The BAA covers the platform. It does not cover your broken permissions. Here is what you need to fix before Copilot touches PHI.
Microsoft signs a HIPAA BAA for M365 Copilot — but the BAA covers the platform, not your broken permissions. Before enabling Copilot for any clinical user, you must audit SharePoint permissions, classify PHI with sensitivity labels, and block unauthorized PHI access. EPC Group has deployed Copilot for 9 Houston healthcare systems under HIPAA BAA with zero PHI exposure events.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
Quick Answer: Yes, Microsoft Copilot for M365 is covered under Microsoft's Business Associate Agreement (BAA). Microsoft processes Copilot queries within the M365 compliance boundary and does not use your data to train foundation models. The BAA covers the platform. But the BAA does not cover your tenant configuration — and that is where every healthcare HIPAA violation with Copilot originates.
Healthcare CIOs often ask, “Is Copilot HIPAA compliant?” However, this question misses the main point. The real concern is, “Is our Microsoft 365 tenant configured to stop Copilot from revealing PHI to unauthorized users?”
For most healthcare organizations we audit, the answer is no.
Microsoft's BAA ensures that the platform's infrastructure meets HIPAA requirements. This includes:
However, Copilot uses the permissions of each individual user.
Copilot will expose that PHI to anyone who asks.
EPC Group has deployed M365 and Copilot for healthcare organizations for since 1997. Our Healthcare Copilot Safety Blueprint addresses the unique challenge of healthcare: protecting PHI while maintaining the data accessibility clinicians need for patient care.
The Core Problem: In healthcare tenant audits, EPC Group finds an average of 12-18 SharePoint sites containing PHI with overshared permissions. This means non-clinical staff — HR, finance, facilities, IT — can access patient records, lab results, and clinical documentation. Before Copilot, this was a latent risk. With Copilot, it becomes an active HIPAA violation the moment a non-clinical employee asks Copilot a question and it surfaces PHI from an overshared site.
The distinction is crucial from a legal perspective. Under HIPAA, a covered entity must implement appropriate administrative, physical, and technical safeguards for PHI.
The BAA identifies Microsoft as a business associate. This designation makes Microsoft responsible for platform-level safeguards.
However, tenant-level access controls are the responsibility of the covered entity. This includes:
When OCR investigates a PHI breach, they check if the covered entity has reasonable access controls in place. Simply stating, “We have a BAA with Microsoft,” does not prove that you limited PHI access to authorized users.
If Copilot shows patient records to a facilities manager with access to a clinical SharePoint site, this indicates a failure in your access controls. This issue does not stem from Microsoft’s platform.
Real Scenario: A hospital system with 3,000 employees deployed Copilot without conducting a permission audit. Within two weeks, an HR analyst used Copilot to research employee benefits. The response included patient treatment notes from a SharePoint site that was shared with “Everyone except external users.”
The site was created 4 years ago by a clinical department to allow quick collaboration. Unfortunately, the broad permissions were never revoked.
This oversight resulted in a HIPAA violation, which exposed 47 patient records.
Copilot searches across all M365 services available to a user. In healthcare, Protected Health Information (PHI) exists in every service. Permission gaps can lead to new exposure paths that were not present before Copilot.
Clinical case conferences, patient consultations, and care coordination meetings are automatically transcribed. Copilot indexes these transcriptions and can surface patient names, diagnoses, treatment plans, and medication discussions to any user with access to the Teams channel or meeting recording.
Restrict meeting recording access to meeting organizers and designated compliance staff. Implement sensitivity labels on clinical meeting recordings. Configure retention policies to auto-delete transcriptions after review period.
Patient records, lab results, imaging reports, and clinical documentation stored in SharePoint are fully searchable by Copilot. Sites with broken permission inheritance or "Everyone except external users" access grant organization-wide PHI exposure.
Audit all clinical SharePoint sites for permission inheritance breaks. Remove broad-scope permissions. Apply sensitivity labels with encryption. Implement site-level access reviews on a 90-day cycle.
Lab results, referral letters, insurance authorizations, and patient correspondence sent as email attachments are indexed by Copilot. Shared mailboxes used by clinical departments are particularly high-risk — Copilot can surface any attachment from a shared mailbox to any user with mailbox access.
Deploy DLP policies scanning email attachments for PHI patterns (MRN, SSN, diagnostic codes). Configure sensitivity labels for clinical email. Restrict shared mailbox access to authorized clinical staff only.
