Are Microsoft Copilot (consumer app)'s AI features covered by the BAA?

Copilot Health (consumer preview): coverage not stated.

Does Microsoft Copilot (consumer app) sign a BAA?

Q: Does Microsoft Copilot (consumer app) sign a HIPAA BAA?

Not confirmed. Microsoft publishes no BAA path for consumer Copilot used with a personal Microsoft account. It is governed by the consumer Copilot Terms and the Microsoft Services Agreement, and Microsoft's documented BAA runs only through the commercial DPA.

Not confirmed

Microsoft publishes no BAA path for consumer Copilot used with a personal Microsoft account. It is governed by the consumer Copilot Terms and the Microsoft Services Agreement, and Microsoft's documented BAA runs only through the commercial DPA.

Based on 4 sources, all from Microsoft unless marked.

Business associate: Microsoft
Tool: Microsoft Copilot (consumer app)
Plans with a BAA: Not stated
Checked: Oct 11, 2026

Not confirmed

No BAA offer found on Microsoft's own pages.

By plan

Plan	BAA	How to get it	Conditions
Free / Microsoft 365 Personal, Family, Premium (personal Microsoft account)	Not confirmed	Not stated	The consumer Terms say they and the Microsoft Services Agreement govern Copilot, and they do not apply to Entra (work/school) sign-ins. Neither document mentions HIPAA or a BAA. Consumer Copilot does not appear in Microsoft's HIPAA in-scope list, which is delivered through the commercial DPA. Microsoft does not state outright that it refuses a BAA here.[1],[2],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.

AI feature	Under the BAA	Details
Copilot Health (consumer preview)	Not stated	Microsoft calls Copilot Health a direct-to-consumer wellness product and says HIPAA does not apply to most such products. The page does not mention a BAA. Health data is governed by Microsoft's Consumer Health Data Privacy Policy.[4],[2]

AI chat assistants that offer a BAA

ChatGPTBAA on: ChatGPT FedRAMP, ChatGPT for Clinicians, ChatGPT for Healthcare, Edu, EnterpriseSome plans only
Claude apps (Claude.ai)BAA on: Enterprise (self-serve or sales-assisted)Some plans only
GrokBAA on: API (ZDR-enabled)Some plans only
PerplexityBAA on: API (Sonar), Enterprise Pro / Enterprise MaxSome plans only
BastionGPTBAA on: API, Professional, Professional Plus, Ultra (Enterprise)Signs a BAA
CompliantChatGPTBAA on: Enterprise, Starter / Pro / FullSigns a BAA

All BAA-ready alternatives to Microsoft Copilot (consumer app)

Sources

HIPAA/HITECH - Microsoft complianceMicrosoft, Documentation. Checked Oct 11, 2026.
Copilot - Terms of UseMicrosoft, Legal terms. Checked Oct 11, 2026.
Microsoft Copilot privacy overviewMicrosoft, Help center. Checked Oct 11, 2026.
About Copilot HealthMicrosoft, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.