Last verified: October 2026, against Microsoft Learn and Microsoft Support. General information, not legal advice — confirm with your compliance officer or attorney.
Is Microsoft Forms HIPAA compliant? Microsoft Forms is one of the services covered by Microsoft's business associate agreement (BAA) for commercial Microsoft 365 subscriptions. That makes it usable for patient information, but the default sharing settings and the way results files spread mean an internal staff survey and a patient-facing website form need very different setups.
Short answer: is Microsoft Forms HIPAA compliant?
Short answer (verified October 2026): Microsoft's HIPAA compliance page (opens in a new tab) lists Forms among the in-scope services for commercial Office 365 and GCC subscriptions, and says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." Microsoft Support's Forms security page (opens in a new tab) says Forms is encrypted "both at rest and in transit." Forms from a personal Microsoft account isn't part of that.
Search interest is modest but specific: "is microsoft forms hipaa compliant" gets about 110 searches a month and "microsoft forms hipaa compliant" 40 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Microsoft 365, the BAA and in-scope services
Microsoft doesn't make you request a BAA. It is built into the Data Protection Addendum (DPA) that governs Microsoft's enterprise online services. For Office 365 commercial subscriptions, the in-scope list includes Exchange Online, Forms, Microsoft Teams, OneDrive for Business, SharePoint Online, Microsoft Copilot and Copilot Chat, among others.
Two things the BAA doesn't do:
- It doesn't cover personal accounts. Microsoft enters into BAAs for its "enterprise products and services." A form someone builds while signed in with a personal Microsoft account isn't part of your organization's subscription.
- It doesn't make you compliant. Asked whether its BAA ensures compliance, Microsoft answers: "No. … using Microsoft services doesn't on its own achieve HIPAA compliance."
For what a BAA should contain, see business associate agreements. Teams has its own questions; see is Microsoft Teams HIPAA compliant.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Licenses and settings that matter
License. Use Forms only from practice accounts on a commercial Microsoft 365 or Office 365 subscription. Microsoft notes that Forms administrator settings are available to "Office 365 Education and Microsoft 365 Apps for business customers."
Admin settings. In the Microsoft 365 admin center, under Settings > Org settings > Services > Microsoft Forms, an administrator can control (Microsoft Learn (opens in a new tab)):
| Setting | Default | What to consider |
|---|---|---|
| External sharing: send a link and collect responses from people outside the organization | On | Needed for any patient-facing form; it applies to every user |
| External sharing: collaborate with outside people | On | Turn off unless you work with an outside designer |
| External sharing: share as a template | On | Turn off; templates can carry over content |
| External sharing: share a summary of results outside the organization | On | Turn off; it applies to every form |
| Record names of people in your org | On | Fine for staff surveys; off for anonymous ones |
| Internal phishing protection | On | Leave on |
All four external sharing options are checked by default. A practice that never collects patient responses through Forms should uncheck the first one too.
Collecting patient information with Microsoft Forms
Illustrative example for a fictional practice:
| Item | Internal staff survey | Patient appointment request |
|---|---|---|
| Who fills it in | Staff, signed in | Patients, outside your organization |
| PHI collected | None | Name, contact details, reason for visit |
| External response setting | Not needed | Required |
| Who sees results | Office manager | Scheduling staff only |
| Risk if mishandled | Low | Impermissible disclosure of PHI |
| Controls | Defaults are fine | BAA in place, restricted results, minimal questions, no answers in email |
For the patient form, three guardrails matter most:
- Who can open the responses. Keep the form's owner and collaborators to named scheduling staff, and treat anyone who can manage the form as able to read its answers.
- Results files. If you open or export responses in Excel, that workbook inherits the sharing of wherever it's saved. A copy on a shared drive or a laptop desktop is outside your plan.
- Notifications. Keep any alert about new responses free of the answers themselves.
Ask only what you need to call the patient back. HHS's minimum necessary guidance (opens in a new tab) applies to what you collect as well as what you share.
Limits for patient-facing website forms
Forms is built for quizzes and surveys inside an organization. On a practice website, the gaps show:
- Embedding. A form embedded in your website sits on a page that may carry ad pixels or analytics. HHS's tracking guidance (opens in a new tab) says tracking technologies that collect what someone types while booking an appointment receive PHI.
- One tenant-wide switch. External response collection applies across your organization, so turning it on for one patient form turns it on for everyone.
- No patient workflow. Responses sit in Forms or a spreadsheet rather than an inbox where requests are assigned, answered and closed.
Alternatives for practice websites
Microsoft Forms is a good fit for internal surveys, training sign-offs and equipment checklists. For patient-facing forms, compare purpose-built options in HIPAA form builders compared, or see the Google Forms HIPAA check if part of your team uses Google.
Alternative: forms built into your website. Medfy's base plan includes HIPAA-compliant forms on your own site. Submissions go to the patient CRM and inbox, patient information is stored in separate, encrypted databases in the US or Canada, and Medfy signs a BAA with each practice. See Medfy and HIPAA.
The HIPAA compliant forms guide covers every step a submission takes. A free marketing audit flags privacy risks such as pixels on the pages where your forms sit.
Frequently asked questions
Does Microsoft sign a BAA that covers Microsoft Forms?
Yes. As of October 2026, Microsoft lists Forms among the in-scope services for its HIPAA business associate agreement, for commercial Office 365 and GCC subscriptions. Microsoft makes that BAA available by default through its Data Protection Addendum to customers that are covered entities or business associates, so there's no separate form to sign. Confirm your subscription type with your compliance officer or attorney.
Is Microsoft Forms safe for patient intake?
It can be, inside a commercial Microsoft 365 subscription covered by the BAA. Limit external response collection to the forms that need it, keep each form and its results files shared with named staff only, and keep patient answers out of email. For long intake packets with signatures, a dedicated intake tool may be easier to control. Check the setup with your compliance officer.
Is Microsoft 365 HIPAA compliant?
Not on its own. Microsoft signs a BAA covering in-scope services such as Exchange Online, Teams, OneDrive for Business, SharePoint Online and Forms. Microsoft also says that using its services doesn't on its own achieve HIPAA compliance. Your practice still needs a risk analysis, correct sharing settings, access controls and staff training. Ask your compliance officer or attorney to review your configuration.