Microsoft includes its HIPAA BAA by default through its Data Protection Addendum for covered entity and business associate customers, and lists Exchange Online as in scope for Office 365 Commercial and GCC. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Exchange Online under Office 365 Commercial | Covered |
| Exchange Online under Office 365 GCC | Covered |
What the BAA leaves out
- Copilot web search queries are outside the DPA and BAA
How to get the BAA
No separate signature is described; the BAA is included by default through the Microsoft Online Services Data Protection Addendum, and customers cannot substitute their own BAA.
What we couldn’t confirm
Microsoft’s page names Exchange Online, not Outlook, and doesn’t list license tiers or address Outlook.com. We couldn’t read the standalone BAA.
Proof from the vendor
- HIPAA and HITECH, Microsoft ComplianceBAA delivered by default through the DPA; Exchange Online in scope for Commercial and GCC (visible date 2025-07-29)
- Enterprise data protection in Microsoft Copilot and Copilot ChatWeb search queries are not covered by the DPA and BAA
- What plan is used for an email for Outlook? Microsoft Q&AForum reply only, not policy; used as a lead, not as evidence for plan lists
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.