Practice administrators ask this one a lot, usually right after a cyber insurance renewal lands with a new questionnaire. The honest answer is short: Microsoft 365 is HIPAA-capable, not HIPAA-compliant. Microsoft built the platform so a covered entity can use it in a compliant way, and it will sign a Business Associate Agreement. But nothing about a default tenant makes your practice compliant. That part is configuration, policy, and documentation, and it is your responsibility.
Compliance is a property of your tenant, not the product
HIPAA does not certify software. There is no HHS list of "HIPAA compliant" products. The Security Rule sets standards for how a covered entity protects electronic PHI, and a platform either gives you the ability to meet them or it does not. Microsoft 365 does. Whether your tenant meets them depends on how it is set up and run.
Most practice tenants were created years ago by whoever set up the first mailbox and have been quietly accumulating users, shared mailboxes, and guest accounts since. A tenant created in 2018 does not automatically get the 2026 defaults. Someone has to go in and turn things on.
The Microsoft BAA: what it is and what it covers
Microsoft's HIPAA Business Associate Agreement is not a separate document you request and sign. For commercial customers it is folded into the Microsoft Product Terms and the Data Protection Addendum (DPA) that govern your subscription. By accepting those terms, you have a BAA in place. If an auditor asks for a copy, pull the current DPA and Product Terms, note the effective date, and keep them in your compliance file.
Two things to check.
- Which services are covered. The BAA applies to a defined list of in-scope services: Exchange Online, SharePoint Online, OneDrive for Business, Teams, Intune, Purview, Defender, Entra ID, and most of the core suite. Consumer services (personal Outlook.com accounts) are not covered at all. Some newer features and preview experiences may be excluded, and Copilot features have their own terms.
- Which plan you are on. The BAA is available across commercial plans, but some of the controls you need to actually meet the Security Rule are only included in Business Premium and above. A BAA on Business Basic does not give you Intune or Purview Message Encryption.
For more on what a BAA does and does not do, see what a BAA with an IT vendor covers. The short version: the BAA obligates Microsoft for its side of the shared responsibility model. Everything inside your tenant is your side.
Business Premium vs E3 vs E5, in plain terms
| Plan | Who it fits | What you get for HIPAA |
|---|---|---|
| Business Standard | Almost no medical practice | Email and Office apps, no Intune, no conditional access, no message encryption. Not adequate on its own. |
| Business Premium | Most independent practices under 300 users | Intune, Defender for Business, Entra ID P1 (conditional access), Purview Message Encryption, sensitivity labels, basic DLP, retention, audit. This is the practical floor. |
| Microsoft 365 E3 | Larger groups, MSOs, organizations with IT staff | Everything in Premium plus longer audit retention options, more advanced compliance tooling, and no 300-user cap. |
| Microsoft 365 E5 | Health systems, RCM operations, high-risk environments | Adds Defender XDR, Entra ID P2 (risk-based conditional access, privileged identity management), advanced Purview, and eDiscovery Premium. |
For a 5-provider dermatology practice or a 30-person pain management group, Business Premium. For a 400-seat RCM/CBO operation, E3 with a hard look at E5 for admins. Anything below Premium means bolting on third-party tools to fill gaps Microsoft already sells in one license.
The settings that actually matter
This is the configuration work that separates a HIPAA-capable tenant from one that will hold up in a risk analysis. None of it is exotic. It is a few days of work for someone who does it regularly.
Identity: MFA, conditional access, and legacy authentication
Multi-factor authentication on every account, including service accounts and the practice manager who "just needs to check email fast." Security Defaults enforce MFA broadly, but a practice on Business Premium should move to conditional access policies to require MFA everywhere, block sign-ins from countries where you have no staff, and require compliant devices for Exchange and SharePoint.
Block legacy authentication protocols (POP, IMAP, basic SMTP auth, older ActiveSync). These bypass MFA entirely and remain a common path to account takeover. Older tenants often still have them on. Check.
Encryption in transit and PHI in email
Microsoft encrypts data at rest and uses TLS in transit by default. That covers Microsoft's obligation, not yours. When a front desk employee emails an imaging report to a referring practice, TLS protects the message only if the other side supports it, and it does nothing once the message lands in the recipient's inbox.
For email containing PHI, you want Purview Message Encryption (formerly Office 365 Message Encryption), included in Business Premium and E3/E5. Configure a mail flow rule that encrypts automatically when a message is flagged (a subject tag like "[Secure]" is common), when DLP detects PHI patterns, or when the message leaves the organization. Train staff on when to use it, and write the policy down.
Also disable automatic forwarding to external addresses. Attackers who compromise a mailbox routinely set up a silent forwarding rule to an outside account. A tenant-wide block plus an alert on new inbox rules closes that.
Sensitivity labels and DLP basics
You do not need an enterprise information governance program. You need a small set of sensitivity labels (Internal, Confidential, PHI) and a DLP policy that recognizes common PHI patterns and at minimum warns the user, ideally blocks external sharing or forces encryption. Start with the built-in HIPAA policy template in Purview and tune it. Expect false positives at first. Tuning is normal; not turning it on is the mistake.
Retention, litigation hold, and audit logging
Set retention policies for Exchange, SharePoint, OneDrive, and Teams that match your record retention obligations. Texas Medical Board rules and payer contracts often drive longer periods than HIPAA's six-year documentation rule; that is a question for your compliance counsel, but the technical work is the same either way. Litigation hold on specific mailboxes preserves data when a legal or OCR matter opens.
