Is Microsoft Teams HIPAA compliant?

Yes, if the practice is a covered entity or business associate and uses Teams in Microsoft's Commercial or GCC environment. Microsoft offers a Business Associate Agreement (BAA) that covers Teams there, and Microsoft makes it available by default through the Microsoft Online Services Data Protection Addendum. A free or personal Teams account is outside the BAA.

Which Microsoft Teams environments does the BAA cover?

The Microsoft BAA covers Teams in the Commercial and GCC environments, the two rows where Microsoft's Office 365 table lists Teams as an in-scope service. Microsoft says it offers covered entity and business associate customers a BAA that covers in-scope Microsoft services. The table below shows, for each of those two rows and for a free or personal account, whether the BAA covers Teams and how the BAA is accepted.

Microsoft describes Commercial as the public Office 365 cloud service available globally.

Where does a practice confirm that another Microsoft service is in scope?

Microsoft's Office 365 applicability table is where a practice confirms whether another Microsoft service is in scope. The BAA covers in-scope services, and the table lists Microsoft Entra ID and the Microsoft Purview portal beside Microsoft Teams.

How does a practice get Microsoft's BAA?

Microsoft makes its BAA available by default through the Microsoft Online Services Data Protection Addendum to covered entity and business associate customers. Microsoft's HIPAA page describes no separate signing step. The BAA is also available for in-scope Microsoft Professional Services, which a practice arranges through a Microsoft services representative.

Can a practice use its own BAA form with Microsoft?

No, Microsoft cannot use a customer's own BAA form, because its services are standardized for all customers. A practice relies on the BAA that Microsoft makes available through the Data Protection Addendum.

What does the Microsoft BAA leave out?

The Microsoft BAA leaves out every Microsoft service that is not in scope. Microsoft also states that the customer's organization is wholly responsible for ensuring compliance with all applicable laws and regulations, so the BAA does not move the practice's own HIPAA duties to Microsoft.

Is a free Teams account covered by the BAA?

A free or personal Teams account is outside the environments that the Microsoft BAA covers. The Office 365 environments on Microsoft's HIPAA page are Client software, Commercial, GCC, GCC High and DoD, and none of them is a consumer or personal product. A practice that puts patient information in a personal account has no BAA behind that account.

What must a practice set up before using Teams with patient information?

Before a practice puts patient information in Teams, the practice confirms that it is a covered entity or business associate, works in the Commercial or GCC environment and relies on Microsoft's BAA. The steps below follow Microsoft's HIPAA page.

1. Confirm the practice is a covered entity or a business associate, since Microsoft offers the BAA to those customers.
2. Use Teams in the Commercial or GCC environment, where Microsoft lists it as in scope. A free or personal account sits outside both.
3. Rely on the BAA that comes by default through the Data Protection Addendum. Microsoft describes no separate signing step.
4. Send Microsoft no practice-written BAA form, because Microsoft cannot use one.
5. Keep responsibility for the practice's own HIPAA compliance, which Microsoft says stays with the customer's organization.

Where does fax fit when a practice sends patient documents?

Fax is a separate channel from Teams, so a practice that sends patient documents by fax needs a fax service that signs a BAA. Whether a fax service needs a BAA explains that step. A practice choosing between fax and email can start with whether online fax is more secure than email. Every Fax Pigeon plan includes the business associate agreement Fax Pigeon signs at signup, along with your own number.

* Microsoft's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Microsoft.