Is OneDrive HIPAA compliant?
Yes for OneDrive for Business on a Microsoft 365 business subscription, where the agreement applies automatically, but the consumer OneDrive on a personal Microsoft account is a different product and is not covered.
Applies to OneDrive for Business. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Use OneDrive for Business, the service Microsoft names on its in-scope tables.
- No signature required: the agreement arrives through the Data Protection Addendum.
- Download the 'Microsoft General – HIPAA BAA' from the Service Trust Portal for your evidence file.
- Set your own sharing controls. Anonymous links, guest access, retention and deletion are your configuration.
- Review which third-party applications can read the drive.
Does OneDrive sign a business associate agreement?
Yes. Microsoft offers one. Applies by default to business and government Online Services customers. Coverage is scoped by service, not subscription tier. Nothing to request. Download the agreement from the Service Trust Portal.
What this means in practice
The list Microsoft publishes says 'OneDrive for Business', and that precision is most of the answer. The agreement arrives automatically through the Data Protection Addendum, and OneDrive for Business is named on the in-scope tables for both the Commercial and Government Community Cloud environments. Nobody has to sign anything.
Consumer OneDrive is a different product under different terms, and it is not the service Microsoft names. Staff who sync a work folder to a personal Microsoft account, or install the consumer client on a home machine and drag records into it, have put files somewhere Microsoft has made no commitment about, and the practice usually finds out only when the person leaves.
Microsoft is explicit that using its services does not on its own achieve compliance, and with storage that responsibility is mostly about sharing. Anonymous links, external guest access, retention schedules and which connected applications can read the drive are all yours to set. Download the agreement from the Service Trust Portal so there is a document to hand over when someone asks.
How organizations get this wrong
- Syncing a clinical folder to a staff member's personal Microsoft account, which is consumer OneDrive and outside the named service.
- Leaving anyone-with-the-link sharing enabled, so a records link forwarded outside the practice stays open indefinitely.
- Assuming the agreement extends to every app connected to the drive, when third-party tools are not Microsoft services on the list.
- Never downloading the agreement from the Service Trust Portal, then having nothing to produce when an auditor asks.
What the agreement does not cover
- Consumer OneDrive on a personal Microsoft account: Microsoft's list names 'OneDrive for Business' specifically.
- Any Microsoft service not named on the in-scope table.
- Third-party apps and integrations connected to the drive.
Keep a record of your OneDrive agreement
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act: Microsoft. Published July 29, 2025. Read July 29, 2026.
Microsoft can change these terms at any time. If something here no longer matches what Microsoft tells you, tell us.