Is Microsoft Copilot HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Microsoft includes its BAA by default in the Online Services Data Protection Addendum for covered entities and business associates, and lists Microsoft Copilot and Copilot Chat as in scope for organizational use, excluding web search queries. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Copilot Health: Microsoft calls it a direct-to-consumer wellness product and says HIPAA doesn’t apply to most such products | Not covered |
| Microsoft Copilot licensed by an organization (Commercial and GCC Office 365 environments) | Covered |
| Microsoft Copilot Chat for organizations signed in with Microsoft Entra accounts (Commercial and GCC) | Covered |
What the BAA leaves out
- Web search queries, which Microsoft says are outside the DPA and BAA
- Anthropic models labeled with Data Retention, which fall outside the Product Terms and DPA (page does not mention HIPAA)
- Third-party agents are subject to their own terms; review each one
How to get the BAA
No separate signing is described: Microsoft says the BAA is available by default through its Data Protection Addendum, now titled Products and Services DPA, to covered entities and business associates.
What the vendor says to do
- Use work or school Microsoft Entra accounts so enterprise data protection applies
- Microsoft says support depends on a properly configured implementation; it did not list steps on the pages read
What we couldn’t confirm
Microsoft doesn’t state directly that consumer Copilot sits outside its BAA. Ask Microsoft to confirm your exact product and license.
Proof from the vendor
- HIPAA and HITECH ActBAA through DPA by default, Copilot and Copilot Chat listed in scope, compliance remains customer responsibility
- Enterprise data protection in Microsoft 365 Copilot and Copilot ChatCopilot supports HIPAA for properly configured implementations, web search queries excluded
- What is Microsoft Copilot? FAQEntra sign-in gets enterprise data protection; Copilot Chat supports BAA for prompts and responses, not web search
- Claude models from Anthropic in Microsoft Online ServicesModels labeled Data Retention are outside Product Terms and DPA
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.