hipaa.systems
AI models and chat assistants · Microsoft

Azure OpenAI (Microsoft Foundry): HIPAA status

OpenAI models hosted in Microsoft Azure. Microsoft's HIPAA BAA is part of its standard licensing terms for customers who are covered entities or business associates.

BAA YesFacts 6Oldest check 2026-10-06
Visit Microsoft
Signs a BAAYes

Azure OpenAI (Microsoft Foundry) signs a Business Associate Agreement. Included by default via the Microsoft Products and Services Data Protection Addendum for in-scope Azure services; no separate contract to sign.

Source: Microsoft — HIPAA (Azure compliance offering) · checked

Azure OpenAI (Microsoft Foundry) and HIPAA at a glance

Azure OpenAI (Microsoft Foundry) signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you still need to confirm each Azure service you use is in scope for the HIPAA BAA (Microsoft Azure Compliance Offerings, appendices A–B), and host data in appropriate U.S. regions and configure encryption and access controls. Facts checked against Microsoft's own documentation on 2026-10-06.

Signs a BAAYes
How you get itIncluded by default via the Microsoft Products and Services Data Protection Addendum for in-scope Azure services; no separate contract to sign.
You still need toConfirm each Azure service you use is in scope for the HIPAA BAA (Microsoft Azure Compliance Offerings, appendices A–B).
Main limitationMicrosoft does not inspect or approve your application; compliance of what you build remains your responsibility.
Last checked2026-10-06

BAA details

Signs a BAAYesMicrosoft — HIPAA (Azure compliance offering)

What you still have to configure

  1. Confirm each Azure service you use is in scope for the HIPAA BAA (Microsoft Azure Compliance Offerings, appendices A–B). source
  2. Host data in appropriate U.S. regions and configure encryption and access controls. source

Limitations

  • Microsoft does not inspect or approve your application; compliance of what you build remains your responsibility. source

Against our criteria

BAA without a sales processYes — Included in standard licensing terms.Microsoft — HIPAA (Azure compliance offering)
Covers a ready-to-use chat appNo — Model API — you build the application.Microsoft — HIPAA (Azure compliance offering)

Alternatives