Conditional Verified 2026-10-20. A BAA is available for Exchange Online on Microsoft 365 Business and Enterprise plans, plus Office 365 GCC, GCC High and DoD. The main exclusion is Outlook.com and other consumer Microsoft accounts. "Outlook" is not a product property that is compliant or certified. What matters is which account sits behind it, whether the BAA terms apply to your organization, and how you configure and use it.
Short answer
Microsoft includes a BAA by default through the Microsoft Products and Services Data Protection Addendum for covered entities and business associates. There is no separate signature. Exchange Online, the service behind Outlook business mailboxes, is on the in-scope service list for commercial and GCC customers. Consumer services are not on that list.
In practice, Outlook (desktop, mobile, web or calendar) is only a reasonable place for PHI when it is connected to a business or enterprise Exchange Online account. The same app signed in to a free Outlook.com address is not. See all vendor HIPAA checks for other tools.
Which plans include a BAA
A BAA is a contract that makes a vendor accountable for PHI it handles for you. PHI is protected health information. Both terms are defined in the HIPAA glossary: BAA, PHI.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Microsoft 365 Business (Basic, Standard, Premium) | Available | Included by default in the Data Protection Addendum; no separate signature | None stated |
| Microsoft 365 / Office 365 Enterprise | Available | Included by default in the Data Protection Addendum; no separate signature | None stated |
| Office 365 GCC | Available | Included by default in the Data Protection Addendum | None stated |
| Office 365 GCC High | Available | Included by default in the Data Protection Addendum | None stated |
| Office 365 DoD | Available | Included by default in the Data Protection Addendum | None stated |
| Outlook.com / consumer accounts | Not listed as in scope | Not applicable | Not applicable |
Minimum seats: Not published by the vendor.
What the BAA covers and what it excludes
Covered services on the in-scope list:
- Exchange Online
- Microsoft Teams
- SharePoint Online
- OneDrive for Business
- Microsoft Defender for Office 365
- Microsoft Entra ID
- Office Online
- Office Pro Plus
Excluded:
- Microsoft Professional Services. A BAA for these is arranged through a Microsoft services representative, not through the standard terms.
- Outlook.com consumer accounts.
If your clinic also keeps referral letters in OneDrive or runs staff huddles in Teams, check those separately. Related checks: OneDrive, SharePoint and Microsoft Copilot.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Customer-selected region; data not replicated outside the chosen geographic area |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Yes |
"Not published by the vendor" means the pages checked on 2026-10-20 do not state it. It does not mean the control is absent.
Data residency: the customer selects the region, and data is not replicated outside the chosen geographic area.
How to use Outlook with PHI
A BAA is a precondition, not a finish line. Responsibility is shared, and the customer side looks like this:
- Confirm the account type. Check that every mailbox that will touch PHI is on a business or enterprise Exchange Online tenant. A front-desk employee who set up an Outlook.com address "just for scheduling" is outside the BAA.
- Confirm your role and terms. Make sure you are a covered entity or business associate and that the Data Protection Addendum BAA terms apply to your agreement with Microsoft.
- Configure access, sharing and retention yourself. Set who can open shared mailboxes (for example, a billing inbox) and who can delegate calendars. Define how long mail is kept.
- Manage users. Remove access the day a staff member leaves, and review it when roles change.
- Decide and document how PHI email is sent and encrypted. Write down which messages may include PHI, which encryption method you use, and test it with an outside recipient such as a specialist's office before relying on it.
- Set policies and train staff. Cover recipients, auto-forwarding rules, mobile devices and personal accounts. Staff should not forward a lab result to a home Gmail address.
- Keep it in writing. Record these decisions in your risk analysis and policies. See HIPAA guides for templates and walkthroughs.
Compliance depends on the signed BAA, your configuration and your policies, not on the Outlook app itself.
Alternatives with a BAA
Verdicts follow the same sourced, dated standard. Order is alphabetical and does not reflect payment or any vendor relationship.
- Gmail in Google Workspace: conditional, Business Starter.
- GoDaddy: conditional, Microsoft 365 email plans it represents as HIPAA-compliant.
- Google Workspace: conditional.
- Hushmail for Healthcare: conditional, Healthcare Basic.
- Microsoft 365 HIPAA check: conditional, Business Basic.
Compare more options in HIPAA-compliant software by category.
Sources
- HIPAA & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-20. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."
- HIPAA & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-20. "To support our customers' compliance with HIPAA when utilizing Microsoft enterprise products and services, Microsoft enters into Business Associate Agreements with its covered entity and business associate customers."
- HIPAA & HITECH Act – Microsoft Compliance (Office 365 in-scope services) — Trust center, checked 2026-10-20. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams"
- HIPAA & HITECH Act – Microsoft Compliance (third-party certifications) — Trust center, checked 2026-10-20. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Outlook email HIPAA compliant?
Conditionally. A BAA is available for Exchange Online on Microsoft 365 Business and Enterprise plans, and on GCC, GCC High and DoD. It is included by default through the Data Protection Addendum. Using it with PHI still depends on your configuration, access management and staff policies.
Is Outlook encryption enough to send PHI under HIPAA?
Not on its own. The pages checked do not publish encryption in transit or at rest, so this page makes no claim about them, and Outlook should not be described as end-to-end encrypted. Encryption is one control among several. You also need a BAA, access controls, a documented method for sending PHI and trained staff.
Can I use Outlook.com or a free Microsoft account for PHI?
No. Consumer accounts such as Outlook.com are not listed as in scope for the BAA. Use an Exchange Online mailbox on a business or enterprise plan.
Is the Outlook calendar covered by Microsoft's BAA?
The calendar is part of the mailbox service. The published in-scope list names Exchange Online and does not break out the calendar or the Outlook apps separately. Treat calendar entries as covered only when they live in an in-scope Exchange Online account, and keep PHI out of event titles unless your policies allow it.