Is SharePoint HIPAA compliant?
Checked 6 Nov 2026 from 1 vendor source
Microsoft lists SharePoint Online as in scope for its HIPAA BAA, which is included by default in the Data Protection Addendum for customers who are covered entities or business associates. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| SharePoint Online under Office 365 Commercial and GCC | Covered |
How to get the BAA
No separate signing is described; Microsoft says the BAA applies by default through the Data Protection Addendum, and the text is in the Service Trust Portal.
What the vendor says to do
- Review the BAA in the Service Trust Portal
- Maintain your own compliance program and confirm your use aligns with HIPAA
- Microsoft points to the Purview Compliance Manager HIPAA assessment template for assessing risk
What we couldn’t confirm
Microsoft’s page doesn’t name license types and doesn’t address SharePoint Server on your own hardware.
Proof from the vendor
- HIPAA & HITECH Act: Microsoft ComplianceBAA by default in DPA; SharePoint Online in the Office 365 Commercial and GCC scope table; customer duties
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.