Is Microsoft Forms HIPAA compliant?
Checked 6 Nov 2026 from 1 vendor source
Microsoft lists Forms in the Office 365 Commercial and GCC scope table for its HIPAA BAA, which is included by default in the Data Protection Addendum for covered entities and business associates. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Forms under Office 365 Commercial and GCC | Covered |
How to get the BAA
No separate signing is described; Microsoft says the BAA applies by default through the Data Protection Addendum, and the text is in the Service Trust Portal.
What the vendor says to do
- Review the BAA in the Service Trust Portal
- Maintain your own compliance program and confirm your use aligns with HIPAA
What we couldn’t confirm
Microsoft’s page doesn’t name license types and doesn’t address Forms used with a personal account.
Proof from the vendor
- HIPAA & HITECH Act: Microsoft ComplianceBAA by default in DPA; Forms in the Office 365 Commercial and GCC scope table
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.