Turn on unified audit logging and confirm it is retained. After an incident, the audit log is how you show what was accessed and by whom, the difference between "we think" and "we can show" in a breach risk assessment.
SharePoint, OneDrive, and Teams external sharing
Many tenants allow anyone-with-the-link sharing, meaning a staff member can create an unauthenticated link to a folder of scanned records and send it anywhere. Restrict external sharing to authenticated guests or turn it off for sites that hold PHI. Set link defaults to "specific people." Review guest accounts and remove ones nobody recognizes.
In Teams, restrict external and guest access to what the practice uses. Decide whether patient information belongs in Teams chat at all (many practices say no and enforce that with DLP), and apply retention to chats and channels.
Mobile devices and app protection
Physicians will read email on personal phones. Plan for it. Intune app protection policies let you require a PIN or biometric on Outlook and Teams, block copy and paste into unmanaged apps, and remotely wipe practice data without touching personal photos. For practice-owned devices, full enrollment with compliance policies goes further. Either way, tie it to conditional access so an unprotected device cannot open a PHI-bearing mailbox.
Backup, because retention is not backup
This one gets missed most often. Retention and litigation hold prevent permanent deletion within Microsoft's platform. They do not give you an independent copy you can restore if a ransomware actor with a compromised admin account deletes mailboxes and SharePoint sites, or if you need a point-in-time restore of a folder from eight months ago. HIPAA's contingency plan standard requires a retrievable exact copy of ePHI. Third-party Microsoft 365 backup covering Exchange, OneDrive, SharePoint, and Teams, stored outside your tenant and your admin credentials, is how practices meet that. Our backup and disaster recovery page covers this in more depth.
Common practice mistakes
- Global admin accounts used for daily email. Admins should have separate, MFA-protected accounts. The physician-owner should not be a global admin on the account she reads patient email from.
- Shared front-desk mailbox with a shared password. Every login should be an individual identity. Shared mailboxes exist for this purpose and do not need a password.
- Former employees still licensed. Offboarding that stops at "we changed the password" leaves mailboxes and OneDrive accessible. Convert to shared, apply hold if needed, revoke sessions, remove licenses.
- Personal Microsoft accounts or Gmail used for practice work. No BAA, no controls, no visibility.
- Nobody owns the tenant. The provider that set it up is gone. The billing contact is a former manager. Ownership and documented change control matter in an audit.
- Assuming the EMR vendor handles it. The EMR vendor's compliance covers the EMR. Your email, files, and scheduling spreadsheets are your problem.
How this shows up in a risk analysis and an insurance application
Your HIPAA security risk assessment should list Microsoft 365 as a system that stores and transmits ePHI and rate each control above as implemented, partial, or missing, with a remediation plan and dates. If the assessment says "email: encrypted" and that means TLS with no message-level control, the finding will not survive scrutiny after an incident. HHS OCR enforcement data consistently shows an inadequate risk analysis as a leading finding, and email is among the most common breach vectors reported.
Cyber insurance carriers ask about most of this directly: MFA for email and remote access, legacy authentication blocked, email filtering, immutable or offline backup, privileged account separation. Answering "yes" to a control that is not actually configured is a coverage problem, not just a compliance problem. Our article on cyber insurance requirements for healthcare walks through the questionnaire.
A short checklist
- BAA confirmed via current Product Terms and DPA, copy on file
- Business Premium or higher on every user who touches PHI
- MFA everywhere, conditional access enforcing it, legacy auth blocked
- Separate admin accounts, no daily use
- Purview Message Encryption with a mail flow rule for PHI
- External auto-forwarding blocked, alerts on new inbox rules
- DLP policy from the HIPAA template, tuned and enforced
- Retention set, litigation hold procedure documented, audit log on
- SharePoint, OneDrive, and Teams external sharing restricted, guests reviewed
- Intune app protection on mobile, tied to conditional access
- Third-party backup of Exchange, OneDrive, SharePoint, Teams, with tested restores
- Offboarding procedure that actually removes access
- All of the above reflected in the written risk analysis
Frequently asked questions
Microsoft 365 is HIPAA-capable, not automatically HIPAA compliant. Microsoft will sign a Business Associate Agreement and the platform has the controls HIPAA requires, but the practice is responsible for turning them on, configuring them correctly, and documenting that in its risk analysis.
For most commercial tenants, no separate signature is required. Microsoft's HIPAA Business Associate Agreement is incorporated into the Product Terms and Data Protection Addendum that govern your subscription. You should still keep a copy of the current terms in your compliance file as evidence.
Business Premium is the practical floor for most independent practices because it bundles Intune, Defender for Business, conditional access, and message encryption. E3 and E5 add advanced compliance and security tooling that larger groups and organizations with dedicated IT staff tend to need.
It can be, if you use Purview Message Encryption or an equivalent to encrypt PHI-bearing messages end to end, enforce MFA on the sending accounts, and prohibit auto-forwarding to outside addresses. Standard TLS between mail servers alone is not sufficient for messages containing patient information.
Not in the sense HIPAA's contingency plan standard expects. Retention policies and litigation hold keep data from being permanently deleted, but they are not a restorable, independent backup. Most practices need a third-party Microsoft 365 backup that covers Exchange, OneDrive, SharePoint, and Teams.
Configuring and maintaining Microsoft 365 for medical practices is part of the healthcare-first managed IT we deliver across DFW and Houston, and it feeds directly into the regulatory compliance documentation practices need to keep current. If you are not sure whether your tenant would hold up, an IT risk assessment is usually where we start.
Ready for a straight answer about your IT? Call (972) 776-6366 or contact us.