Does Microsoft Dragon Copilot sign a BAA?
Yes, it signs a BAA
Microsoft's licensing Privacy & Security Terms for Dragon Copilot refer to the Microsoft HIPAA Business Associate Agreement and say customer data may contain PHI. That indicates Dragon Copilot is used under Microsoft's BAA. Microsoft's HIPAA compliance page does not yet list Dragon Copilot among its in-scope services.
- Business associate
- Microsoft
- Tool
- Microsoft Dragon Copilot
- Plans with a BAA
- Dragon Copilot (enterprise, via Microsoft volume licensing: EA/EAS, EES, MOSA); Dragon Copilot Physician Practice / Flex editions
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Dragon Copilot (enterprise, via Microsoft volume licensing: EA/EAS, EES, MOSA) | Signs a BAA | Included in the terms | The Dragon Copilot section of the Privacy & Security Terms defines PHI by reference to the HIPAA BAA (aka.ms/BAA). Microsoft says its HIPAA BAA reaches covered entities and business associates by default through the Data Protection Addendum. 'auto_included' is therefore based on those two documents; no Dragon Copilot page says it in so many words. Microsoft's HIPAA in-scope services list (last updated 2025-07-29) does not name Dragon Copilot.[1],[2],[3] |
| Dragon Copilot Physician Practice / Flex editions | Signs a BAA | Included in the terms | Product Terms list Physician Practice (EA/EAS, EES, MOSA) and Flex (MOSA) user licenses. The Dragon Copilot privacy terms that reference the BAA apply to Dragon Copilot as a whole and do not single out any edition. Practices buy through Microsoft licensing programs or partners.[1],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Ambient clinical documentation and generative AI features | Covered | Dragon Copilot customer data, which may include PHI, is handled under the BAA. Under the same terms the customer also tells Microsoft to use customer data, including through human review, to train and develop AI/ML models, and Microsoft may create de-identified health information and use it for any lawful purpose. Microsoft's privacy white paper says models are trained only on anonymized data. Audio and transcripts are kept for up to 90 days.[1],[4],[5] |
Sources
- Product Terms: Privacy & Security Terms (Microsoft Dragon Copilot section)
- HIPAA/HITECH - Microsoft compliance
- Microsoft Dragon Copilot product offering terms
- Dragon Copilot privacy white paper
- Frequently asked questions about Dragon Copilot
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.