Last verified: October 2026, against Microsoft Learn's HIPAA compliance page, SharePoint admin documentation and Microsoft's consumer Services Agreement. General information, not legal advice — confirm with your compliance officer or attorney.
Is SharePoint HIPAA compliant? SharePoint Online, OneDrive for Business, Exchange Online and Teams are all covered by Microsoft's business associate agreement (BAA) on commercial Microsoft 365 subscriptions, and that BAA applies by default. What Microsoft can't do is set your sharing and email rules, and the defaults are built for collaboration, not for patient files.
Is Microsoft 365 HIPAA compliant? Microsoft's own answer
Short answer (verified October 2026): Microsoft's HIPAA compliance page (opens in a new tab) says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." For commercial Office 365, in-scope services include Exchange Online, Forms, Microsoft Teams, OneDrive for Business, SharePoint Online, Microsoft Copilot and Copilot Chat. Asked whether the BAA ensures compliance, Microsoft answers: "No... using Microsoft services doesn't on its own achieve HIPAA compliance."
Two more lines from the same page matter. Microsoft offers BAAs for "Microsoft enterprise products and services," and it "can't use a customer's Business Associate Agreement," so you sign on to Microsoft's terms, not yours.
For context: "is sharepoint hipaa compliant" gets about 210 searches a month in the US, at a CPC of $7.27 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
Microsoft's role is the "maintain" in HIPAA's "create, receive, maintain, or transmit": it holds your mail and files (45 CFR 164.502(e) (opens in a new tab)). That requires "satisfactory assurance," "documented through a written contract" whose required terms, from safeguards to breach reporting, are listed in 45 CFR 164.504(e) (opens in a new tab). Microsoft's Data Protection Addendum supplies that contract. See our guide to business associate agreements.
Microsoft's default BAA solves the contract. It doesn't solve configuration: a SharePoint folder of referral letters shared through an "Anyone" link is covered by the BAA and still an impermissible disclosure waiting to happen.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which Microsoft 365 plans a BAA can cover
| Account type | Governed by | BAA? |
|---|---|---|
| Commercial Microsoft 365 or Office 365 subscription | Microsoft's Data Protection Addendum | Yes, by default, for in-scope services |
| Microsoft 365 Personal, Family or Premium | Consumer Microsoft Services Agreement (opens in a new tab) | No: the agreement doesn't mention HIPAA or a BAA |
| Free Outlook.com or consumer OneDrive | Same consumer agreement | No |
The consumer agreement (effective September 30, 2026) names Microsoft 365 Personal, Family and Premium, Outlook.com and OneDrive storage. None of it is part of your practice's tenant, so a doctor's personal Outlook.com address is outside the BAA even if the practice pays for Microsoft 365.
Safe uses and unsafe uses for a practice
| Use | Safe? | Condition |
|---|---|---|
| Patient files in a restricted SharePoint site | Yes | Commercial plan; sharing off or guests only |
| Referral packets shared with a partner | Yes | "Specific people" link to a work address |
| Patient email from Exchange Online | Yes | Encryption for outside recipients |
| Copilot Chat over files with PHI | Covered service | Staff training; same access rules |
| PHI in a personal Outlook.com or OneDrive | No | Consumer agreement; no BAA |
| "Anyone" links to clinical folders | No | Unauthenticated access |
Safer setup or alternatives
- Confirm your subscription is commercial, and that every staff account lives in the practice tenant.
- Build one restricted SharePoint site for clinical files, set to "Only people in your organization."
- Set "Specific people" as the default link and domain-limit external sharing.
- Turn on email encryption rules for messages to patients and outside partners.
- Review guests and sharing every quarter.
If your team already lives in Google, Google lists Gmail and Google Drive among the services in its BAA (Google (opens in a new tab)); see our gmail page. For every other tool on the front desk, start at HIPAA and everyday tools.
Medfy doesn't replace Microsoft 365. It runs the patient-facing website, where form and chat submissions land in an access-controlled patient CRM and inbox, stored in separate, encrypted HIPAA databases in the US or Canada. Medfy signs a BAA with each practice for its own services; see how Medfy handles patient data. A free marketing audit checks the website side, including tracking pixels on patient forms.
Frequently asked questions
Will Microsoft 365 sign a BAA?
Yes, automatically, for commercial subscriptions. As of October 2026, Microsoft says its HIPAA BAA is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates. In-scope services include Exchange Online, SharePoint Online, OneDrive for Business, Teams and Forms. Microsoft won't sign your own BAA form instead. Confirm your subscription type with your compliance officer or attorney.
Is the free version of Microsoft 365 HIPAA compliant?
No. Free Outlook.com and OneDrive, and Microsoft 365 Personal, Family and Premium, run under Microsoft's consumer Services Agreement, which doesn't mention HIPAA or a BAA. Microsoft's BAA comes through the Data Protection Addendum for its enterprise services. Patient email and files belong in a commercial Microsoft 365 or Office 365 subscription, set up by an admin, never in staff members' personal accounts.
Can a practice use Microsoft 365 without patient information?
Yes, but on a commercial subscription you rarely need to. The BAA comes by default, so the more useful question is which parts of the tenant should hold PHI. Keep patient files in restricted SharePoint sites and OneDrive folders, and use open sharing only for sites with no patient information, such as marketing materials or staff schedules.
What is a HIPAA-compliant alternative to Microsoft 365?
Google Workspace is the usual alternative: Google lists Gmail and Google Drive among the services in its BAA, which an administrator accepts in the Admin console. Either suite only works with the right settings, such as restricted sharing and encrypted email to patients. Pick the one your team already knows, then confirm the setup with your compliance officer or attorney.