Is Microsoft 365 HIPAA Compliant?Outlook, OneDrive and SharePoint

Only if your practice uses a business or enterprise Microsoft 365 plan, where Microsoft's Business Associate Agreement (BAA) applies by default, and you configure it correctly. Exchange Online, OneDrive for Business, SharePoint Online and Teams are listed as in scope. Consumer plans are not listed. We read Microsoft's HIPAA page on October 16, 2026.

Microsoft 365 and HIPAA at a glance

• Verdict: only if, on a business plan, with the right settings.
• How the BAA works: Microsoft includes it by default in its Online Services Data Protection Addendum for covered entities and business associates.
• In scope: Exchange Online, OneDrive for Business, SharePoint Online and Microsoft Teams, in the commercial and GCC environments.
• Not listed: Microsoft 365 Personal, Microsoft 365 Family, Outlook.com and personal OneDrive.
• Your side: Microsoft says using its services does not on its own achieve HIPAA compliance.
• Page checked: Microsoft's HIPAA and HITECH page, last updated July 29, 2025, read on October 16, 2026.

Does Microsoft sign a BAA for Microsoft 365?

Yes, and you do not have to request it separately. Microsoft's HIPAA page says the BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."

The BAA matters because Microsoft stores your data. HHS guidance on cloud computing says a cloud provider is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." A practice that uses one without a BAA "is in violation of the HIPAA Rules."

Is Outlook HIPAA compliant?

Outlook is covered when it connects to an Exchange Online mailbox on a business plan. Microsoft's in-scope table lists Exchange Online, the email service behind business Outlook. It does not list Outlook by name, and it does not list the free Outlook.com service.

Email to patients leaves your tenant, so encryption matters. Microsoft Purview Message Encryption "works with Outlook.com, Yahoo!, Gmail, and other email services." Recipients on those services get a link to a portal where they sign in to read the message. Microsoft's page does not list which plans include it, so check your license before you rely on it.

For the HHS rules on emailing patients, read our guide to HIPAA compliant email.

Are OneDrive and SharePoint HIPAA compliant?

OneDrive for Business and SharePoint Online are in scope in both the commercial and GCC rows of Microsoft's table. A personal OneDrive tied to a consumer Microsoft account is a different product and is not listed.

What about Microsoft 365 Personal and Family?

We could not confirm any BAA coverage for them. Microsoft's HIPAA page covers the commercial and government Office 365 environments. It makes no statement about Microsoft 365 Personal, Family, Outlook.com or personal OneDrive. We found no Microsoft page in this check that extends the BAA to those plans.

Small practices often start on a home plan. Move practice work to a business plan before staff store patient files or send patient email. The same split applies to AI: see whether Microsoft Copilot is HIPAA compliant.

How do you set up Microsoft 365 for HIPAA?

Microsoft says your organization is responsible for making sure "your particular use of Microsoft services aligns with your obligations under HIPAA and the HITECH Act." These five steps cover the basics.

1. 1

   Confirm the plan

   Check that every account that touches patient data is on a business or enterprise Microsoft 365 plan, not a Personal or Family plan.

2. 2

   Keep a copy of the BAA

   Download Microsoft's BAA and the Data Protection Addendum from the Service Trust Portal and file them with your HIPAA records.

3. 3

   Limit sharing

   Restrict external sharing in OneDrive and SharePoint. Avoid links that let anyone open a file without signing in.

4. 4

   Encrypt outbound email

   Confirm your plan includes message encryption, then train staff on when to use it for patient email.

5. 5

   Require multifactor sign-in

   Turn on multifactor authentication for every account, starting with administrators.

Is Microsoft Teams covered too?

Yes. Microsoft Teams appears in both the commercial and GCC rows of Microsoft's in-scope table. Settings for guests, chat and recordings still matter. Our guide on whether Microsoft Teams is HIPAA compliant covers them.

How Webpatch helps

Webpatch is a technology company for healthcare practices. We build websites and manage their security, HIPAA compliance, SEO and AEO. We review how your Microsoft 365 tenant, website forms and email connect, and we flag accounts on consumer plans. Contact Webpatch to review your setup.

We are not a law firm. We handle the technical side and work alongside your privacy officer or attorney.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.