Is Azure AI Translator HIPAA compliant?

Microsoft signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Azure AI Translator with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Microsoft doesn't say whether the BAA covers all of its AI features.

Does Azure AI Translator sign a BAA?

Yes, it signs a BAA

Microsoft says its Translator service is included in its HIPAA BAA. The BAA comes by default through Microsoft's Product Terms for Azure customers that are HIPAA covered entities or business associates. Text sent for translation is not stored.

Based on 4 sources, all from Microsoft unless marked.

Not confirmed for the AI features: Microsoft doesn’t say whether its BAA covers Custom Translator (custom models). Get that in writing before using it with patient data.

Business associate
Microsoft
Tool
Azure AI Translator
Plans with a BAA
Azure commercial customers
Checked
Signs a BAA
Microsoft signs a BAA with its customers; AI coverage isn't stated.

By plan

PlanBAAHow to get itConditions
Azure commercial customersSigns a BAAIncluded in the termsThere is no separate contract to sign. The BAA is part of the Product Terms and DPA for customers that are covered entities or business associates, and it applies to in-scope services. Microsoft's Translator compliance page says Translator is included in the BAA. The free consumer Translator apps are a separate product (microsoft-translator-app).[1],[2],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.

AI featureUnder the BAADetails
Text translation APICoveredTranslator is named as included in the BAA. Text is processed in real time and not stored.[3],[4]
Document translationCoveredPart of the same Translator service that Microsoft names in the BAA. Documents are held temporarily during processing and then hard-deleted. The BAA statement is made at the service level and does not list features.[3],[4]
Custom Translator (custom models)Not statedUploaded training documents are stored encrypted in the customer's workspace. The BAA statement names Translator as a whole, and no page says whether training documents containing PHI are in scope.[3]

Sources

  1. HIPAA (US) Health Insurance Portability and Accountability Act - Azure complianceMicrosoft, Documentation. Checked Oct 13, 2026. Archived copy
  2. HIPAA/HITECH - Microsoft complianceMicrosoft, Documentation. Checked Oct 13, 2026. Archived copy
  3. No Trace - Microsoft Translator for BusinessMicrosoft, Documentation. Checked Oct 13, 2026. Archived copy
  4. Data, privacy, and security for TranslatorMicrosoft, Documentation. Checked Oct 13, 2026. Archived copy

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.