Is Microsoft Forms HIPAA compliant?
Microsoft's form and survey tool in Microsoft 365. Forms is on Microsoft's list of services covered by its BAA, which is included by default for covered entities and business associates.
Microsoft Forms signs a Business Associate Agreement. Forms is listed among the in-scope Office 365 services; Microsoft's BAA comes by default through the Online Services Data Protection Addendum for covered entities and business associates.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Microsoft — HIPAA & HITECH offering · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Yes | Microsoft — HIPAA & HITECH offering |
|---|
What you still have to configure
- Confirm each Microsoft 365 service you connect to the form — for example a SharePoint list or Power Automate flow — is on Microsoft's in-scope list. source
Limitations
- The BAA covers Microsoft's enterprise online services for covered entities and business associates, not personal Microsoft accounts; Microsoft signs only its standard BAA. source
Against our criteria
| BAA without a sales process | Yes — Included by default in Microsoft's data protection terms; nothing to request. | Microsoft — HIPAA & HITECH offering |
|---|---|---|
| BAA on entry-level team plans | Yes — The BAA is available by default to all customers who are covered entities or business associates, and Forms is in scope for commercial Office 365. | Microsoft — HIPAA & HITECH offering |
Alternatives
- Cognito Forms →BAA: conditional
- Formstack Forms →BAA: conditional
- Google Forms →BAA: yes
- IntakeQ →BAA: yes
- Jotform →BAA: conditional
- Typeform →BAA: conditional