Unknown (Checked 2026-10-28.) Microsoft makes a HIPAA BAA available by default through its Online Services DPA for in-scope services, but Dragon Medical One and Dragon Copilot, both owned by Microsoft (Nuance Communications), do not appear on the published in-scope list, and no Microsoft or Nuance page states BAA coverage for Dragon.
Short answer
A Microsoft BAA exists, and it applies to the services on Microsoft's published in-scope list. Dragon Medical One and Dragon Copilot are not on that list, and none of the three sources checked says the BAA extends to them. The gap is the finding, not a "no": Microsoft has not said Dragon is excluded, and it has not said Dragon is included.
Treat the status as unknown until your contract says otherwise. Dragon products are sold through enterprise and volume licensing, so the BAA question is settled in your agreement, not on a checkout page. For a related example of how Microsoft scopes its BAA across products, see Is Microsoft 365 HIPAA compliant?. Other vendors are in the Is it HIPAA compliant? All vendors directory.
Which plans include a BAA
No plan names are published for Dragon, so one row covers both products.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Dragon Medical One / Dragon Copilot | Not published by the vendor (for Dragon specifically) | Microsoft HIPAA BAA is included by default in the Online Services DPA for in-scope services | Not published by the vendor |
Dragon pricing is not published. A related Microsoft product with its own BAA terms is covered in Is Microsoft Copilot HIPAA compliant?; its terms do not carry over to Dragon.
What the BAA covers and what it excludes
Covered services for Dragon: Not published by the vendor.
Exclusions:
- Dragon Copilot and Dragon Medical One are not listed among the in-scope services on Microsoft's HIPAA & HITECH offering page. Confirm by contract.
The Microsoft Product Terms for Dragon Copilot contain a line on Healthcare Intended Uses:. Read it as a usage condition. It is not a statement that a BAA covers the product.
Whether earlier Nuance BAA terms for Dragon Medical One still apply under Microsoft contracts is not stated in the sources checked.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Every row reads "Not published by the vendor" on the pages checked. Absence of publication is not evidence of absence; these controls may exist and be available under NDA or in contract documents.
How to use Dragon with PHI
A BAA is the written agreement that lets a vendor handle PHI for you (see the HIPAA glossary). Before a clinician dictates a single patient detail into Dragon:
- Get written confirmation from Microsoft or your reseller that your specific product and edition (Dragon Medical One or Dragon Copilot) is within BAA scope.
- Confirm the BAA is in your contract before any PHI is dictated, not promised in a sales call.
- Configure access. Assign accounts per clinician, and remove users at offboarding, such as when a locum's contract ends.
- Set dictation policies: what may be dictated, and where the output goes. A note pasted from dictation into an email or a shared document is a separate system that needs its own BAA.
- Train staff on those policies, including what to do when dictation lands in the wrong patient record.
- Ask for the control documentation from the table above: encryption, audit logging, data residency and audit reports.
- Keep a vendor inventory entry with the contract reference and the date you confirmed scope, and re-verify on a schedule.
Compliance depends on the signed BAA, your configuration and your policies, not on the product name.
Alternatives with a BAA
These AI scribe and documentation vendors have their own pages with sourced verdicts. The list is alphabetical, not ranked, and each verdict applies only as stated on that vendor's page.
- DeepScribe: yes
- Freed: yes, BAA from the Starter plan
- Heidi Health: conditional
- Suki: conditional
- Upheal: yes, BAA from the Free plan
See the AI scribes category for the comparison table, or browse HIPAA-compliant software by category.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance — Trust center, checked 2026-10-28. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Compliance in Microsoft for Healthcare | Microsoft Learn — Trust center, checked 2026-10-28. "The BAA is automatically included as part of the Online Services Terms and applies to customers who are covered entities or business associates and are storing PHI."
- Microsoft Product Terms – Microsoft Dragon Copilot — Terms, checked 2026-10-28. "Customer must only use Dragon Copilot in furtherance of the Healthcare Intended Uses."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Dragon dictation HIPAA compliant?
The verdict is unknown. A Microsoft BAA is available for in-scope services, but Dragon is not on the published list. Confirm coverage by contract before dictating PHI.
Is Nuance Dragon Medical One HIPAA compliant?
No page checked states BAA coverage for Dragon Medical One. Confirm in writing that your edition is in scope under your contract.
Does Microsoft sign a BAA for Dragon Copilot?
Microsoft's BAA applies to in-scope services, and Dragon Copilot does not appear on the published list. No source checked states whether a BAA covers it, so ask Microsoft or your reseller for written confirmation.
What should I ask before dictating PHI into Dragon?
Ask these questions:
- Is my exact product and edition in BAA scope, and where does the contract say so?
- Which security controls and audit reports are available?
- Where is dictated content stored?
- Which other services touch the output?