AI Vendor BAA Check

Does Azure OpenAI / Microsoft Foundry (Azure AI Foundry) sign a BAA?

Not confirmed

Microsoft's HIPAA BAA is included automatically, through the Product Terms and DPA, for in-scope Azure services. However, no Microsoft page we could reach names Azure OpenAI or Foundry models as in scope; the official list sits in a Service Trust Portal PDF we could not open. Treat coverage as unconfirmed until verified there or with Microsoft.

Based on 8 sources, all from Microsoft unless marked.

Business associate
Microsoft
Tool
Azure OpenAI / Microsoft Foundry (Azure AI Foundry)
Plans with a BAA
Not stated
Checked
Not confirmed
No BAA offer found on Microsoft's own pages.

By plan

PlanBAAHow to get itConditions
Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAINot confirmedIncluded in the termsThe Microsoft BAA comes by default through the Product Terms and DPA, with no separate signature, but only for in-scope Azure services. Whether Azure OpenAI / Foundry Models sold by Azure are in scope could not be confirmed from an official page. Microsoft Q&A moderators (not official documentation) give conflicting answers.[2],[3],[4]
Foundry Models from partners and community (serverless / Marketplace)Not confirmedNot statedMicrosoft treats these as Non-Microsoft Products governed by each provider's terms and billed through Azure Marketplace. No official HIPAA statement for them was found.[5]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.

AI featureUnder the BAADetails
Azure OpenAI models (Models sold by Azure)Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAINot statedNo reachable official Microsoft page lists Azure OpenAI in HIPAA BAA scope. The data-privacy doc is silent on HIPAA.[1],[4]
Abuse monitoring / modified abuse monitoringAzure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAINot statedBy default, flagged prompts and completions may be stored for human review. Turning that off (modified abuse monitoring) is limited to managed customers who meet extra criteria. Microsoft docs don't link this to HIPAA.[1],[6]
Claude models in Microsoft Foundry (under Anthropic's BAA)Foundry Models from partners and community (serverless / Marketplace)Not statedAnthropic's pages conflict. Its BAA article lists Claude via Foundry as eligible under its BAA, while its API docs say HIPAA readiness isn't available on Microsoft Foundry.[7],[8]
Other partner/community models (e.g., Mistral, DeepSeek, Qwen)Foundry Models from partners and community (serverless / Marketplace)Not statedNo official Microsoft HIPAA statement found for individual partner models.[5]

Cloud AI platforms that offer a BAA

All BAA-ready alternatives to Azure OpenAI / Microsoft Foundry (Azure AI Foundry)

Compare Azure OpenAI / Microsoft Foundry (Azure AI Foundry)

Sources

  1. Data, privacy, and security for Models sold by AzureMicrosoft, Documentation. Checked Oct 11, 2026.
  2. HIPAA (US) Health Insurance Portability and Accountability Act - Azure complianceMicrosoft, Documentation. Checked Oct 11, 2026.
  3. HIPAA/HITECH - Microsoft complianceMicrosoft, Documentation. Checked Oct 11, 2026.
  4. Cloud services in audit scopeMicrosoft, Documentation. Checked Oct 11, 2026.
  5. Foundry Models overviewMicrosoft, Documentation. Checked Oct 11, 2026.
  6. Limited access to Models sold by AzureMicrosoft, Documentation. Checked Oct 11, 2026.
  7. Business Associate Agreements (BAA) for commercial customersAnthropic, Help center. Checked Oct 11, 2026.
  8. API and data retentionAnthropic, Documentation. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.