Is Microsoft Copilot HIPAA Compliant?Which Copilot accounts fall under Microsoft's BAA, what the BAA leaves out, and what a practice must set up first.

Only if staff sign in with a work Microsoft Entra account on an organization plan that Microsoft's Business Associate Agreement (BAA) covers, and Copilot is properly configured. Microsoft says the BAA does not cover Copilot web search queries. Copilot on a personal Microsoft account runs under consumer terms. We read Microsoft's pages on October 10, 2026.

Copilot and HIPAA at a glance

• BAA: Microsoft says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."
• Work accounts: Microsoft says Copilot and Copilot Chat "support HIPAA compliance for properly configured implementations."
• Web search: "HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)."
• Personal accounts: Copilot in home subscriptions runs under consumer terms. Microsoft's consumer page does not mention HIPAA or a BAA.
• Ahrefs shows 400 US searches a month for "is copilot hipaa compliant" (checked October 10, 2026).

Which Copilot is your practice using?

The account decides the answer, not the name. Microsoft uses the Copilot name for work products and for a personal product. Its own page notes a rename: "Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat."

Microsoft's FAQ separates the two by sign-in. Work and education users reach Copilot "after signing in with their Entra account." The FAQ then says: "Microsoft Copilot is for personal use. Users access it using a personal account (MSA)." A staff member can open the same app with either account. The table shows what Microsoft's pages said on October 10, 2026.

We did not check GitHub Copilot or Dragon Copilot today. This article gives no verdict on them.

Does Microsoft sign a BAA for Copilot?

Yes, for organizations. Microsoft does not ask a practice to negotiate a separate contract. Its HIPAA page says the BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." The same page lists Microsoft Copilot and Microsoft Copilot Chat among its in-scope Office 365 services.

The pages we read do not list plan names or prices. Confirm with Microsoft or your reseller that your subscription falls under the Data Protection Addendum. Download the BAA and keep a copy.

A BAA is not a certificate. Microsoft writes: "There's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA or the HITECH Act by a business associate."

Is the personal Copilot HIPAA compliant?

Treat it as not compliant. Microsoft's support page says Copilot in Personal, Family, Premium and Pro subscriptions is covered by the "Microsoft Services Agreement and the Copilot Terms of Use." Those are consumer terms. The page does not mention HIPAA or a BAA. We found no Microsoft page that extends the BAA to a personal account.

Are Copilot web searches covered by the BAA?

No. This is the gap most practices miss. Microsoft states: "HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA)." Copilot can send a search query to Bing to answer a prompt. Microsoft says its Product Terms "provide additional commitments about the web queries sent to the Bing search service." Those commitments are not the BAA.

Keep patient names and details out of any prompt that may trigger a web search. Ask your Microsoft administrator whether web search can be limited for your users. We did not verify that setting today.

Does Microsoft train its models on Copilot prompts?

Not for work accounts, according to Microsoft. Its FAQ says: "No, prompts and responses aren't used to train foundation models under enterprise data protection." Enterprise data protection applies "to users who sign in with a Microsoft Entra account" and Microsoft adds that "no IT admin action is required." The promise is tied to the work account. The consumer page we read does not say how personal prompts are used.

How do you set up Copilot for HIPAA?

Follow five steps. Microsoft puts the duty on the practice: "Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place." Microsoft's pages say "properly configured" without listing every setting, so involve your IT administrator.

1. 1

   Confirm the plan and the BAA

   Check that your Microsoft subscription is an organization plan under the Data Protection Addendum. Download the BAA and file it.

2. 2

   Require work sign-in

   Staff use Copilot only with their work Entra account. Personal Microsoft accounts are off limits for patient information.

3. 3

   Decide on web search

   Web search queries fall outside the BAA. Limit web search where you can and tell staff to keep patient details out of prompts that search the web.

4. 4

   Limit what Copilot can reach

   Licensed Copilot uses Microsoft Graph data such as mail and files. Review who can open which mailboxes, sites and folders before you switch it on.

5. 5

   Train staff and record it

   Give staff a one-page rule sheet. Add Copilot to your risk analysis and recheck Microsoft's pages when a feature changes.

How Webpatch helps

Webpatch builds and manages websites for healthcare practices. We list each AI assistant, chat widget and form connected to a practice website. We map each one to the vendor that receives its data. We check whether a BAA covers that vendor. Two related guides compare the options: Which AI Tools Are HIPAA Compliant? and Is ChatGPT HIPAA Compliant?

We are not a law firm. We work alongside your compliance adviser. Contact Webpatch to review the AI tools connected to your website.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.