Foundry models for Hippa complaince

Question

We are evaluating thri party under "Direct from Azure models" in Azure AI Foundry.

Can Microsoft confirm:

1. Is Deepseek, Mistral etc are covered under Microsoft's HIPAA BAA/DPA?
2. Can PHI be processed using Deepseek?
3. Is there an official list of Azure AI Foundry models that are HIPAA eligible?
4. Are "Direct from Azure models" treated differently from partner-hosted models such as Fireworks on Foundry?

Answer 1

Hello @Teja Reddy

Thank you for reaching out with your questions regarding HIPAA compliance for models available under "Direct from Azure models" in Azure AI Foundry.

As HIPAA eligibility depends not only on the model itself, but also on how it is hosted and whether the underlying Azure service is within the scope of Microsoft's HIPAA compliance offerings.

Based on the current Microsoft documentation, here's what we can confirm:

1. Are DeepSeek, Mistral, etc. covered under Microsoft's HIPAA BAA/DPA?

The Microsoft HIPAA documentation confirms that Microsoft offers a Business Associate Agreement (BAA) to covered entities and business associates through the Microsoft Product Terms for in-scope Azure services.

However, the documentation does not provide an explicit mapping of individual third-party models (such as DeepSeek, Mistral, or other models available in the Azure AI Foundry catalog) to HIPAA BAA/DPA coverage.

Therefore:

What we can confirm: Microsoft's HIPAA BAA applies to Azure services that are included within the HIPAA compliance scope.

What we cannot confirm from the published documentation: Whether specific third-party models, such as DeepSeek or Mistral, are individually covered simply because they appear under the Direct from Azure models catalog.

2. Can PHI be processed using DeepSeek?

Microsoft's documentation explains that customers may process Protected Health Information (PHI) using Azure services that are within the HIPAA compliance scope and when appropriate administrative, technical, and contractual safeguards are in place.

However, the documentation does not specifically state that DeepSeek models are approved or certified for processing PHI within Azure AI Foundry.

Therefore:

• PHI can be processed only when using Azure services that are covered by Microsoft's HIPAA compliance offerings and in accordance with your organization's compliance requirements.
• We cannot confirm from the current documentation that DeepSeek specifically is approved for PHI processing.

Unless Microsoft explicitly documents HIPAA eligibility for a particular model or hosting scenario, it should not be assumed to be approved for regulated healthcare workloads.

3. Is there an official list of Azure AI Foundry models that are HIPAA eligible?

At this time, Microsoft does not publish a model-by-model list identifying which Azure AI Foundry models are HIPAA eligible.

HIPAA eligibility is generally determined by:

• The Azure service hosting the model.
• The deployment or hosting option being used.
• Whether that Azure service is included in Microsoft's HIPAA compliance scope.

The authoritative reference for HIPAA coverage is the Azure Products Available by Compliance Offerings documentation, which lists the Azure services covered under HIPAA rather than individual models.

4. Are "Direct from Azure models" treated differently from partner-hosted models such as Fireworks?

Based on the available documentation, Microsoft does not explicitly compare Direct from Azure models with partner-hosted models (such as Fireworks AI) in terms of HIPAA coverage or contractual treatment.

In general:

Direct from Azure models are hosted and managed within Microsoft Azure infrastructure.

Partner-hosted models are operated by third-party providers, and their data handling, compliance scope, and contractual commitments may differ depending on the provider.

However, the published HIPAA documentation does not explicitly state whether Direct from Azure models receive different HIPAA treatment than partner-hosted models.

Please refer this, https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us

I Hope this helps. Do let me know if you have any further queries.

---

If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

Thank you!