How do I get a BAA for HIPAA compliance for my version of Microsoft 365?

Question

How do I get a BAA for HIPAA compliance for my version of Microsoft 365?

Answer 1

Hi @Daniel Gossett,

Thank you for reaching out with your question about obtaining a Business Associate Agreement (BAA) for HIPAA compliance with Microsoft 365.

Microsoft provides a standard HIPAA BAA through the Microsoft Online Services Data Protection Addendum (DPA) for eligible customers who are HIPAA covered entities or business associates. This BAA applies to in‑scope Microsoft 365 services, including OneDrive for Business.

Below is an overview of how to obtain and use the Microsoft HIPAA BAA:

1/ Download the official Microsoft HIPAA BAA

Microsoft publishes its HIPAA BAA in the Microsoft Service Trust Portal, where it is available as a downloadable document. This is typically the document auditors request when asking for proof of a BAA with Microsoft: Service Trust Portal.

This is typically what auditors want when they say “show us your BAA with Microsoft” - a copy of Microsoft’s BAA, downloaded from the trust/compliance portal.

 

2/ How “signing” the BAA works with Microsoft

Microsoft uses a standardized BAA and does not sign custom or customer‑provided agreements. The BAA is contractually incorporated through the Microsoft Online Services DPA and Product Terms for eligible customers.

In practice, acceptance of the DPA and Product Terms serves as agreement to the BAA, rather than a separately negotiated or manually signed document.

 

3/ Confirm that your Microsoft 365 services are in scope

For HIPAA compliance, it’s important to verify that the specific Microsoft 365 workloads you plan to use (such as OneDrive, Exchange Online, or SharePoint Online) are listed as “in‑scope services” under Microsoft’s HIPAA/HITECH documentation. This list determines which services are covered by the BAA.

 

4/ Microsoft Professional Services

If you require a HIPAA BAA for Microsoft Professional Services, this is handled separately through your Microsoft account or services representative.

 

5/ Important compliance note

While a BAA is a required component of HIPAA compliance, it does not ensure compliance on its own. Your organization is still responsible for implementing appropriate administrative, technical, and organizational safeguards and configuring Microsoft 365 services correctly.

 

For additional background and guidance, please refer to:

• Health Insurance Portability and Accountability Act (HIPAA) & Health ...
• Is Microsoft 365 HIPAA Compliant? BAA, Requirements & Setup Guide

This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. We can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it. 

 

I hope this information helps clarify how to obtain and use a BAA with Microsoft 365. Please let me know if you have any follow‑up questions or need assistance confirming your service eligibility.

As other users will also search for information in this community, your vote can significantly help those with similar inquiries quickly locate the most relevant resources. 

Thank you for your kindness and for contributing to the forum.   

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.