A BAA is available for OneDrive for Business on Office 365 / Microsoft 365 commercial and GCC plans. Consumer OneDrive is not in scope. A clinic can put PHI in OneDrive only inside a business tenant, never in a personal Microsoft account.
Is OneDrive HIPAA compliant? Verdict: conditional
Conditional Microsoft makes a BAA available through the Microsoft Online Services Data Protection Addendum (DPA) on Office 365 / Microsoft 365 commercial and GCC plans, and the main exclusion is consumer OneDrive. Verdict date: 2026-10-28.
This directory is published by Chanty, Inc. Chanty has no relation to this entry.
Short answer
The answer is "BAA available on plan X for services Y," not a property of the product. For OneDrive, plan X is Office 365 / Microsoft 365 commercial or GCC, and service Y is OneDrive for Business. Consumer OneDrive, which runs under the Microsoft Services Agreement, is not in scope.
For customers that are covered entities or business associates, the BAA is included by default in the Online Services DPA. There is no separate signature and no extra cost.
A BAA is one requirement, not a compliance program. See All vendor HIPAA checks for how other tools compare.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Office 365 / Microsoft 365 commercial (OneDrive for Business) | Available | Included by default in the Online Services DPA | None |
| Office 365 GCC | Available | Same mechanism: Online Services DPA | None |
| Consumer OneDrive (free, Microsoft 365 Personal/Family) | Not available | Not in scope; governed by the Microsoft Services Agreement | Not published by the vendor |
For example, a three-physician practice that stores scanned intake forms in the OneDrive attached to its Microsoft 365 business tenant falls under the first row. A front-desk employee who saves the same scans to a personal OneDrive account is on the last row. No BAA exists for that account.
What the BAA covers and what it excludes
Covered services (the in-scope cloud services under the DPA):
- OneDrive for Business
- SharePoint Online (see SharePoint)
- Exchange Online
- Microsoft Teams
- Office Online
- Office Pro Plus
Excluded:
- Consumer OneDrive under the Microsoft Services Agreement.
- Microsoft Professional Services. A BAA for these is arranged separately through a Microsoft services representative.
Microsoft's "in-scope cloud services" list is the controlling reference. Check it before putting PHI in any Microsoft service not named above.
Security controls the vendor publishes
On the Microsoft pages checked, the following are not stated:
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Customer-selected region; replication kept within the chosen geographic area |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Yes |
This means these controls were not stated on the pages checked, not that they are absent. Evaluators should request this documentation from Microsoft directly.
Data residency: the customer selects the region, and replication stays within the chosen geographic area.
Audits: Microsoft's statement about audits of services covered under the BAA names HITRUST (Yes) and ISO 27001 (Yes).
How to use OneDrive with PHI
- Confirm the tenant is on an Office 365 / Microsoft 365 commercial or GCC plan, not a personal account.
- Confirm your organization's status as a covered entity or business associate under the DPA. The BAA is part of those terms, so no separate signature is required. Keep a copy of the DPA terms in effect for your vendor file (see the HIPAA glossary for the BAA definition).
- Keep PHI out of personal and consumer accounts. Tell staff that a personal OneDrive on a home laptop is out of scope.
- Configure access and sharing deliberately. Decide who can see each library and who can share files outside the organization.
- Manage user access and offboarding. Remove departed staff promptly and review who still has access to folders containing PHI.
- Check that every service you use with PHI appears in Microsoft's in-scope list.
- Train staff and write policies for what may be stored, shared and synced to devices.
Compliance depends on the BAA, your configuration and your policies.
Alternatives with a BAA
- Amazon Web Services: conditional, all accounts.
- Backblaze: conditional, B2 Cloud Storage business customers.
- Box: conditional, Enterprise.
- Carbonite: conditional, Safe Backup Pro Core/Power/Ultimate.
- Dropbox: conditional, Standard.
Compare more options in HIPAA-compliant storage and HIPAA-compliant backup.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, … Office Online, Office Pro Plus, Office Services Infrastructure, OneDrive for Business, Planner, Power Apps, Power BI, Project Online, Service Encryption with Microsoft Purview Customer Key, SharePoint Online, Stream"
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28.
Is OneDrive for Business HIPAA compliant?
Conditional. A BAA is available for OneDrive for Business on Office 365 / Microsoft 365 commercial and GCC plans through the Online Services DPA. Whether your use meets HIPAA depends on your configuration and policies.
Is personal or free OneDrive covered by a BAA?
No. Consumer OneDrive, including free accounts and Microsoft 365 Personal/Family, runs under the Microsoft Services Agreement and is not in scope for the BAA.
Do I have to sign a separate BAA or pay extra for Microsoft's HIPAA BAA?
No. For customers that are covered entities or business associates, the BAA is included by default in the Online Services DPA, with no separate signature and no extra cost. Microsoft Professional Services are the exception: a BAA for them is arranged separately through a Microsoft services representative.
Which Microsoft services are covered by the same BAA as OneDrive?
OneDrive for Business, SharePoint Online, Exchange Online, Microsoft Teams, Office Online and Office Pro Plus. Microsoft's in-scope cloud services list is the controlling reference.