BAA guide
Is Microsoft 365 HIPAA compliant?
Plan by plan, from Microsoft 365's own pages.
Only on a plan where the vendor signs a BAA. Microsoft 365 is not HIPAA compliant on its own. Microsoft 365 and Office 365 commercial cloud: BAA available. The BAA is included by default in the Data Protection Addendum for customers who are covered entities or business associates, and it covers only the in-scope services Microsoft lists, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Office 365 U.S. Government (GCC): BAA available. Covers only the in-scope GCC services Microsoft lists.
Checked against Microsoft 365's own pages, linked in the table.
Which Microsoft 365 plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Microsoft 365 and Office 365 commercial cloud | BAA available | The BAA is included by default in the Data Protection Addendum for customers who are covered entities or business associates, and it covers only the in-scope services Microsoft lists, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. | The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.learn.microsoft.com |
| Office 365 U.S. Government (GCC) | BAA available | Covers only the in-scope GCC services Microsoft lists. | Office 365, Office 365 U.S. Governmentlearn.microsoft.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Microsoft sign a BAA for Microsoft 365?
Yes. Microsoft says its HIPAA BAA is available by default through the Microsoft Online Services Data Protection Addendum to all customers who are covered entities or business associates under HIPAA.
Which Microsoft 365 services does the BAA cover?
Only the in-scope services Microsoft lists. For the commercial cloud these include Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Office Online, Forms, Planner, Power BI, Microsoft Copilot, and Microsoft Copilot Chat. A separate list applies to Office 365 U.S. Government (GCC).
Which Microsoft 365 setup should a healthcare team use with patient data?
A Microsoft 365 or Office 365 commercial or GCC subscription held by the organization, using only the in-scope services Microsoft lists for the BAA. Rivvi is a free AI workspace for healthcare teams, and a HIPAA BAA is included.
Free to start. Most teams are using it the same day.
Get started for free