HIPAA guide

Microsoft 365 and HIPAA: the BAA, the in-scope services, and the settings that are on you

Microsoft includes a business associate agreement in its standard terms, which makes Microsoft 365 the easiest major platform to start using for patient data and the easiest to misconfigure. Here is what the BAA covers, what Microsoft says you still have to do, and the settings an investigator would check.

Take the 3-minute Cyber Hygiene Test

By the AccuSights compliance team. Updated October 2026. Every figure is quoted from a source listed at the end of the page.

How Microsoft's BAA works

Unlike most vendors, Microsoft doesn't make you ask. Its HIPAA Business Associate Agreement is available through the Online Services Data Protection Addendum by default to any customer that is a covered entity or business associate. Microsoft's compliance documentation lists the in-scope services: Office 365 and its workloads (Exchange Online, SharePoint, OneDrive, Teams and more), Microsoft Entra ID, Intune, Azure, Dynamics 365, Power Platform, Windows 365 and the Defender products.

Then it adds the sentence every practice should read twice: using Microsoft services "doesn't on its own achieve HIPAA compliance." Your organization is responsible for an adequate compliance program and for making sure your particular use of the services aligns with your obligations.

What's in scope and what isn't

Microsoft services and HIPAA BAA scope
Service	In scope for the BAA?	Note
Exchange Online, Outlook	Yes	Add Purview Message Encryption for PHI to outside organizations
SharePoint, OneDrive	Yes	External sharing defaults need tightening
Teams	Yes	Guest access and external chat are settings, not defaults you want
Entra ID, Intune, Defender for Office 365 and Cloud Apps	Yes	Listed in scope; confirm the specific Defender product you use
Azure, Dynamics 365, Power Platform	Yes	Per Microsoft's in-scope list
Copilot	Check current list	Microsoft lists Microsoft Copilot and Copilot Chat among in-scope services; verify the Copilot product you use
Consumer Outlook.com, personal OneDrive	No	Consumer services, no BAA
Third-party add-ins	No	Each needs its own BAA

"We're on Microsoft" is a licence, not a safeguard. The safeguard is the policy you turned on.Your engineer

Why Business Premium is the usual answer for a practice

Microsoft 365 Business Premium bundles Intune for device management and Defender for Business for endpoint protection with the Office apps and Exchange. For a practice that would otherwise buy an MDM and an antivirus product separately, that's two Security Rule safeguards in the licence you may already pay for. It doesn't include Audit (Premium); if you need audit retention beyond 180 days, plan an export or the add-on.

Microsoft 365 or Google Workspace?

Both sign a BAA, both encrypt, both leave the hard part to you. Microsoft's edge for a small practice is the bundled device management and endpoint protection; default audit retention is about the same, 180 days against six months. Google's edge is simplicity and the browser-first model. Whichever you have, configure it; switching is rarely the fix. See Google Workspace and HIPAA.

With AccuSights: the Microsoft 365 connector reads MFA enforcement, audit log status, sharing settings and Intune compliance into the platform, and flags the day mailbox auditing or MFA changes. Each setting above is a monitored control with evidence filed against its citation. The AccuSights endpoint agent covers devices Intune doesn't manage.

Quick questions

Is Microsoft 365 HIPAA compliant?

Microsoft 365 can support HIPAA compliance. Microsoft offers a business associate agreement by default through its Data Protection Addendum and operates in-scope services to its own security standards. Microsoft's documentation says plainly that using its services doesn't on its own achieve HIPAA compliance, and that your organization is responsible for its own compliance program and configuration.

Do I need to sign a separate BAA with Microsoft?

No. Microsoft's HIPAA Business Associate Agreement is available through the Online Services Data Protection Addendum by default to customers that are covered entities or business associates. Download and keep a copy of the current DPA and BAA with your documentation, because OCR will ask for the agreement.

Which Microsoft 365 plans are covered?

Microsoft scopes the BAA by service, not by plan. Office 365 services including Exchange Online, SharePoint, OneDrive and Teams are in scope across commercial plans, along with Entra ID, Intune, Azure, Dynamics 365, Power Platform, Windows 365 and Defender. Microsoft 365 Business Premium is the common choice for practices because it bundles Intune and Defender, which deliver several Security Rule safeguards.

How long does Microsoft 365 keep audit logs?

Audit (Standard) retains unified audit log records for 180 days by default, for logs generated on or after October 17, 2023. Audit (Premium), which requires an E5 licence or an add-on, keeps Exchange, SharePoint, OneDrive and Entra ID records for one year, and a separate add-on extends retention to ten years. Mailbox audit logging is on by default.

Is Outlook email HIPAA compliant?

Exchange Online is in scope for the BAA and encrypts mail at rest and in transit with TLS where the receiving server supports it. For PHI sent to outside organizations, use Microsoft Purview Message Encryption or a secure portal, because TLS alone doesn't guarantee the recipient's side.

Three on the same thread, then every HIPAA guide.

the BAA is in the admin console, not the inboxGoogle Workspace and HIPAA how long the river has to rememberAudit log retention the river remembers who swam whereAudit controls, 164.312(b)

Who it applies to

Rules, risk and OCR

Costs, software and tools

Security Rule, clause by clause

The HIPAA overview

Sources

Rules, figures and enforcement examples on this page were checked against these in October 2026. Regulations and prices change, so confirm before you rely on them.

Written by the AccuSights compliance team and updated October 2026. Figures are quoted from the sources named here and were current when checked. This page is general information, not legal advice.

Next step

Want the tenant hardened and the evidence kept?

We configure Entra, Intune and Purview to the policy, connect the tenant to the platform, and keep every setting evidenced.