OneDrive for Business (Microsoft 365): HIPAA status
Microsoft's business file storage. OneDrive for Business is an in-scope service under the Microsoft HIPAA BAA included in Microsoft 365 business terms.
Signs a BAAYes
OneDrive for Business (Microsoft 365) signs a Business Associate Agreement. OneDrive for Business is listed among in-scope Office 365 services; the BAA is included by default for covered entities and business associates.
Source: Microsoft — HIPAA & HITECH offering (Office 365 in-scope services) · checked
OneDrive for Business (Microsoft 365) and HIPAA at a glance
OneDrive for Business (Microsoft 365) signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you remain responsible for configuring it securely and covering it in your risk analysis. Facts checked against Microsoft's own documentation on 2026-10-06.
| Signs a BAA | Yes |
|---|---|
| How you get it | OneDrive for Business is listed among in-scope Office 365 services; the BAA is included by default for covered entities and business associates. |
| Main limitation | Applies to OneDrive for Business under a Microsoft 365 business subscription, not personal OneDrive. |
| Last checked | 2026-10-06 |
BAA details
Limitations
- Applies to OneDrive for Business under a Microsoft 365 business subscription, not personal OneDrive. source
- Covered under Microsoft's standard BAA only; Microsoft does not sign customers' own BAA forms. source
Against our criteria
| BAA without a sales process | Yes — Included in standard licensing terms. | Microsoft — HIPAA & HITECH offering (Office 365 in-scope services) |
|---|---|---|
| BAA on entry-level team plans | Yes — Included with Microsoft 365 business plans. | Microsoft — HIPAA & HITECH offering (Office 365 in-scope services) |