All tools / Video and messaging
Is Microsoft Teams HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Microsoft includes its HIPAA BAA by default through its Data Protection Addendum for covered entity and business associate customers, and lists Teams as in scope for Office 365 Commercial and GCC. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Microsoft Teams under Office 365 Commercial | Covered |
| Microsoft Teams under Office 365 GCC | Covered |
What the BAA leaves out
- Copilot web search queries are outside the DPA and BAA
How to get the BAA
No separate signature is described; the BAA is included by default through the Microsoft Online Services Data Protection Addendum, and customers cannot substitute their own BAA.
What we couldn’t confirm
Microsoft’s page doesn’t list license tiers and doesn’t address free Teams. We couldn’t read the standalone BAA.
Proof from the vendor
- HIPAA and HITECH, Microsoft ComplianceBAA delivered by default through the DPA; Teams in scope for Commercial and GCC; own BAA not accepted (visible date 2025-07-29)
- Enterprise data protection in Microsoft Copilot and Copilot ChatWeb search queries are not covered by the DPA and BAA
- How do make Teams HIPAA Compliant? Microsoft Q&AForum reply only, not policy; used as a lead, not as evidence for the plan lists
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.