BAA guide
Is Microsoft 365 HIPAA compliant?
Plan by plan, from Microsoft's own pages.
Only on a plan where the vendor signs a BAA. Microsoft 365 is not HIPAA compliant on its own. Microsoft 365 and Office 365 commercial cloud: BAA available. The BAA is included by default in the Data Protection Addendum for customers who are covered entities or business associates, and it covers only the in-scope services Microsoft lists, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Office 365 U.S. Government (GCC): BAA available. Covers only the in-scope GCC services Microsoft lists.
Checked against Microsoft 365's own pages, linked in the table.
Which Microsoft 365 plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Microsoft 365 and Office 365 commercial cloud | BAA available | The BAA is included by default in the Data Protection Addendum for customers who are covered entities or business associates, and it covers only the in-scope services Microsoft lists, such as Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. | The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.learn.microsoft.com |
| Office 365 U.S. Government (GCC) | BAA available | Covers only the in-scope GCC services Microsoft lists. | Office 365, Office 365 U.S. Governmentlearn.microsoft.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Microsoft sign a BAA for Microsoft 365?
Yes. Microsoft says its HIPAA BAA is available by default through the Microsoft Online Services Data Protection Addendum to all customers who are covered entities or business associates under HIPAA.
Which Microsoft 365 services does the BAA cover?
Only the in-scope services Microsoft lists. For the commercial cloud these include Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Office Online, Forms, Planner, Power BI, Microsoft Copilot, and Microsoft Copilot Chat. A separate list applies to Office 365 U.S. Government (GCC).
Which Microsoft 365 setup does Microsoft cover for patient data?
Microsoft says the BAA covers the in-scope services it lists for the Office 365 commercial cloud and for Office 365 U.S. Government (GCC). Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Related
- Is Google Workspace HIPAA compliant?
- Is Notion HIPAA compliant?
- Is Smartsheet HIPAA compliant?
- Is Airtable HIPAA compliant?
- Is Asana HIPAA compliant?
- Is monday.com HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: Microsoft's own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free