Conditional Microsoft makes a BAA available through the Online Services DPA for SharePoint Online on Office 365 and Microsoft 365 commercial and GCC subscriptions; the main exclusion is SharePoint Server on-premises. Last verified 2026-10-28.
Disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. This vendor has no commercial relationship with Chanty.
Short answer
Microsoft includes a BAA by default in the Microsoft Online Services Data Protection Addendum (DPA) for covered entities and business associates. SharePoint Online, the cloud service also searched as "Microsoft SharePoint," is an in-scope service. This applies to business subscriptions only.
A BAA alone does not make your use of SharePoint compliant. See All vendor HIPAA checks for how other tools compare.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Office 365 / Microsoft 365 commercial subscriptions (SharePoint Online) | Available | Included by default in the Online Services DPA; no separate signature | None |
| Office 365 GCC | Available | Same mechanism: included in the DPA | None |
For the wider suite, see the Microsoft 365 HIPAA status page.
What the BAA covers and what it excludes
Covered (in-scope online services):
- SharePoint Online
- OneDrive for Business (see Is OneDrive HIPAA compliant?)
- Exchange Online
- Microsoft Teams
- Office Online
Excluded:
- Microsoft Professional Services. The BAA for these is arranged separately through a Microsoft services representative.
- SharePoint Server on-premises. It is not an online service and is not on Microsoft's in-scope list. A clinic running its own SharePoint Server in a back-office closet has no Microsoft BAA for it. Hosting, patching and safeguards are entirely its own responsibility.
Microsoft's in-scope list is the authority and may change, so check it before moving any PHI workload.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Customer-selected region; replication kept within the chosen geographic area |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Yes |
"Not published by the vendor" refers to the sources cited on this page. It does not mean the control is absent.
How to use SharePoint with PHI
A BAA only covers Microsoft's side. Whether a document library holding scanned referral letters or billing records meets HIPAA depends on the customer's own work, which is why searches for "how to make SharePoint HIPAA compliant" have no one-click answer. A practical checklist:
- Confirm coverage. Check that your organization is a covered entity or business associate under the DPA, and read the current DPA wording.
- Use only in-scope SharePoint Online. Stay on a commercial or GCC business subscription, not a personal or consumer account.
- Keep PHI out of excluded services. That means SharePoint Server on-premises and Microsoft Professional Services, unless separately agreed in writing.
- Select your data region. Choose the geographic area where data is stored; replication stays within it.
- Set access and sharing permissions. Limit each site and library to staff who need it, such as the billing team but not the front desk, and decide who may share outside the organization.
- Offboard users promptly. Remove access when a medical assistant or contractor leaves.
- Train staff and write policies. Cover where PHI may be saved, what may not be downloaded to personal devices, and how incidents are reported.
Compliance depends on the signed BAA, configuration and policies together. Terms such as BAA, covered entity and business associate are defined in the HIPAA glossary.
Alternatives with a BAA
Verdicts below reflect the vendors' published BAA terms.
- Adobe Acrobat: conditional (Acrobat Sign Solutions for enterprise)
- Adobe Acrobat Sign: conditional (same scope)
- Amazon Web Services: conditional (all AWS accounts)
- Backblaze: conditional (B2 Cloud Storage, business customers)
- Box: conditional (Enterprise)
Compare more options in HIPAA-compliant storage and HIPAA-compliant document management.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "GCC | Azure Communications Service, Compliance Manager, Delve, Exchange Online, Forms, Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams, MyAnalytics, Office 365 Advanced Compliance add-on, Office Online, Office Pro Plus, OneDrive for Business, Planner, Power Apps, Power Automate, Power BI, SharePoint Onli…"
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act – Microsoft Compliance | Microsoft Learn — BAA page, checked 2026-10-28. "Most Office 365 services enable customers to specify the region where their customer data is located. Microsoft may replicate customer data to other regions within the same geographic area (for example, the United States) for data resiliency, but Microsoft will not replicate customer data outside the chosen geographic area."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is SharePoint Online HIPAA compliant?
Microsoft provides a BAA by default through the Online Services DPA for in-scope SharePoint Online on business subscriptions. Whether your use is compliant depends on the signed BAA, your configuration and your policies.
Do I need to sign a separate BAA with Microsoft for SharePoint?
Per Microsoft's source, no separate signature is required. The BAA is included by default in the DPA. Microsoft Professional Services is the exception and is arranged separately.
Is on-premises SharePoint Server covered by Microsoft's BAA?
No. SharePoint Server on-premises is not an online service and is not listed as in scope.
Does the SharePoint BAA cost extra or require a specific plan?
There is no extra cost. It applies to Office 365 and Microsoft 365 commercial subscriptions and Office 365 GCC, not to consumer accounts.