Is Microsoft Teams HIPAA compliant? Teams, OneDrive and the BAA

Short answer (dated) from Microsoft's compliance documentation

There is no separate BAA form to request for these services. Your obligations start where Microsoft's end: who can see what, who can join, and what gets recorded.

Business plans vs personal Microsoft accounts

Microsoft says it signs BAAs to support customers "utilizing Microsoft enterprise products and services." The scope list is precise, so read the names.

Bookings deserves a note. Microsoft now steers virtual appointments to it, yet it isn't named on the HIPAA list. Ask Microsoft in writing before putting patient details into booking questions.

The common slip is a clinician who starts a "quick" Teams call from a personal Microsoft account on a home laptop. That call is outside the BAA.

Teams chats and channels with patient details

A BAA permits PHI in Teams; it doesn't decide who reads it. HIPAA's minimum necessary standard still applies to every message.

• Private channels or care-team group chats for clinical coordination. A practice-wide channel isn't the place for a patient's lab result.
• Neutral names. "Front desk", "Billing", "Dr. Patel's team". Never a patient's name in a team, channel or chat title.
• Know your guests. Microsoft's guest and external access article (opens in a new tab) says a guest "can be given nearly all the same Teams capabilities as a native team member," including files. Review each team's guest list quarterly.
• External access is on by default. It lets staff chat and call people outside your organization, and admins can control whether users talk to Teams accounts "not managed by an organization." Turn that off unless you need it.
• Copilot reads what users can read. Before switching it on, see Copilot in Microsoft 365.

External guests and video visits in Teams

Microsoft's appointments page (opens in a new tab) says the Virtual Appointments app "is no longer available." Microsoft now offers:

• Microsoft Bookings, where external attendees can join through a browser without downloading Teams. A Teams Premium license adds SMS notifications and an appointment queue. Check Bookings' HIPAA status first, as above.
• The virtual appointment meeting template in Teams, for scheduling with people outside your organization.
• The Teams EHR connector, which lets clinicians launch visits from Epic or Oracle Health. It needs a Microsoft Cloud for Healthcare subscription or the standalone connector offer.

Patients without a work account join as anonymous participants, which Teams allows by default. The lobby settings (opens in a new tab) decide whether they wait to be admitted. For "meetings with sensitive or regulated information," Microsoft suggests setting Who can bypass the lobby to "Only organizers and co-organizers." Organizers can change that default unless it's enforced with a meeting template or sensitivity label, which requires Teams Premium. Keep "Anonymous users and dial-in callers can start a meeting" off, as Microsoft recommends.

Recordings, transcripts and OneDrive storage

Microsoft's recording policy article (opens in a new tab) says a recording uploads to the organizer's OneDrive, or to SharePoint for channel meetings. Invitees can view it. Guests and external attendees see it only if it's explicitly shared. It also appears in "Shared with me" and Recent, and Microsoft 365 Search indexes it.

So a recorded visit becomes a searchable file in someone's OneDrive. If you don't need recordings, turn the Meeting recording toggle off in the Teams admin center (Meetings > Meeting policies) for clinician policies. If you do, use the ExplicitRecordingConsent policy so participants must agree. Turning off Copilot in a meeting also turns off recording and transcription.

Sharing settings to lock down

In the SharePoint admin center (Policies > Sharing), per Microsoft's sharing settings article (opens in a new tab):

• OneDrive external sharing set no broader than "New and existing guests." "Anyone" links work without sign-in. OneDrive can be stricter than SharePoint, never looser.
• If "Anyone" stays on for SharePoint, require those links to expire and allow view only.
• Default link type: "Specific people."
• Guest access set to expire automatically after a fixed number of days.
• Teams meeting policies: lobby, anonymous start off, recording as decided above.
• Retention set in Microsoft Purview for chats and recordings, matching your records policy.
• Multifactor sign-in for every account, and offboarding the same day someone leaves.

Forms collecting patient information have their own check: Microsoft Forms and HIPAA. Comparing tools? See Slack and HIPAA, Zoom for telehealth and Dropbox and Box, or the HIPAA-compliant email and messaging hub.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Medfy doesn't sell messaging or video tools. For its own services, it signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit checks the public side, including tracking pixels on pages with patient forms.

Frequently asked questions

Is Microsoft Teams covered by Microsoft's BAA?

Yes, on commercial Microsoft 365 and Office 365 plans. Microsoft's HIPAA page lists Microsoft Teams among in-scope services and says the BAA comes through its Data Protection Addendum by default for covered entities and business associates. The free consumer version of Teams isn't on that list. Microsoft also says the BAA alone doesn't make you compliant. Confirm your plan with your compliance officer or attorney.

Can we discuss patients in Teams chat?

Yes, in a work account under Microsoft's BAA, with the minimum necessary details and the right audience. Use private channels or group chats limited to the care team, keep patient names out of team and channel names, and review who has guest access to each team. Copilot can surface chats to anyone with access, so tidy permissions first. Confirm your policy with your compliance officer or attorney.

Is OneDrive HIPAA compliant?

OneDrive for Business is on Microsoft's in-scope list; personal OneDrive isn't. Under the BAA it can hold PHI, but sharing defaults decide the risk. Keep OneDrive's external sharing no broader than signed-in guests, make Specific people the default link type, require expiry on any Anyone links and set guest access to expire. Confirm the configuration with your compliance officer or attorney.

Can patients join a Teams video visit as guests?

Yes. Patients without a work account join as anonymous participants, which Teams allows by default, and Microsoft says external attendees can join through a browser. Set Who can bypass the lobby so patients wait until the clinician admits them, and keep Anonymous users and dial-in callers can start a meeting turned off, as Microsoft recommends. Check Bookings' HIPAA status before using it to schedule visits.