Is Microsoft Azure HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Microsoft makes its HIPAA BAA available by default through the Product Terms to customers who are covered entities or business associates, for in-scope Azure services. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access.
| Plan or product | BAA |
|---|---|
| Azure | Covered |
| Azure Government | Covered |
What the BAA leaves out
- Azure services not listed as in scope
- Microsoft will not sign a customer’s own BAA form; its standard BAA applies
How to get the BAA
No separate contract is needed; Microsoft says the BAA applies by default through the Product Terms and Data Protection Addendum, and the text can be reviewed in the Service Trust Portal.
What the vendor says to do
- Confirm each service against Microsoft’s Cloud services in audit scope list
- Review the BAA in the Service Trust Portal
- Maintain your own compliance program; Microsoft does not inspect or approve deployed applications
Proof from the vendor
- HIPAA: Azure ComplianceBAA via Product Terms by default, Azure and Azure Government, customer duties, standard BAA only
- HIPAA & HITECH Act: Microsoft ComplianceBAA in Data Protection Addendum, Service Trust Portal location, Azure in-scope listing
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.