Is Microsoft Teams HIPAA Compliant?

Only if your practice uses Teams inside a Microsoft 365 or Office 365 business subscription, where Microsoft's Business Associate Agreement (BAA) applies, and sets it up correctly. We read Microsoft's HIPAA page and its Teams security pages on October 11, 2026. This guide covers what Microsoft says, what HHS requires, and which settings a practice must check.

Microsoft Teams and HIPAA at a glance

• Microsoft offers a BAA that covers its in-scope services. Teams is on the in-scope list for Office 365.
• The BAA comes through the Microsoft Online Services Data Protection Addendum. Microsoft says it is available by default.
• Microsoft says that using its services does not make a practice compliant on its own.
• End-to-end encryption for one-to-one calls is off by default.
• End-to-end encrypted meetings need a Teams Premium license for the organizer.
• We could not confirm BAA coverage for the free version of Teams. Do not use it for patient information.

Does Microsoft sign a BAA for Teams?

Yes. Microsoft's HIPAA page states: "Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services."

The practice does not sign a separate form. Microsoft says the BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." The same page lists Microsoft Teams among the in-scope Office 365 services, for both commercial and US Government (GCC) environments. You can read the wording on Microsoft's HIPAA and HITECH page.

Keep a copy of the BAA and the addendum in your compliance file. An auditor will ask for the document, not for a link.

Is Teams covered on every plan?

No plan list appears on the page we read. The BAA follows the Data Protection Addendum, and the addendum belongs to Microsoft's online services agreements. The table shows what we confirmed and what we did not.

Does a BAA make Teams HIPAA compliant?

No. Microsoft answers this question directly: "using Microsoft services doesn't on its own achieve HIPAA compliance." It adds: "Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place."

HHS takes the same view from the other side. Its cloud computing guidance says a provider that uses a cloud service for patient data "without entering into a BAA with the CSP" is "in violation of the HIPAA Rules." The BAA is the starting point. The practice still owns access control, training, and its risk analysis.

Is Microsoft Teams HIPAA compliant for telehealth?

Teams can be used for video visits when the BAA applies and the meeting settings are locked down. HHS guidance on telehealth, first published on June 10, 2022, says that when an app stores session data, "the provider would need to enter into a BAA with the app developer before it can use the app with patients." Teams stores chat, files, and recordings, so the BAA matters.

Encryption needs a closer look. Microsoft's Teams security overview lists "Encryption of data in transit and at rest." End-to-end encryption is a separate, optional layer. Microsoft states: "For one-to-one calls, E2EE is disabled by default in the Global (Org-wide default) enhanced encryption policy." An admin must allow it, and each user must turn it on.

For meetings, Microsoft says: "Meeting organizers must have a Teams Premium license to use E2EE for meetings." Recording, live captions, and transcription are not available in end-to-end encrypted calls. A practice must choose between those features and the extra layer. We compare another video tool in Is Zoom HIPAA Compliant for Telehealth?.

How do you make Microsoft Teams HIPAA compliant?

Microsoft's Teams security overview lists "Team-wide and organization-wide two-factor authentication" among its controls. It also notes that subscriptions and licenses "determine the available features." Work through these six steps with your IT admin.

1. 1

   Confirm the BAA

   Download the Microsoft BAA and the Data Protection Addendum. File both with your HIPAA records.

2. 2

   Require two-factor sign-in

   Turn it on for every clinician and staff account. Remove accounts when staff leave.

3. 3

   Limit guests and external access

   Decide who outside the practice can join teams, chats, and shared files. Block the rest.

4. 4

   Decide on recording and transcripts

   A recording of a visit is patient information. Turn recording off unless you have a clinical reason and a storage plan.

5. 5

   Set retention and audit logging

   Choose how long chats and files are kept. Confirm that audit logs are on and that someone reviews them.

6. 6

   Review third-party apps

   Remove apps that can read Teams data unless each vendor has its own BAA with the practice.

Is Teams chat HIPAA compliant?

Teams chat sits under the same BAA as meetings when the subscription is covered. The rules for staff still apply. HHS defines a business associate as an entity involved in "creating, receiving, maintaining, or transmitting PHI" for a provider, and that is what Teams does with every chat message.

• Share the minimum patient detail needed for the task.
• Keep patient names out of team and channel names.
• Do not paste patient details into chats with outside guests.
• Check AI features before you enable them. See Which AI Tools Are HIPAA Compliant?.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. Many practice websites hand patients to Teams through a booking link or a contact form. We review that path and list every vendor that touches patient information, with its BAA status. We are not a law firm.

If you want a review of how your website connects to Teams and your other tools, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.