Is Azure AI Translator HIPAA compliant?
Microsoft signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Azure AI Translator with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Microsoft doesn't say whether the BAA covers all of its AI features.
Does Azure AI Translator sign a BAA?
Yes, it signs a BAA
Microsoft says its Translator service is included in its HIPAA BAA. The BAA comes by default through Microsoft's Product Terms for Azure customers that are HIPAA covered entities or business associates. Text sent for translation is not stored.
Not confirmed for the AI features: Microsoft doesn’t say whether its BAA covers Custom Translator (custom models). Get that in writing before using it with patient data.
- Business associate
- Microsoft
- Tool
- Azure AI Translator
- Plans with a BAA
- Azure commercial customers
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Azure commercial customers | Signs a BAA | Included in the terms | There is no separate contract to sign. The BAA is part of the Product Terms and DPA for customers that are covered entities or business associates, and it applies to in-scope services. Microsoft's Translator compliance page says Translator is included in the BAA. The free consumer Translator apps are a separate product (microsoft-translator-app).[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Text translation API | Covered | Translator is named as included in the BAA. Text is processed in real time and not stored.[3],[4] |
| Document translation | Covered | Part of the same Translator service that Microsoft names in the BAA. Documents are held temporarily during processing and then hard-deleted. The BAA statement is made at the service level and does not list features.[3],[4] |
| Custom Translator (custom models) | Not stated | Uploaded training documents are stored encrypted in the customer's workspace. The BAA statement names Translator as a whole, and no page says whether training documents containing PHI are in scope.[3] |
Sources
- HIPAA (US) Health Insurance Portability and Accountability Act - Azure compliance
- HIPAA/HITECH - Microsoft compliance
- No Trace - Microsoft Translator for Business
- Data, privacy, and security for Translator
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.