BAA guide
Is Microsoft Teams HIPAA compliant?
Plan by plan, from Microsoft Teams's own pages.
Only on a plan where the vendor signs a BAA. Microsoft Teams is not HIPAA compliant on its own. Microsoft Teams in Microsoft 365 and Office 365 commercial cloud: BAA available. Covered under the Microsoft BAA that is included by default in the Data Protection Addendum for customers who are covered entities or business associates. Microsoft Teams in Office 365 U.S. Government (GCC): BAA available. Covered under the same Microsoft BAA for GCC customers.
Checked against Microsoft Teams's own pages, linked in the table.
Which Microsoft Teams plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Microsoft Teams in Microsoft 365 and Office 365 commercial cloud | BAA available | Covered under the Microsoft BAA that is included by default in the Data Protection Addendum for customers who are covered entities or business associates. | Customer Lockbox, Delve, Exchange Online, Forms, Griffin, Identity Manager, Lockbox (Torus), Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teamslearn.microsoft.com |
| Microsoft Teams in Office 365 U.S. Government (GCC) | BAA available | Covered under the same Microsoft BAA for GCC customers. | Azure Communications Service, Compliance Manager, Delve, Exchange Online, Forms, Microsoft Copilot, Microsoft Copilot Chat, Microsoft Defender for Office 365, Microsoft Entra ID, Microsoft Purview portal, Microsoft Teamslearn.microsoft.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Microsoft sign a BAA for Microsoft Teams?
Yes. Microsoft lists Microsoft Teams as an in-scope service for both the Office 365 commercial cloud and Office 365 U.S. Government (GCC). The BAA is available by default through the Microsoft Online Services Data Protection Addendum to customers who are covered entities or business associates.
Do we need to sign a separate BAA for Teams?
Microsoft says its HIPAA BAA is included by default in the Data Protection Addendum for covered entities and business associates, and it covers in-scope services such as Microsoft Teams.
Which Teams setup should a healthcare team use with patient data?
Microsoft Teams as part of the organization's Microsoft 365 or Office 365 commercial or GCC subscription, where Teams is on Microsoft's in-scope list for the BAA. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Free to start. Most teams are using it the same day.
Get started for free