Official documentation

Microsoft Cloud HIPAA and HITECH offering: Business Associate Agreement and in-scope services

Microsoft, Microsoft Learn, 2026

Read the original

Read on October 16, 2026

What it is: Microsoft's compliance page for HIPAA. It explains that Microsoft signs a Business Associate Agreement for covered entities and business associates, lists the cloud services the agreement covers, and says that the agreement alone does not make an organization compliant.
How much weight it carries: First-party compliance documentation maintained by Microsoft. It is the page that answers 'Can my organization enter into a BAA with Microsoft?' and it lists the in-scope services, but it is a summary, and the Business Associate Agreement and the Online Services Data Protection Addendum are the binding documents.

Facts taken from this source

Microsoft says its Business Associate Agreement covers in-scope Microsoft services, meaning the services it lists on the page.
“Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services” (Can my organization enter into a BAA with Microsoft?)
Microsoft says its HIPAA Business Associate Agreement is available by default to all customers who are covered entities or business associates under HIPAA.
“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA” (Can my organization enter into a BAA with Microsoft?)
Microsoft says a Business Associate Agreement does not on its own make an organization compliant with HIPAA.
“By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services doesn't on its own achieve HIPAA compliance.” (Does having a Business Associate Agreement with Microsoft ensure my organization's compliance?)
Microsoft says it enters into Business Associate Agreements with its covered entity and business associate customers when they use its enterprise products and services.
“To support our customers' compliance with HIPAA when utilizing Microsoft enterprise products and services, Microsoft enters into Business Associate Agreements with its covered entity and business associate customers.” (Business Associate Agreement section)
Microsoft's HIPAA page lists Azure and Azure Government among its in-scope cloud platforms and services.
“Microsoft in-scope cloud platforms and services Azure and Azure Government” (Section headed Microsoft in-scope cloud platforms and services)
Microsoft's in-scope table for Office 365 lists a Speech microservice among its Office 365 microservices.
“Office 365 Microservices (including but not limited to ObjectStore, Sway, Power Automate, PowerPoint Online Document Service, Query Annotation Service, School Data Sync, Siphon, Speech, eXtensible Application Program)” (Office 365 applicability and in-scope services (table))
Microsoft says there is currently no certification standard that the Department of Health and Human Services approves to demonstrate HIPAA compliance by a business associate.
“There's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA or the HITECH Act by a business associate.” (HIPAA and HITECH section, on certification)

Pages that rest on this source

Official documentation

Microsoft Cloud HIPAA and HITECH offering: Business Associate Agreement and in-scope services

Microsoft, Microsoft Learn, 2026

Read the original

Read on October 16, 2026

What it is: Microsoft's compliance page for HIPAA. It explains that Microsoft signs a Business Associate Agreement for covered entities and business associates, lists the cloud services the agreement covers, and says that the agreement alone does not make an organization compliant.
How much weight it carries: First-party compliance documentation maintained by Microsoft. It is the page that answers 'Can my organization enter into a BAA with Microsoft?' and it lists the in-scope services, but it is a summary, and the Business Associate Agreement and the Online Services Data Protection Addendum are the binding documents.

Facts taken from this source

Microsoft says its Business Associate Agreement covers in-scope Microsoft services, meaning the services it lists on the page.
“Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services” (Can my organization enter into a BAA with Microsoft?)
Microsoft says its HIPAA Business Associate Agreement is available by default to all customers who are covered entities or business associates under HIPAA.
“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA” (Can my organization enter into a BAA with Microsoft?)
Microsoft says a Business Associate Agreement does not on its own make an organization compliant with HIPAA.
“By offering a Business Associate Agreement, Microsoft helps support your HIPAA compliance. However, using Microsoft services doesn't on its own achieve HIPAA compliance.” (Does having a Business Associate Agreement with Microsoft ensure my organization's compliance?)
Microsoft says it enters into Business Associate Agreements with its covered entity and business associate customers when they use its enterprise products and services.
“To support our customers' compliance with HIPAA when utilizing Microsoft enterprise products and services, Microsoft enters into Business Associate Agreements with its covered entity and business associate customers.” (Business Associate Agreement section)
Microsoft's HIPAA page lists Azure and Azure Government among its in-scope cloud platforms and services.
“Microsoft in-scope cloud platforms and services Azure and Azure Government” (Section headed Microsoft in-scope cloud platforms and services)
Microsoft's in-scope table for Office 365 lists a Speech microservice among its Office 365 microservices.
“Office 365 Microservices (including but not limited to ObjectStore, Sway, Power Automate, PowerPoint Online Document Service, Query Annotation Service, School Data Sync, Siphon, Speech, eXtensible Application Program)” (Office 365 applicability and in-scope services (table))
Microsoft says there is currently no certification standard that the Department of Health and Human Services approves to demonstrate HIPAA compliance by a business associate.
“There's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA or the HITECH Act by a business associate.” (HIPAA and HITECH section, on certification)