Is Microsoft 365 HIPAA compliant?
Microsoft 365 can be configured to support HIPAA, but the honest answer to "is Microsoft 365 HIPAA compliant" is that no cloud service is HIPAA compliant on its own. Microsoft's own wording is that there is currently no certification standard the Department of Health and Human Services approves to demonstrate compliance by a business associate; what Microsoft does is enter into Business Associate Agreements with its covered entity and business associate customers and adhere to the HIPAA Security Rule in its capacity as a business associate (Microsoft Learn, Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act, accessed 2026-10-20). Microsoft also states that having a BAA does not ensure compliance: the customer is responsible for an adequate compliance program and for using the services in a way that aligns with its HIPAA obligations (same source). EPC Group, a Houston-based Microsoft consulting firm, does the configuration half of that shared responsibility for covered entities and business associates.
What the Microsoft BAA covers and which services are in scope
The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates; the Azure HIPAA offering states that execution of the volume licensing agreement includes execution of the BAA, so there is no separate contract to sign (Microsoft Learn, HIPAA & HITECH Act; HIPAA (US), Azure compliance offering; both accessed 2026-10-20). Microsoft cannot sign a customer's own BAA, because its multitenant services run the same way for every customer (Microsoft Learn, HIPAA & HITECH Act, accessed 2026-10-20).
For Office 365 Commercial, Microsoft lists the in-scope services. The ones that matter most in a healthcare tenant are Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Microsoft Entra ID, Microsoft Defender for Office 365, the Microsoft Purview portal, Power BI, Power Apps, Power Automate, Forms, Planner, Stream, Microsoft Copilot and Microsoft Copilot Chat; Office 365 U.S. Government is in scope as a platform, and Azure, Azure Government, Dynamics 365, Intune and Windows 365 are in scope as well (Microsoft Learn, HIPAA & HITECH Act, accessed 2026-10-20). A service that is not on the list should not hold PHI until it is, and EPC Group checks the current list at the start of every engagement because Microsoft revises it.
How to configure Microsoft 365 for HIPAA
EPC Group's configuration work for a covered entity follows the Security Rule's administrative, physical and technical safeguards as the client has written them into policy, and maps each one to a Microsoft 365 control. The technical controls, in the order they are applied:
- Access control in Microsoft Entra ID. Multifactor authentication for every account, Conditional Access policies that block legacy authentication and require compliant devices for clinical and administrative applications, and time-bound privileged roles. Conditional Access requires a Microsoft Entra ID P1 license (Microsoft Learn, What is Conditional Access?, accessed 2026-10-20).
- Classification and encryption with sensitivity labels. A small label set, including a PHI label that applies encryption and content markings. Labels can restrict who opens content and what they can do with it, persist in file and email metadata, and can also protect containers such as Teams and SharePoint sites (Microsoft Learn, Learn about sensitivity labels, accessed 2026-10-20).
- Data loss prevention for PHI. DLP policies built from the predefined Medical and health data templates and tuned to the organization, deployed first in simulation mode, then set to block or block-with-override for email, SharePoint, OneDrive, Teams chat and endpoints; every monitored activity is written to the audit log (Microsoft Learn, Learn about data loss prevention, accessed 2026-10-20).
- Audit retention set to policy. The default retention for Audit (Standard) is 180 days; Audit (Premium) retains Exchange, SharePoint, OneDrive and Entra records for one year for E5-licensed users, and custom retention policies can extend to 10 years with the add-on license (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20). EPC Group matches the retention policy to the client's written retention period rather than leaving the default.
- Teams governance. Container labels that set privacy and external access for PHI teams, retention policies for Teams messages (Microsoft Learn, Data Residency for Microsoft Purview, accessed 2026-10-20), and DLP extended to chat and channel messages.
- Evidence. A control matrix that lists each Security Rule safeguard in the client's policy, the Microsoft 365 setting that implements it, the date it was configured and a dated export, so an auditor or an OCR investigator reads records rather than screenshots.
The identity, Defender and audit work sits in EPC Group's Microsoft 365 consulting practice; the classification, labeling and DLP design sits in its data governance consulting practice. Microsoft Purview Compliance Manager offers a premium assessment template for HIPAA that EPC Group uses to track control status during the engagement (Microsoft Learn, HIPAA & HITECH Act, accessed 2026-10-20).