Physicians and clinical staff frequently store patient notes, care plans, and clinical documentation in OneDrive for convenience. If OneDrive sharing defaults are set to "People in your organization," these files become Copilot-accessible to everyone.
Change OneDrive sharing defaults to "Specific people" only. Deploy auto-labeling policies that detect PHI in OneDrive files. Configure DLP policies blocking broad sharing of PHI-containing documents.
Clinical staff discussing patients in Teams channels and chats creates searchable PHI. Copilot can surface these conversations when users ask questions about patients, cases, or clinical decisions — even if the user asking is in a non-clinical department with channel access.
Implement information barriers between clinical and non-clinical departments. Create dedicated clinical Teams channels with restricted membership. Deploy DLP policies scanning Teams messages for PHI patterns.
EPC Group's Healthcare Copilot Safety Blueprint improves our standard 47-Point Framework. It adds HIPAA-specific controls to address unique risks.
These additional checkpoints focus on:
Healthcare remediation faces unique challenges. Overly restricted access can hinder patient care. For example, if a clinical team loses access to shared documents during a shift, it may lead to patient safety issues.
EPC Group's healthcare approach ensures that:
Use Microsoft Purview data classification to scan all M365 services for PHI. Include custom healthcare content types such as:
Next, map every location where PHI is stored and identify who currently has access. This will create the baseline exposure map.
Before changing any permissions, confirm with clinical leadership the access needed for care delivery. It is important to map data flows between departments, including:
Identify the minimum access required for each role. This helps avoid the common issue of disrupting clinical workflows during remediation.
Implement permission changes in stages. Start with non-clinical sites such as HR, finance, and facilities. These areas have a lower risk to patient safety.
Deploy Copilot to 50-100 users in clinical and administrative departments. Monitor usage logs to find patterns of PHI exposure.
Ensure that information barriers are effective in preventing cross-department PHI leakage.
Refine DLP policies based on actual Copilot usage. Document evidence of HIPAA compliance to prepare for OCR readiness.
700+
M365 Tenants Secured
29
Years Microsoft Expertise
100%
HIPAA Audit Pass Rate
EPC Group's healthcare practice includes:
We recognize that healthcare IT goes beyond security. It is essential for helping clinicians provide patient care while safeguarding the data created during that care.
Our HIPAA-Compliant Microsoft 365 Deployment Guide provides the complete framework for healthcare organizations deploying or securing M365 — from initial configuration through Copilot enablement. The Healthcare Copilot Safety Blueprint is an extension of this proven methodology, adapted for the specific risks that AI-powered search introduces to PHI-containing environments.
Yes — Microsoft Copilot for M365 is covered under Microsoft's Business Associate Agreement (BAA), which is a prerequisite for HIPAA compliance. However, the BAA only covers the platform, not your configuration. If your M365 tenant has overshared SharePoint sites containing patient records, broken permission inheritance exposing PHI, or Teams meeting recordings with clinical discussions, Copilot will surface that data to any user with access — creating HIPAA violations regardless of the BAA. HIPAA compliance requires both the BAA (platform) and proper tenant configuration (your responsibility).
Copilot can access any data that the user querying it has access to — including PHI stored in SharePoint, OneDrive, Exchange, and Teams. If a non-clinical employee has been inadvertently granted access to a SharePoint site containing patient records (a common finding in healthcare tenant audits), Copilot will surface that PHI in response to their queries. The risk is amplified because Copilot makes data discovery effortless — users don't need to know where PHI is stored or navigate to it. A simple prompt like "summarize recent patient discussions" could surface PHI from Teams meetings, emails, and documents across the entire tenant.
The top PHI exposure risks from Copilot in healthcare environments are: 1) Teams meeting recordings — clinical case discussions, patient consultations, and care coordination meetings are transcribed and searchable by Copilot, 2) SharePoint medical records — patient data stored in SharePoint libraries with overshared permissions becomes Copilot-accessible, 3) Email attachments — lab results, referral letters, and insurance documents attached to emails are indexed by Copilot, 4) OneDrive clinical notes — physicians storing patient notes in OneDrive create PHI exposure if sharing settings are misconfigured, 5) Teams chat — clinical staff discussing patients in Teams channels creates searchable PHI that Copilot can surface to anyone with channel access.
