Is Dynamics 365 HIPAA compliant?
Microsoft's CRM and business applications. Dynamics 365 is on Microsoft's list of in-scope services for its BAA, which is included by default for covered entities and business associates.
Microsoft Dynamics 365 signs a Business Associate Agreement. Dynamics 365 is listed among Microsoft's in-scope cloud services; the BAA comes by default through the Online Services Data Protection Addendum for covered entities and business associates.
A BAA alone does not make its use HIPAA compliant: you remain responsible for configuring it securely and covering it in your risk analysis.
Source: Microsoft — HIPAA & HITECH offering · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Yes | Microsoft — HIPAA & HITECH offering |
|---|
Limitations
- Microsoft signs only its standard BAA; check that each connected service (Power Automate, Power BI, add-ins) is also in scope. source
Against our criteria
| BAA without a sales process | Yes — Included by default in Microsoft's data protection terms. | Microsoft — HIPAA & HITECH offering |
|---|---|---|
| BAA on entry-level team plans | Not verified | Not verified yet |