Questions Regarding HIPAA Compliance for Telehealth via Microsoft Teams

Hi @Alicia Millette,

Welcome to the Microsoft Q&A forum.

Thank you for contacting us. I would like to provide you with the following information:

Microsoft Teams can comply with HIPAA for telehealth sessions, but it is not automatically compliant by default. You need to take specific steps to ensure HIPAA requirements are met. Below are some steps you can take:

1. Use Microsoft 365 with HIPAA compliance features

You need to use a Microsoft 365 plan such as Microsoft 365 E3/E5 or Microsoft 365 Business Premium, which includes enterprise-grade security and compliance tools. Avoid using personal or consumer Teams accounts—they lack the necessary protections.

2. Sign a Business Associate Agreement (BAA)

Microsoft provides a BAA for organizations covered by HIPAA (such as healthcare providers). The BAA is included by default in Microsoft 365 for organizations that need compliance, but you should verify that it has been signed/acknowledged in Microsoft 365 compliance documentation. To verify or accept the BAA:

• Sign in to Microsoft 365 Compliance Center
• Go to Service Trust Portal > Check “Compliance Manager”
• Or contact Microsoft Support / your account manager to confirm the BAA status.

3. Configure Teams for HIPAA compliance

You or your IT administrator should ensure Teams is securely configured:

• Enable encryption for data at rest and in transit (Microsoft does this by default)
• Set up Data Loss Prevention (DLP) policies to prevent unauthorized sharing of Protected Health Information (PHI)
• Disable recording unless it is secured and stored properly (HIPAA requires PHI to be stored safely)
• Use Multi-Factor Authentication (MFA) for all users
• Apply role-based access controls (principle of least privilege)
• Enable auditing and logging in Microsoft Purview.

4. Train staff on HIPAA-compliant usage

• Educate employees on handling PHI in Teams
• Define which channels are safe for PHI and enforce usage policies
• Conduct regular training and updates.

5. Monitor and audit activities

• Enable audit logs to track PHI access and changes
• Use Microsoft 365 Compliance Center to generate reports and monitor suspicious activity
• Connect logs to a SIEM tool for centralized monitoring.

6. Address telehealth-specific risks

• Verify patient identity during online sessions
• Ensure the patient’s environment is private and secure
• Be cautious with DLP settings that might block PHI sharing with guests (patients often join as guests).

For more details, you can refer to:

• Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act - Microsoft Compliance | Microsoft Learn
• Is Microsoft Teams HIPAA Compliant?
• Is Microsoft Teams HIPAA Compliant? A Comprehensive Guide 

 Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

Regarding the question “Does Microsoft Teams store video call information?” Yes, but details depend on your organization’s policies and configuration:

• Teams stores chat data, files, and sometimes meeting recordings in SharePoint/OneDrive according to your tenant’s retention policies.
• Microsoft encrpts data at rest and in transit and provides options for managing encryption keys.
• Retention periods can be customized via Retention Policies in Microsoft Purview.

I hope this information is helpful.

If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

 If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.