EPC Group's Healthcare 47-Point Checklist extends our standard framework with HIPAA-specific controls: PHI data classification scan across all M365 services, information barriers between clinical and administrative departments, sensitivity labels for PHI content with auto-labeling, DLP policies preventing PHI in Copilot-generated outputs, Teams meeting recording policies restricting clinical meeting transcription access, SharePoint site-level permissions audit for all clinical sites, guest access review (vendors, contractors, referring physicians), audit logging for Copilot queries that return PHI, HIPAA-specific retention policies for clinical content, and BAA validation for all M365 services in use.
Healthcare organizations typically require 12-20 weeks for HIPAA-compliant Copilot deployment: Weeks 1-3 for the 47-Point Security Assessment with healthcare overlay, Weeks 4-10 for PHI-specific remediation (permission fixes, sensitivity labels, DLP policies, information barriers), Weeks 11-14 for controlled pilot with clinical champions (50-100 users from both clinical and administrative departments), and Weeks 15-20 for phased department rollout with HIPAA-specific training. This is 50-75% longer than non-healthcare deployments because PHI remediation requires clinical workflow validation — you cannot restrict access to data that clinicians need for patient care.
EPC Group has deployed Microsoft 365 and Copilot for healthcare organizations including hospital systems, health insurance providers, clinical research organizations, and medical device companies. Our healthcare practice has HIPAA compliance experience across 700+ tenant engagements since 1997. We understand the unique challenge of healthcare: balancing data accessibility for patient care with PHI protection for HIPAA compliance. Our Healthcare Copilot Safety Blueprint includes PHI-specific data classification, clinical workflow analysis, and department-level information barriers that protect PHI without disrupting care delivery.
EPC Group offers Copilot & M365 Tenant Security Reviews for businesses across all industries. We have secured more than 700 tenants and have Microsoft experience since 1997. Our aim is to identify what Copilot can access that it should not.
Our Healthcare Copilot Safety Blueprint includes PHI-specific data classification, clinical workflow validation, and HIPAA compliance documentation. Start with the 47-Point Security Review ($15,000).
Microsoft has signed a HIPAA BAA for M365 Copilot. This BAA only covers the platform and does not resolve your current permission issues.
Before enabling Copilot for any clinical user, you must:
EPC Group has successfully deployed Copilot for 9 Houston healthcare systems under the HIPAA BAA, with zero PHI exposure events.
Microsoft's HIPAA Business Associate Agreement applies to the M365 platform. However, it does not cover how you configure permissions.
If a nurse can see an orthopedic surgeon's patient list because of a missed SharePoint permission, Copilot will show that information when the nurse asks a general question.
The BAA is necessary. It is not sufficient. The permissions work is yours to do before any Copilot license goes live.
The risk: Clinical discussions, patient case reviews, and M&A strategy meetings are recorded in Teams. These recordings are stored in OneDrive. Any user with access to that OneDrive folder can request Copilot to summarize the recording.
Mitigation:
The risk: Medical record libraries might have broken permission inheritance. This issue can allow clinical staff who are not part of the intended care team to gain access. Additionally, Copilot shows this content when any authorized user searches for related topics.
Mitigation:
The risk: PHI shared as email attachments in Outlook is indexed by Copilot. Clinical staff can ask Copilot to summarize these attachments. This can occur even if the attachments were not intended for wide access.
Mitigation:
The risk: Clinicians store patient notes in personal OneDrive folders, sometimes using shared-with-everyone links for quick access. Copilot indexes these files across the tenant.
Mitigation:
The risk: Clinical Teams chats containing patient information are searchable by Copilot across the tenant. A user in a different department can ask Copilot to summarize recent clinical discussions.
Mitigation:
Yes, Microsoft signs a HIPAA BAA for M365 Copilot when it is properly configured. This BAA applies to the platform. However, healthcare organizations must take several steps before enabling Copilot for clinical users:
Yes, Copilot can access any content that the user is allowed to view. This includes:
If permissions are not set correctly, Copilot may show PHI to users who should not have access.
There are five main PHI exposure vectors:
EPC Group's four-phase process lasts 11–14 weeks. The phases are as follows:
Yes. EPC Group has successfully deployed M365 Copilot for 9 healthcare systems in Houston. This was done under HIPAA BAA, with zero PHI exposure events.
Additionally, we have secured over 700 Microsoft 365 tenants for Copilot deployment across the nation.
EPC Group's healthcare Copilot team covers permissions, PHI classification, clinical workflow validation, and HIPAA audit documentation. Call (888) 381-9725 or schedule a healthcare Copilot readiness review.
AI assistant — not human