and which channels they may not be shared in.
- Manage user access and offboarding. Remove departed staff, and review who still owns forms and receives responses.
For templates and walkthroughs, see the HIPAA guides.
Alternatives with a BAA
Verdicts follow the same sourced, dated format as this page. The order is not a ranking.
- Formstack: conditional; Forms HIPAA add-on.
- Google Forms: conditional; Google Workspace paid editions.
- Hushmail for Healthcare: conditional; Healthcare Basic plan.
- Jotform: conditional; Gold plan.
- Qualtrics: conditional; plan not published.
Browse the forms category and others under HIPAA-compliant software by category.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-20. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-20. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID"
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-20. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Microsoft sign a BAA for Microsoft Forms?
Microsoft makes a BAA available by default through the Microsoft Online Services Data Protection Addendum for customers that are covered entities or business associates. Forms is listed as an in-scope service on Microsoft's HIPAA and HITECH compliance page, checked 2026-10-20.
Can I use Microsoft Forms with a personal Microsoft account for patient information?
No. Consumer (personal) Microsoft accounts are not covered by the BAA. Use an Office 365 / Microsoft 365 commercial or GCC subscription instead.
Is there an extra charge for the Microsoft BAA?
None is stated in the sources checked. The BAA is included by default through the DPA. Minimum seats and BAA pricing are not published by the vendor.
Is Microsoft Forms covered in Office 365 GCC as well as commercial?
Yes. Microsoft's page lists Forms (Office 365 Commercial) and Forms (Office 365 GCC) among the in-scope services.