Is Microsoft OneDrive HIPAA compliant?
Checked 6 Nov 2026 from 1 vendor source
Microsoft lists OneDrive for Business as in scope for its HIPAA BAA, which is included by default in the Data Protection Addendum for customers who are covered entities or business associates. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| OneDrive for Business under Office 365 Commercial and GCC | Covered |
What the BAA leaves out
- Microsoft’s HIPAA page describes no coverage for consumer or personal OneDrive; it is simply not listed
How to get the BAA
No separate signing is described; Microsoft says the BAA applies by default through the Data Protection Addendum, and the text is in the Service Trust Portal.
What the vendor says to do
- Review the BAA in the Service Trust Portal
- Maintain your own compliance program and confirm your use aligns with HIPAA
- Microsoft points to the Purview Compliance Manager HIPAA assessment template for assessing risk
What we couldn’t confirm
Microsoft’s page doesn’t name license types or state a position on personal OneDrive.
Proof from the vendor
- HIPAA & HITECH Act: Microsoft ComplianceBAA by default in DPA; OneDrive for Business in the Office 365 Commercial and GCC scope table; customer duties
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.