Documented work
ANON-CASES: EPC Group engagement data in healthcare covers mid-size and large covered entities and business associates, including provider organizations and revenue-cycle firms, whose Microsoft 365 tenants EPC Group has configured for PHI. Client names are not published here, and engagements are described by industry and organization size only. No outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- What is Conditional Access? — Microsoft Learn, accessed 2026-10-20
- Manage audit log retention policies — Microsoft Learn, accessed 2026-10-20
- Microsoft Purview service description — Microsoft Learn, accessed 2026-10-20
- Learn about sensitivity labels — Microsoft Learn, accessed 2026-10-20
- Learn about data loss prevention — Microsoft Learn, accessed 2026-10-20
- HIPAA & HITECH Act — Microsoft Learn, accessed 2026-10-20
- Data Residency for Microsoft Purview — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
Does Microsoft sign a BAA and which services does it cover?
Yes. Microsoft offers a HIPAA Business Associate Agreement to covered entity and business associate customers through the Microsoft Products and Services Data Protection Addendum by default; there is no separate contract to sign. For Office 365 Commercial, in-scope services include Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Microsoft Entra ID, Microsoft Defender for Office 365, the Microsoft Purview portal, Power BI, Power Apps, Forms, Planner, Microsoft Copilot and Microsoft Copilot Chat, among others (Microsoft Learn, Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act, accessed 2026-10-20).
Which Microsoft 365 plans include the audit, retention and encryption features HIPAA needs?
Microsoft documents the feature-to-plan mapping rather than a single HIPAA plan. Conditional Access requires Microsoft Entra ID P1 (Microsoft Learn, What is Conditional Access?, accessed 2026-10-20). Audit retention beyond 180 days, up to one year, requires an Office 365 E5 or Microsoft 365 E5 license or a Purview Suite or E5 eDiscovery and Audit add-on; 10-year retention needs a further add-on (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20). Automatic sensitivity labeling requires Microsoft 365 E5 or Information Protection and Governance (Microsoft Learn, Microsoft Purview service description, accessed 2026-10-20).
How are PHI emails protected (encryption, DLP, sensitivity labels)?
Three layers. Sensitivity labels can encrypt email and documents, restrict who can open them, and persist in metadata (Microsoft Learn, Learn about sensitivity labels, accessed 2026-10-20). Purview DLP policies, including the predefined Medical and health data templates, can warn the sender, block the send with or without override, and record every match in the audit log (Microsoft Learn, Learn about data loss prevention, accessed 2026-10-20). Conditional Access controls which devices and users can reach the mailbox. EPC Group configures all three and tests them with sample PHI.
What audit logging and retention does HIPAA require and how is it configured?
HIPAA’s Security Rule requires audit controls (45 CFR 164.312(b)), but it does not name a specific log retention period; the covered entity sets it. In Microsoft 365, Purview Audit (Standard) retains records for 180 days, Audit (Premium) retains Exchange, SharePoint, OneDrive and Entra records for one year for E5-licensed users, and custom audit retention policies can extend to 10 years with the add-on license (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20). EPC Group sets the retention policy to the period in the client’s written HIPAA policy.
How does Teams handle PHI (recordings, chat retention, guest access)?
Microsoft Teams is listed among the Office 365 services in scope for the Microsoft BAA (Microsoft Learn, HIPAA & HITECH Act, accessed 2026-10-20). Retention policies for Teams messages are part of Purview Data Lifecycle Management (Microsoft Learn, Data Residency for Microsoft Purview, accessed 2026-10-20), and sensitivity labels applied to containers can set privacy, external user access and external sharing (Microsoft Learn, Learn about sensitivity labels, accessed 2026-10-20). EPC Group restricts guest access on PHI teams, applies retention to chat and recordings, and extends DLP to Teams messages.
Talk to a senior architect
If your organization is a covered entity or business associate and your Microsoft 365 tenant has never been configured against your written HIPAA policy, a 30-minute discovery call with a senior EPC Group architect will cover the BAA scope check, the control matrix and the order of work. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.