Does Microsoft 365 Sign a HIPAA Business Associate Agreement?

By BAA Generator Research Team  ·  Published Apr 19, 2026  ·  Last reviewed Apr 19, 2026  ·  3 min read

Microsoft 365 is one of the most widely used productivity suites in healthcare — from physician practices using Outlook for scheduling to health systems storing documents in SharePoint. If PHI flows through any Microsoft service, a HIPAA BAA with Microsoft is legally required. Fortunately, Microsoft has streamlined this process considerably.

How Microsoft's BAA Works

Unlike many vendors that require a manual contract request, Microsoft incorporates its HIPAA BAA into the Microsoft Online Services Terms (OST). When your organization subscribes to a qualifying Microsoft 365 commercial plan, the BAA obligations are automatically included — you don't need to separately request or sign a BAA document.

For organizations with an Enterprise Agreement (EA), your Microsoft account representative can also provide a separate signed BAA document if your compliance or legal team requires it.

Which Plans Are Covered?

Microsoft's HIPAA BAA applies to commercial Microsoft 365 plans including:

• Microsoft 365 Business Basic, Standard, and Premium
• Microsoft 365 Apps for Business and Enterprise
• Microsoft 365 E3 and E5
• Office 365 E1, E3, E5 (legacy plans)
• Microsoft 365 Government (GCC, GCC High, DoD)

Not covered: Free Microsoft accounts, consumer Outlook.com, personal OneDrive, Xbox accounts, and Microsoft's consumer products. Personal Microsoft accounts cannot be used for PHI regardless of plan.

Which Services Are Covered Under Microsoft's HIPAA BAA?

What to Check in the Microsoft Trust Center

Microsoft's Trust Center (microsoft.com/en-us/trust-center) provides its current HIPAA compliance documentation including:

• The HIPAA and HITECH compliance overview
• The list of in-scope services updated by Microsoft
• The Microsoft Online Services Terms that contain the BAA
• Microsoft's HIPAA implementation guide (audit checklists)

Review the in-scope services list annually — Microsoft occasionally adds or removes services from HIPAA coverage.

What Else You Need After the Microsoft BAA

The Microsoft BAA covers Microsoft's obligations. Your organization's compliance obligations don't end there:

• BAAs with other vendors — if staff share PHI via Microsoft Teams with a third-party telehealth app, that app needs its own BAA
• Microsoft 365 third-party integrations — apps added through the Microsoft App Store each require their own BAA assessment
• Azure services — if your organization uses Azure separately (e.g., for AI or database workloads involving PHI), Azure has its own BAA under the Azure OST
• Your own policies — Microsoft provides compliant infrastructure; your organization must implement access controls, training, and audit log reviews