Is OneDrive HIPAA compliant?

Yes, for a covered entity or business associate under HIPAA: Microsoft's BAA comes by default through its Data Protection Addendum, and Microsoft's HIPAA page lists OneDrive for Business in its in-scope services rows for Office 365 (Commercial) and GCC. A free or consumer OneDrive account is outside that default by inference.

Does Microsoft sign a BAA that covers OneDrive?

Microsoft's BAA covers OneDrive for Business for covered entities and business associates, because the BAA is available through the Data Protection Addendum by default and Microsoft's HIPAA page lists OneDrive for Business in its in-scope services rows.

Microsoft says it offers covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services. That BAA is available by default through the Microsoft Online Services Data Protection Addendum, and the default applies to every customer that is a covered entity or business associate under HIPAA.

Microsoft's HIPAA page lists OneDrive for Business in the in-scope services rows for Office 365 (Commercial) and for GCC. Each of those rows also names Exchange Online and Forms.

Microsoft's HIPAA page names no plan or SKU for OneDrive, so the table sorts coverage by the page's rows and by account type.

The page's Office 365 HIPAA section covers 4 environments: Office 365 (Commercial), GCC, GCC High and DoD.

Which OneDrive plans does the BAA cover?

Microsoft's HIPAA page names no OneDrive plan or SKU, so coverage is read from its applicability table for Office 365 services and subscriptions. A practice should check its own services against that table before relying on them. Microsoft Teams is a separate question, covered in whether Microsoft Teams is HIPAA compliant.

What does Microsoft's BAA leave out?

Microsoft's BAA leaves out any Microsoft service that is not in scope, because it covers in-scope Microsoft services and no others. A practice that uses a Microsoft service outside the in-scope rows should keep patient information out of it. Microsoft also says its HIPAA BAA closely reflects how it operates, and that it cannot use a customer's own Business Associate Agreement.

Microsoft's HIPAA page names GCC High and DoD among its 4 environments, but OneDrive for Business is confirmed only in the Office 365 (Commercial) and GCC rows. A practice in either environment should read the in-scope services list for its own environment on Microsoft's HIPAA page.

Can a free or consumer OneDrive account hold patient information?

No, a free or consumer OneDrive account should not hold patient information, because Microsoft ties its default BAA to covered entities and business associates and its HIPAA page lists OneDrive for Business without mentioning consumer accounts. Reading that as a bar on consumer accounts is an inference. Microsoft's HIPAA page describes no signing path for a consumer account. A practice that wants OneDrive for patient information therefore needs an Office 365 subscription that Microsoft's applicability table covers.

What must a practice set up before using OneDrive for patient information?

A practice sets up OneDrive for patient information by confirming its HIPAA role, finding its environment on Microsoft's page, and using the applicability table.

• Confirm that the practice is a covered entity or business associate under HIPAA, because the default BAA covers those customers.
• Find the practice's environment among the 4 the page covers.
• Use Microsoft's table to determine applicability for the practice's Office 365 services and subscription.
• Do not plan to use the practice's own BAA, because Microsoft says it cannot use a customer's Business Associate Agreement.

Can a practice fax patient documents from email under a BAA?

Yes, a practice can fax patient documents from email under a BAA, because Fax Pigeon sends faxes from email and signs a BAA at signup on every plan. Every delivered fax gets delivery proof. For more on faxing from an email account, see how to fax from Gmail or Outlook under HIPAA.

* Microsoft's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Microsoft.