Is Microsoft 365 HIPAA Compliant? A Configuration Review

Microsoft 365 can support HIPAA workflows when Microsoft’s BAA covers your organization, PHI stays in in-scope services, and your tenant is configured to match your safeguards. Microsoft says that using its services “doesn’t on its own achieve HIPAA compliance.” See its HIPAA offering page.

If you are a practice manager or outsourced IT provider and the organization already runs on Microsoft 365, ask a narrower question. Which settings in this tenant could let protected health information (PHI) reach the wrong person, and what evidence shows someone reviewed them?

How does Microsoft offer its BAA?

Microsoft says its HIPAA BAA is available by default, through its Data Protection Addendum, to customers who are covered entities or business associates. It also says it cannot sign a customer’s own BAA form, because its multitenant services operate the same way for every customer.

Download the current HIPAA BAA from the Service Trust Portal and file it with the date you reviewed it. Our cloud vendor BAA guide covers what else to read for, including subcontractors, incident reporting, and termination.

Which Microsoft 365 services are in scope?

Microsoft’s HIPAA page lists in-scope services by cloud environment. For the commercial cloud, the list includes Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Microsoft Entra ID, Microsoft Defender for Office 365, Forms, Microsoft Copilot, and Microsoft Copilot Chat, among others.

Three cautions keep that list from being overread:

• Scope is per service. A feature available in your tenant is not automatically on the list. Check each tool staff will use against the current page.
• Consumer accounts are a different environment. The list names business services such as OneDrive for Business. Consumer services such as Outlook.com and personal OneDrive accounts do not appear on it.
• Third-party apps bring their own terms. Teams apps, Outlook add-ins, and Copilot agents from other publishers need a separate review. Microsoft tells admins to check an agent’s privacy statement and terms of use to see how it handles organizational data.

Who is responsible for which settings?

HHS cloud computing guidance treats a cloud provider that maintains ePHI as a business associate, and it still expects the customer to meet its own HIPAA obligations. The guidance encourages written terms that spell out how each party handles Security Rule responsibilities.

In practice, Microsoft runs the service. Your organization decides who gets accounts, what can be shared externally, how long content is kept, and who reviews activity. Those decisions sit under standards you own. 45 CFR 164.308 covers risk analysis and information system activity review. 45 CFR 164.312 covers access control, audit controls, authentication, and transmission security. Note which standard each setting below supports, so your risk analysis can point to the evidence.

What should the configuration review cover?

Use this suggested worksheet and adapt it to your licenses, workflows, and risk analysis.

Exchange Online

Microsoft Purview Message Encryption offers Encrypt-only and Do Not Forward options, and admins can apply encryption automatically with mail flow rules. Gmail and similar recipients get a link to an encrypted message portal. Send a synthetic test message to an outside account and confirm what the recipient sees.

Check external auto-forwarding next. Microsoft says the default Automatic - System-controlled value can behave differently depending on the organization’s history. It recommends setting the outbound spam policy to On or Off explicitly. Turning it off disables inbox rules and admin forwarding to external addresses, but internal forwarding is unaffected. Also review the auto-forwarded messages report: a rule sending a billing mailbox to a personal address runs until a policy or admin stops it. For the wider mailbox workflow, use the HIPAA email guide.

SharePoint and OneDrive

An Anyone link opens a file without sign-in. If your organization allows these links, Microsoft lets admins require them to expire and limit them to view-only. The OneDrive setting can be more restrictive than SharePoint but never more permissive. Turning external sharing off and back on restores guest access, so restrict specific sites first if guests should not return. The HIPAA file sharing guide covers the recipient and revocation tests.

Teams

Guest access in Teams is an organization-wide setting. It also depends on settings in Entra ID, Microsoft 365 Groups, and SharePoint. A guest who leaves a team still has a guest account in your directory until an admin removes it.

Microsoft says meeting recordings and transcripts save to the organizer’s OneDrive for most meetings, or to the channel’s SharePoint site for channel meetings. External participants get no access unless someone shares the file with them. Decide whether clinical or billing calls may be recorded at all, and how long the files are kept.

In the Teams admin center, use org-wide app settings to decide whether staff can install third-party apps. Each app’s details page links to the developer’s terms of use and privacy policy.

Entra ID

Security defaults require MFA registration for all users and MFA for administrators, and they block legacy authentication protocols, at no extra cost. Conditional Access allows more customization but requires at least Microsoft Entra ID P1. If you replace security defaults, confirm the replacement policies cover the same protections. Microsoft also recommends fewer than five Global Administrators and two emergency access accounts.

Audit logs and retention

Microsoft says Audit (Standard) records are kept for 180 days by default. Longer retention depends on licensing. With qualifying E5-level licenses, a default policy keeps Exchange, SharePoint, OneDrive, and Entra records for one year. An add-on extends retention up to 10 years. The license of the user who performs an activity determines how long its record is kept. Keeping logs is not the same as reviewing them. Name a reviewer, pick an interval, and record each review.

Purview retention policies and labels can retain, delete, or retain and then delete content across Exchange, SharePoint, OneDrive, Teams, and Copilot interactions. Retention wins over deletion, and the longest retention period wins. Have the records owner set the schedule before anyone configures it; our HIPAA retention guide explains why six years is not a universal answer.

How should Copilot fit the review?

Microsoft Copilot and Copilot Chat appear on Microsoft’s in-scope list. Microsoft says Copilot only surfaces content a user has at least view permission for, and it tells admins to keep SharePoint permissions accurate. A folder that was overshared but hard to find becomes one prompt away. Fix permissions before rollout.

Two settings need a deliberate decision:

• Web search. Copilot can send generated queries to Bing. Microsoft states that the DPA does not apply to those queries and that HIPAA compliance doesn’t apply to generated search queries. Admins can control web search with the Allow web search in Copilot policy.
• AI subprocessors. Microsoft enables Anthropic models by default for most commercial customers outside the EU, EFTA, and UK, under its Product Terms and DPA. Models labeled “with Data Retention” are the exception. They are off by default and fall under Anthropic’s own terms.

Write down whether staff may include PHI in prompts, which settings support that decision, and the date you checked Microsoft’s documentation.

What about personal accounts and departing staff?

Some staff may have personal Microsoft accounts signed in on the same devices they use for work. Make the rule explicit: PHI stays in the organization’s work account. A personal OneDrive sync folder or a personal Outlook.com address falls outside the reviewed environment.

For departures, Microsoft says blocking sign-in or removing a license does not start OneDrive cleanup. Deleting the user does. By default, the manager then gets access for a retention period that defaults to 30 days, and Purview retention settings take precedence. Confirm a successor has the files before deletion, remove forwarding rules, and revoke active sessions. Use the offboarding checklist for the steps outside Microsoft 365.

Compare the administration burden

If this review spans several admin centers, owners, and license decisions, request a healthcare pilot to compare the same configuration review in IRONKEEP. MAIL, DRIVE, DOCS, CHAT, and MEETINGS share one identity, audit, retention, and legal hold layer, and you can use IRONKEEP MFA or connect Entra through SAML or OIDC. Bring the completed worksheet and one synthetic workflow, such as a referral handoff, so the comparison uses the same checks. IRONKEEP is in private beta, and it signs a BAA during onboarding when it will handle ePHI for your organization.

If the review shows Microsoft 365 already fits your workflows, closing the gaps you found may be all you need.

Keep the review current

Save the completed worksheet with the BAA, the in-scope service list, and the date of each check. Repeat the review when you add a service, change licenses, or enable a new AI feature, because Microsoft renames features and changes defaults. Add any new location for PHI to your ePHI inventory.