A BAA is available for commercial and GCC Microsoft 365 and Office 365 plans, including the Exchange Online mailboxes behind Outlook. It is not available for consumer Personal and Family subscriptions, Outlook.com or personal OneDrive.
Conditional A BAA is available on commercial and GCC Microsoft 365 / Office 365 plans; the main exclusion is consumer Personal and Family plans. Last verified 2026-10-19.
"Office 365" and "Microsoft 365" fall under the same terms on this page, so every Office 365 query variant is answered here.
Short answer
Microsoft offers a business associate agreement (BAA) through the Microsoft Products and Services Data Protection Addendum (DPA). It applies to Exchange Online (Outlook email), OneDrive for Business, SharePoint Online, Office apps, Forms and Teams. Consumer Personal and Family subscriptions are not Online Services under the DPA and are not covered.
This page states the position as "BAA available on plan X for services Y". It does not treat HIPAA compliance as a property of the product. See all vendor HIPAA checks for other tools.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Microsoft 365 Business Basic | Yes | Included by default in the DPA | None stated; from $7.00/user/month paid yearly |
| Microsoft 365 Business Standard (with Copilot) | Yes | Included by default in the DPA | None stated |
| Microsoft 365 Business Premium (with Copilot) | Yes | Included by default in the DPA | None stated |
| Enterprise suites | Yes | Included by default in the DPA | None stated |
| Office 365 U.S. Government (GCC) | Yes | Included by default in the DPA | None stated |
| Microsoft 365 Personal and Family | No | Not applicable | Not applicable |
| Outlook.com and personal OneDrive | No | Not applicable | Not applicable |
For covered entities and business associates, the BAA is included by default in the DPA. There is no separate signature or request step, and Microsoft does not sign customer-provided BAAs. Minimum seat counts: Not published by the vendor.
What the BAA covers and what it excludes
In scope for commercial and GCC plans:
- Exchange Online (the mailboxes used by Outlook)
- OneDrive for Business (see the OneDrive check)
- SharePoint Online
- Office Online and Office Pro Plus
- Forms
- Teams
- Entra ID
- Purview portal
- Defender for Office 365
- Planner
- Stream
- Power Apps, Power Automate and Power BI in Office 365 plans
- Copilot and Copilot Chat (see the Microsoft Copilot HIPAA check)
Excluded:
- Microsoft Professional Services need a separate BAA, obtained through a Microsoft services representative.
- Bing web search queries sent from Copilot are not covered by the DPA and BAA.
- Consumer subscriptions, Outlook.com and personal OneDrive are outside the DPA.
A clinic that moves referral letters between staff mailboxes on a Business Standard tenant is inside the covered services. The same clinic forwarding those letters to a staff member's personal Outlook.com address is not.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Most Office 365 services let customers specify the region where customer data is located; data is not replicated outside the chosen geographic area |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Yes |
"Not published by the vendor" means the pages cited on this entry do not document the control. It does not mean the control is absent.
Data residency: Microsoft states that most Office 365 services let customers specify a region, and that data is not replicated outside the chosen geographic area. The verbatim wording is in the Sources section.
How to use Microsoft 365 with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. Customer-side checklist:
- Confirm the tenant is a commercial or GCC subscription, not a consumer plan.
- Keep PHI inside covered services only. Do not route it through personal accounts or consumer apps.
- If you use Microsoft Professional Services (for example, a migration engagement that touches PHI), obtain a separate BAA first.
- Keep Copilot web search (Bing) out of PHI workflows.
- Set access, sharing and retention configuration deliberately, for example who can share a patient-intake folder outside the organization.
- Configure and verify your own email-protection settings. The published position is encryption in transit and at rest; no end-to-end encryption claim is made here.
- Train staff and write policies for email, file sharing and AI use.
Alternatives with a BAA
Each is conditional on plan and configuration. Browse the categories: HIPAA-compliant email, HIPAA-compliant office suites and HIPAA-compliant file sharing.
- Box: conditional, from Enterprise. Box check
- Dropbox: conditional, from Standard. Dropbox check
- Gmail in Google Workspace: conditional, from Business Starter. Gmail in Google Workspace
- GoDaddy: conditional; Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. GoDaddy check
- Google Drive: conditional, paid Workspace editions. Google Drive check
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance — Trust center, checked 2026-10-19. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Office 365 in-scope services) — Trust center, checked 2026-10-19. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams, MyAnalytics"
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Office 365 in-scope services, continued) — Trust center, checked 2026-10-19. "Office Online, Office Pro Plus, Office Services Infrastructure, OneDrive for Business, Planner, Power Apps, Power BI, Project Online, Service Encryption with Microsoft Purview Customer Key, SharePoint Online, Stream"
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Third-party certifications) — Trust center, checked 2026-10-19. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Office 365 environments) — Trust center, checked 2026-10-19. "Most Office 365 services enable customers to specify the region where their customer data is located. Microsoft may replicate customer data to other regions within the same geographic area (for example, the United States) for data resiliency, but Microsoft will not replicate customer data outside the chosen geographic area."
- SOC 2 – Microsoft Compliance — Trust center, checked 2026-10-19. "Office 365 SOC 2 attestations are based on rigorous comprehensive third-party examinations (also known as audits) conducted by an independent AICPA accredited CPA firm."
- Data, Privacy, and Security for Microsoft Copilot — Help article, checked 2026-10-19. "Microsoft 365 uses service-side technologies that encrypt customer content at rest and in transit, including BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec)."
- Microsoft 365 Pricing for Business: Plans & Features — Pricing page, checked 2026-10-19. "Microsoft 365 Business Basic Lightweight web and mobile apps to kickstart your business $7.00 user/month, paid yearly (Annual subscription–auto renews)"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Office 365 HIPAA compliant, and is it the same as Microsoft 365?
Both names fall under the same terms on this page. The verdict is conditional: a BAA is available on commercial and GCC plans for the in-scope services listed above. Whether your use is compliant also depends on your configuration and policies.
Do I need to sign a separate BAA with Microsoft?
No. The BAA is included by default through the DPA for covered entities and business associates. Microsoft does not sign customer-provided BAAs. Professional Services are the exception and need a separate BAA through a services representative.
Is Microsoft 365 Business Basic, Standard or Premium covered by the BAA?
Yes. Business Basic, Business Standard and Business Premium are commercial plans, and the DPA's BAA applies to the in-scope services on each. No extra cost for the BAA is stated.
Can I use Microsoft 365 Personal or Family or Outlook.com for PHI?
No. Consumer Personal and Family subscriptions, Outlook.com and personal OneDrive are not Online Services under the DPA and are not covered by the BAA.
Is Microsoft Copilot covered by the BAA?
Copilot and Copilot Chat are in scope. Bing web search queries sent from Copilot are not covered by the DPA and BAA, so keep PHI out of web-search prompts.