HIPAA compliance for Co-Pilot under existing MS 365 Family plan

Question

I currently have an MS 365 - Family account. Please let me know if/how I can make Co-Pilot within MS Word HIPAA compliant. I do not need this same help for any other aspect of Office, only for using Co-Pilot to support my report-writing within Word. Thank you.

Answer 1

Copilot in Microsoft 365 Family/Personal/Premium is a consumer offering governed by the Microsoft Services Agreement and Copilot Terms of Use, not by an enterprise HIPAA Business Associate Agreement (BAA). HIPAA compliance for handling protected health information (PHI) with Microsoft cloud services requires that:

1. The service be in scope for Microsoft’s HIPAA BAA.
2. The customer be a covered entity or business associate under HIPAA and have the Microsoft HIPAA BAA in place via the Online Services Data Protection Addendum.

From the provided information:

• Microsoft 365 Copilot (commercial/enterprise) is listed as an in-scope service under Microsoft’s HIPAA BAA for Office 365 and related services.
• Copilot in Microsoft 365 apps for home (Personal, Family, Premium) is covered by the Microsoft Services Agreement and Copilot Terms of Use, and is positioned as a consumer service.
• The HIPAA BAA is available to covered entities and business associates using in-scope commercial cloud services; it is not described as applying to consumer Microsoft 365 Family/Personal subscriptions.

Therefore, with an existing Microsoft 365 Family plan, Copilot in Word is not covered by a HIPAA BAA and cannot be treated as HIPAA-compliant for PHI. To use Copilot with PHI in a HIPAA-aligned way, an organization must:

• Use in-scope commercial services (for example, Microsoft 365 with Microsoft 365 Copilot under an enterprise/commercial tenant), and
• Have the Microsoft HIPAA BAA in place as part of the Online Services Data Protection Addendum.

If PHI must be handled under HIPAA, PHI should not be entered into Copilot features under a Microsoft 365 Family subscription.

---

References:

• Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act
• Frequently asked questions about Copilot in Microsoft 365 subscriptions
• Ensure compliance with Copilot Studio