Is Microsoft 365 Copilot HIPAA compliant?

Yes

Microsoft · Productivity

Yes. Microsoft will sign a Business Associate Agreement (BAA) for Microsoft 365 Copilot, usually on an enterprise plan, which is the baseline requirement for handling PHI.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Business Associate Agreement: Confirmed; Microsoft publishes a BAA option. Confirm the exact plan and service are covered before sending PHI.
Enterprise route: Microsoft 365 Copilot; For regulated use, validate the BAA, configured service and users under the Microsoft 365 Copilot contract.
Default data training: No by default; Microsoft 365 Copilot is a paid commercial add-on; with enterprise data protection, prompts/responses are not used to train foundation models.
Business-tier training: No by default; Prompts, responses, and Microsoft Graph data accessed by Microsoft 365 Copilot are not used to train the foundation LLMs.

Practical risk: Copilot inherits the user's existing permissions, so over-shared SharePoint/OneDrive content becomes far easier for employees to surface. That is an oversharing and governance risk rather than a training one.

How to make a decision

Check the precise account tier, written contract and intended data before approving Microsoft 365 Copilot. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Microsoft 365 Copilot

Is Microsoft 365 Copilot GDPR compliant?Is Microsoft 365 Copilot SOC 2 compliant?Is Microsoft 365 Copilot ISO 27001 certified?Does Microsoft 365 Copilot train on your data?

See the full Microsoft 365 Copilot risk profile, with every data-handling fact and its source, or browse all rated AI tools.