Does Microsoft 365 Copilot sign a BAA?
Yes, it signs a BAA
Microsoft's HIPAA BAA is included by default in its Data Protection Addendum for commercial customers, and Microsoft lists Microsoft Copilot and Copilot Chat among the Office 365 services it covers. Web search queries sent to Bing are explicitly outside the DPA and the BAA.
Not fully covered by the BAA: Web search grounding (Bing web queries); Third-party plugins / connectors.
- Business associate
- Microsoft
- Tool
- Microsoft 365 Copilot
- Plans with a BAA
- Microsoft 365 commercial (Microsoft 365 Copilot license); Microsoft 365 Copilot Chat (free with eligible work/school Entra accounts); Office 365 GCC
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Microsoft 365 commercial (Microsoft 365 Copilot license) | Signs a BAA | Included in the terms | The BAA comes by default through the Microsoft Online Services DPA for customers that are covered entities or business associates. The Commercial in-scope table lists 'Microsoft Copilot' and 'Microsoft Copilot Chat'. The HIPAA page does not use the exact name 'Microsoft 365 Copilot', but Microsoft's EDP page says Microsoft Copilot and Copilot Chat support HIPAA compliance when properly configured.[1],[2] |
| Microsoft 365 Copilot Chat (free with eligible work/school Entra accounts) | Signs a BAA | Included in the terms | Copilot Chat is named in the Commercial and GCC in-scope lists. Enterprise data protection under the DPA and Product Terms applies to prompts and responses for eligible work and school accounts.[1],[2],[3] |
| Office 365 GCC | Signs a BAA | Included in the terms | The GCC in-scope table lists Microsoft Copilot and Microsoft Copilot Chat. The HIPAA page gives no in-scope service table for GCC High or DoD.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Copilot / Copilot Chat prompts and responses (enterprise data protection) | Covered | Prompts and responses get EDP under the DPA and Product Terms, with Microsoft acting as processor. Microsoft says Copilot and Copilot Chat support HIPAA compliance for properly configured implementations.[1],[2],[3] |
| Web search grounding (Bing web queries) | Excluded | Microsoft says HIPAA compliance does not apply to web search queries because the DPA and BAA do not cover them. Bing operates as an independent data controller under the Microsoft Services Agreement. Admins can switch off web search, which is an optional connected experience.[2],[4],[5] |
| Third-party plugins / connectorsMicrosoft 365 commercial (Microsoft 365 Copilot license) | Excluded | Microsoft tells customers to check each third-party plugin's own privacy statement and terms. These plugins fall outside Microsoft's own commitments.[5] |
Sources
- HIPAA/HITECH - Microsoft compliance
- Enterprise data protection in Microsoft 365 Copilot and Microsoft 365 Copilot Chat
- Privacy and protections for Copilot Chat
- Manage access to public web content in Microsoft 365 Copilot
- Data, Privacy, and Security for Microsoft 365 Copilot
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.