BAA guide
Is Microsoft Copilot HIPAA compliant?
Plan by plan, from Microsoft's own pages.
Only on a plan where the vendor signs a BAA. Microsoft Copilot is not HIPAA compliant on its own. Microsoft Copilot and Microsoft Copilot Chat (organizational use): Covered under the Microsoft BAA only for properly configured implementations, and web search queries sent to Bing are not covered.
Checked against Microsoft Copilot's own pages, linked in the table.
Which Microsoft Copilot plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Microsoft Copilot and Microsoft Copilot Chat (organizational use) | BAA only if the condition is met | Covered under the Microsoft BAA only for properly configured implementations, and web search queries sent to Bing are not covered. | Microsoft Copilot and Microsoft Copilot Chat support HIPAA compliance for properly configured implementations. HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA).learn.microsoft.com |
Training, retention, and access logs
- Model training
- Per Microsoft, prompts, responses, and data accessed through Microsoft Graph in Microsoft Copilot and Copilot Chat are not used to train foundation models.
- Retention
- Per Microsoft, Copilot applies the organization's retention policies.
- Access logs
- Per Microsoft, Copilot supports audit of interactions.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Microsoft sign a BAA for Copilot?
Microsoft says Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, support HIPAA compliance for properly configured implementations under the Data Protection Addendum and BAA.
Are Copilot web searches covered by the BAA?
No. Microsoft says HIPAA compliance does not apply to web search queries that Copilot sends to the Bing search service, because those queries are not covered by the DPA and the BAA.
Which Copilot does Microsoft cover for patient data?
Microsoft says Microsoft Copilot and Microsoft Copilot Chat support HIPAA compliance for properly configured implementations, and that web search queries sent to Bing are outside the BAA. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Related
- Is Grammarly HIPAA compliant?
- Is Perplexity HIPAA compliant?
- Is DeepSeek HIPAA compliant?
- Is Grok HIPAA compliant?
- Is BastionGPT HIPAA compliant?
- Is CompliantChatGPT HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
- Rivvi vs Microsoft Copilot for healthcare teams
Source: Microsoft's own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free