Is Microsoft 365 Copilot HIPAA compliant?
Microsoft's AI assistant in Microsoft 365 and Copilot Chat for work accounts. Both are included in Microsoft's HIPAA/HITECH offering under its BAA for eligible customers — which does not by itself make a customer's use compliant.
Microsoft 365 Copilot signs a Business Associate Agreement only under specific conditions. Microsoft Copilot and Microsoft Copilot Chat are listed as in-scope services for Microsoft's HIPAA BAA, which is part of its standard licensing terms.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Microsoft Learn — HIPAA/HITECH Act (in-scope cloud services) · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Microsoft Learn — HIPAA/HITECH Act (in-scope cloud services) |
|---|---|---|
| Plans that include a BAA | Commercial and GCC Microsoft 365 plans with Copilot | Microsoft Learn — HIPAA/HITECH Act (in-scope cloud services) |
What you still have to configure
- Use Copilot only with work (Entra ID) accounts covered by your Microsoft licensing and BAA. source
Limitations
- Consumer Copilot used with personal Microsoft accounts is not covered. source
- Copilot can surface any data a user can already access — review permissions and sharing before rollout. source
Against our criteria
| BAA without a sales process | Yes — Included in Microsoft's licensing terms. | Microsoft Learn — HIPAA/HITECH Act (in-scope cloud services) |
|---|---|---|
| Covers a ready-to-use chat app | Yes — Microsoft Copilot and Copilot Chat. | Microsoft Learn — HIPAA/HITECH Act (in-scope cloud services) |
Alternatives
- Amazon Bedrock →BAA: yes
- Azure OpenAI (Microsoft Foundry) →BAA: yes
- BastionGPT →BAA: yes
- ChatGPT (Free, Go, Plus, Pro and Business) →BAA: no
- ChatGPT for Clinicians →BAA: conditional
- ChatGPT for Healthcare and Enterprise →BAA: conditional
- Claude (Anthropic) →BAA: conditional
- CompliantChatGPT →BAA: yes
- Gemini in Google Workspace →BAA: conditional
- Google Cloud Vertex AI and Gemini Enterprise →BAA: yes
- OpenAI API →BAA: conditional