Microsoft Teams is a communication and collaboration platform that enables organizations to chat, host video meetings, make calls, and share files.

With Microsoft Teams, organizations can coordinate work and collaborate on documents through connected Microsoft 365 services.

Is Microsoft Teams HIPAA compliant? Yes, based on our research, Microsoft Teams can be HIPAA compliant when users have an eligible option.

 

What changed this year?

As of October 2026, our review did not identify any publicly disclosed changes to Microsoft Teams’ HIPAA-related policies or BAA terms.

Microsoft updated its broader Data Protection Addendum in May 2026 to clarify notification terms for subprocessors supporting artificial intelligence functionality. Its HIPAA BAA clause remains unchanged, and Microsoft Teams remains listed as an in-scope service.

 

Will Microsoft Teams sign a business associate agreement (BAA)?

Yes, Microsoft will sign a business associate agreement, which can be reviewed here.

For covered entities and business associates using in-scope services, Microsoft includes the BAA through its Data Protection Addendum by default. A separate standalone signature is not required.

Eligible options include Microsoft 365 Business Basic, Standard, and Premium with Teams; enterprise plans with Teams; and standalone commercial Teams subscriptions, such as Teams Essentials using Microsoft Entra business accounts. If a Microsoft 365 plan is sold without Teams, a separate Teams license is required.

BAA coverage is not restricted to premium plans. However, security and compliance features vary by subscription, so organizations must confirm that their chosen plan supports the safeguards they need.

 

What does the Microsoft Teams BAA cover?

Microsoft’s BAA covers protected health information (PHI) handled through in-scope services, including Microsoft Teams. Its data protection terms require Microsoft to “implement and maintain appropriate technical and organizational measures” to protect customer data.

The BAA and associated data protection terms cover:

  • Protection of PHI
  • Security incident notification
  • Safeguards for subcontractors handling customer data
  • Customer access to and extraction of stored data
  • Data deletion after services end, subject to the agreement’s retention provisions

What does the Microsoft Teams BAA exclude?

Microsoft’s BAA does not automatically cover third-party apps connected to Teams. Its data protection terms state, “Separate terms, including different privacy and security terms, govern Customer’s use of Non-Microsoft Products.”

Organizations must assess those providers’ HIPAA obligations and BAA arrangements separately before sharing PHI. Preview features also require a coverage check because Microsoft’s terms provide exceptions and different protections for previews.

 

Conclusion

Microsoft Teams may be HIPAA compliant, but organizations must use services covered by Microsoft’s BAA and configure and use them in accordance with HIPAA requirements.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.