Request to Review/Sign HIPAA Business Associate Agreement (BAA)

Microsoft’s HIPAA BAA is automatically included through the Microsoft Online Services Data Protection Addendum for customers that are HIPAA covered entities or business associates using in-scope services; there is normally no separate BAA to sign or upload.^1^

1. Review and retain the applicable BAA

An authorized administrator or legal representative should:

1. Open Microsoft’s HIPAA/HITECH offering page.
2. Under Frequently asked questions, follow the Microsoft HIPAA Business Associate Agreement link.
3. Download the current BAA and Microsoft Online Services Data Protection Addendum.
4. Retain copies together with:
   • The organization’s Microsoft subscription or order documentation.
   • The applicable Product Terms.
   • The date and identity of the person who completed the review.

Microsoft’s healthcare documentation confirms that the BAA is automatically included as part of the Online Services Terms and applies to customers that are covered entities or business associates storing PHI.^2^

Microsoft cannot determine from a public Q&A post whether your organization legally qualifies as a covered entity or business associate, or verify the contractual state of a particular tenant.

2. Verify the tenant’s subscriptions

A Global Administrator or Billing Administrator should:

1. Sign in to the Microsoft 365 admin center.
2. In Dashboard view, select Billing → Your products. In Simplified view, select Subscriptions.
3. Record each product name, subscription status, and number of assigned licenses.
4. Select each subscription to review its details.

This page provides the authoritative tenant-specific subscription inventory.^3^

Compare those subscriptions with the applicability table in Microsoft’s HIPAA/HITECH offering. Do not rely only on the presence of an onmicrosoft.com tenant or on applications appearing in the launcher; neither establishes the applicable contract or assigned licenses.

3. Services covered by the Microsoft BAA

For Office 365 Commercial, Microsoft lists all four requested services as in scope:

They are also listed for the GCC environment. Coverage applies when the service is included in your organization’s applicable subscription and is being used under the governing Microsoft terms.^1^

The available information does not identify your currently purchased plans or assigned services, so Exchange Online and Teams licensing must be checked in Billing → Your products.

4. Obtain account-specific confirmation

If your legal or audit process requires written confirmation tied to the tenant:

1. In the Microsoft 365 admin center, select Help & support.
2. Enter a request such as:
   “Confirm that our Microsoft 365 subscription is governed by the current Microsoft DPA and HIPAA BAA, and identify whether our licensed SharePoint Online, OneDrive for Business, Exchange Online, and Teams services are in scope.”
3. If self-help results do not resolve the request, select Contact Support and choose email or phone.
4. If every subscription was purchased through a Microsoft partner, contact that partner instead; direct Microsoft support requires at least one subscription purchased through Microsoft.^4^

5. Customer-side compliance requirements

The BAA and an in-scope license do not make a deployment automatically HIPAA compliant. Microsoft states that the customer remains responsible for its compliance program, internal processes, and use of the services.^1^

Before introducing PHI, complete a documented risk assessment covering at least:

• User authentication and least-privilege access.
• External and guest sharing.
• SharePoint, OneDrive, Teams, and mailbox permissions.
• Retention, deletion, records management, and legal holds.
• Audit logging and incident response.
• Protection against inappropriate disclosure of PHI.
• Meeting recordings, transcripts, chat, and files.
• Managed devices and access from personal devices.
• Workforce policies and HIPAA training.

Use Microsoft Purview portal → Compliance Manager to create or review the relevant assessment and track improvement actions. Access requires an appropriate role—at least Compliance Manager Reader or a corresponding Microsoft Entra role—and assessment availability and management capabilities vary by license.^5^

A Compliance Manager score is not proof or a guarantee of compliance; it measures progress against recommended actions.^6^ Have legal counsel or a qualified HIPAA compliance professional approve the planned portals, workflows, sharing model, retention rules, and operational procedures before PHI is introduced.

References

1. Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act
2. Compliance in Microsoft for Healthcare
3. What Microsoft business subscriptions do I have?
4. Get support for Microsoft 365 for business
5. Get started with Compliance Manager
6. Compliance Manager frequently asked questions