Is Microsoft Copilot HIPAA compliant?
Yes for Microsoft 365 Copilot and Copilot Chat used under a commercial Microsoft 365 licence, where the agreement already applies — but the consumer Copilot signed into with a personal account is a different product and is not named in scope.
Applies to Microsoft 365 Copilot and Microsoft 365 Copilot Chat. Last reviewed against Microsoft's own documentation. Next review November 3, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Use Microsoft 365 Copilot or Microsoft 365 Copilot Chat under a commercial Office 365 or Microsoft 365 licence. Microsoft names both in its in-scope service list for Office 365 Commercial and for the Government Community Cloud.
- Nothing separate to sign: the agreement arrives through the Product Terms and Data Protection Addendum, the same route as the rest of the tenant.
- Have staff sign in with the organisational account. A personal Microsoft account puts the session outside the in-scope service entirely.
- Treat prompts as disclosures. What a staff member pastes into Copilot is a use of patient information and belongs under the same minimum-necessary thinking as any other system.
- Microsoft states directly that having an agreement does not on its own achieve compliance — your programme and your configuration remain yours.
Does Microsoft Copilot sign a business associate agreement?
Yes. Microsoft offers one. A commercial Office 365 or Microsoft 365 licence carrying Microsoft 365 Copilot or Copilot Chat. Also in scope for Government Community Cloud tenants. Nothing to request. The agreement is available by default through the Product Terms to customers that are covered entities or business associates.
What this means in practice
The name is doing a lot of damage here. Microsoft ships several distinct things called Copilot, and only some of them appear on the in-scope list. Microsoft 365 Copilot and Microsoft 365 Copilot Chat are named for Office 365 Commercial and for the Government Community Cloud; the free consumer Copilot someone signs into with a personal account is not. Same brand, same icon, entirely different contractual position.
Where it is in scope, the agreement is already there — it arrives through the Product Terms with the rest of the tenant, so there is nothing to arrange. That makes the practical control an identity question rather than a procurement one: is the person signed in with the organisational account, or their own?
The part no agreement touches is what gets typed. A prompt containing a patient's history is a use of patient information, and minimum-necessary thinking applies to it exactly as it does to an email. Staff who would never email a full chart will happily paste one into an assistant, because it does not feel like sending it anywhere.
How organizations get this wrong
The specific mistakes we see with Microsoft Copilot, not generic advice.
- Assuming every product called Copilot is covered, when the consumer version is not named in the in-scope list at all.
- Letting staff use Copilot signed in with a personal Microsoft account on a work device, which leaves the tenant and the agreement behind.
- Attaching third-party plugins or connectors and assuming Microsoft's agreement follows the data into them.
- Treating prompts as private scratch space rather than as a disclosure subject to the same judgement as any other.
What the agreement does not cover
- The free consumer Copilot. It is not named among the in-scope Office 365 commercial services, and Microsoft's list is a positive one — absence is not an oversight to read past.
- Third-party plugins, connectors and agents attached to Copilot.
- What your staff choose to type into it, which no agreement can constrain.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
The other mainstream assistant with a published position on patient data
Covered inside Google Workspace once an administrator accepts the agreement
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Microsoft Copilot, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Microsoft’s own published documentation, read on the date shown.
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act — Microsoft Compliance — Microsoft. Published July 29, 2025. Read August 10, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Microsoft’s published documentation as read on August 10, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.