Conditional (Last verified 2026-10-19.) Microsoft makes a BAA available for Teams chat, calling and meetings on Microsoft 365/Office 365 commercial and GCC subscriptions and on Teams Essentials. The main exclusions are free Teams and Teams used with a personal Microsoft account, which are consumer services. This directory is published by Chanty, Inc., which sells a competing product. Chanty is listed as one alternative, and placement never depends on that relationship.
Short answer
The BAA for Teams chat, calling and meetings comes through the Microsoft Online Services Data Protection Addendum (DPA) on covered subscriptions. For covered entities and business associates, it is included by default in the DPA. Microsoft states no separate signature and no extra cost. Free Teams and Teams with personal Microsoft accounts fall under the Microsoft Services Agreement, not the Online Services DPA, so they are not covered. Whether a BAA exists says nothing yet about whether your configuration is safe. See the other checks in Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Teams Essentials | Available | Included by default in the DPA | None stated; included in the subscription |
| Microsoft 365 Business Basic | Available | Included by default in the DPA | None stated; included in the subscription |
| Microsoft 365 Business Standard (with Copilot) | Available | Included by default in the DPA | None stated; included in the subscription |
| Microsoft 365 Business Premium (with Copilot) | Available | Included by default in the DPA | None stated; included in the subscription |
| Microsoft 365 / Office 365 enterprise suites | Available | Included by default in the DPA | None stated; included in the subscription |
| Office 365 U.S. Government (GCC) | Available | Included by default in the DPA | None stated; included in the subscription |
| Microsoft Teams (free) | Not available | Consumer service, not covered by the DPA | n/a |
| Teams for personal use (personal Microsoft account) | Not available | Microsoft Services Agreement, not the Online Services DPA | n/a |
Minimum seats: Not published by the vendor. Teams Essentials starts at $4.00 per user per month, paid yearly (source dated 2026-10-19).
The suites are covered in more detail in Is Microsoft 365 HIPAA compliant?
What the BAA covers and what it excludes
Covered:
- Teams chat, calling and meetings on commercial and GCC subscriptions.
- Meeting recordings and transcripts stored in OneDrive/SharePoint. Storage is governed by your tenant's settings, so see Is SharePoint HIPAA compliant?
- Teams Phone, as an in-scope Office 365 service.
Excluded:
- Chat between work and personal accounts.
- Third-party apps integrated into Teams.
- Copilot in Teams web search queries sent to Bing. See Is Microsoft Copilot HIPAA compliant?
These exclusions are where PHI most often leaves a protected boundary. Picture a front-desk lead who installs a third-party scheduling app into a Teams channel, or a nurse manager who chats with a staff member's personal account. In both cases the BAA does not reach the data, and only admin policy prevents it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Data in Teams resides in the geographic region associated with the Microsoft 365 or Office 365 organization |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Yes |
Data residency: data resides in the geographic region associated with the Microsoft 365 or Office 365 organization.
SOC 2, HITRUST and ISO 27001 are named by their standards. HIPAA has no certification, so no "HIPAA certified" claim appears here. This directory reports Microsoft's published terms and does not audit Microsoft.
How to use Microsoft Teams with PHI
Compliance depends on the signed BAA, your configuration and your organization's policies. Work through this shared-responsibility checklist:
- Confirm the subscription is a covered commercial or GCC plan and that the DPA applies to your tenant.
- Block or separate chat with personal accounts, and keep free Teams out of clinical workflows.
- Review and restrict third-party apps in the Teams app catalog.
- Decide where recordings and transcripts are stored and who can access them.
- Review the Copilot web-search setting, given the Bing exclusion.
- Manage user access and offboarding, so departed staff lose access the same day.
- Train staff on what may and may not be posted, and document the policy.
For BAA and risk-analysis basics, see the HIPAA guides and the HIPAA glossary.
Alternatives with a BAA
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Chanty | Conditional | Business |
| Doxy.me | Yes | Free |
| Google Chat | Conditional | Google Workspace (admin-managed; accepted in the Admin console) |
| Google Meet | Conditional | Google Workspace (paid editions) |
| Google Workspace | Conditional | Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits) |
Browse the category tables: HIPAA-compliant team chat tools and HIPAA-compliant video conferencing.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance — Trust center, checked 2026-10-19. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Office 365 in-scope services) — Trust center, checked 2026-10-19. "Commercial | Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams, MyAnalytics"
- Overview of security and compliance – Microsoft Teams — Help article, checked 2026-10-19. "Compliance standards Teams uses the following standards: ISO 27001 ISO 27018 SSAE18 SOC 1 and SOC 2 HIPAA EU Model Clauses (EUMC)."
- Overview of security and compliance – Microsoft Teams (Location of data in Teams) — Help article, checked 2026-10-19. "Data in Teams resides in the geographic region associated with your Microsoft 365 or Office 365 organization."
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance (Third-party certifications) — Trust center, checked 2026-10-19. "Microsoft services covered under the BAA undergo audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification and the HITRUST Common Security Framework (CSF) certification."
- Data, Privacy, and Security for Microsoft Copilot — Help article, checked 2026-10-19. "Microsoft 365 uses service-side technologies that encrypt customer content at rest and in transit, including BitLocker, per-file encryption, Transport Layer Security (TLS), and Internet Protocol Security (IPsec)."
- Microsoft Teams Pricing for Business: Plans & Features — Pricing page, checked 2026-10-19. "Microsoft Teams Essentials Affordable, professional meeting solution for small and medium-sized businesses $4.00 user/month, paid yearly (Annual subscription—auto renews)1"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does Microsoft Teams sign a BAA?
A BAA is included by default in the Online Services DPA for covered entities and business associates on covered subscriptions. Microsoft states no separate signature and no extra cost.
Is the free version of Microsoft Teams HIPAA compliant?
No. Free Teams, and Teams used with a personal Microsoft account, are consumer services governed by the Microsoft Services Agreement. They are not covered by the DPA and should not be used with PHI.
Are Teams meeting recordings and transcripts covered by the BAA?
Recordings and transcripts stored in OneDrive/SharePoint are listed as covered. You still control where they are stored and who can access them.
Are third-party apps and Copilot web search in Teams covered?
No. Third-party apps integrated into Teams are excluded. So are Copilot in Teams web search queries sent to Bing. Restrict both by admin policy before PHI enters the workspace.