Microsoft HIPAA BAA: Where to Find It
A quick video and written walkthrough for finding Microsoft's HIPAA Business Associate Agreement for Microsoft 365 and related cloud services.
By Chris Chobot - Published June 15, 2026
A practical walkthrough showing where Microsoft makes its HIPAA Business Associate Agreement available for Microsoft 365 customers.
Watch on YouTube1. Where to find the Microsoft HIPAA BAA
Microsoft makes its HIPAA Business Associate Agreement available through the Microsoft Service Trust Portal. The shortcut shown in the video is aka.ms/baa, which redirects to the Service Trust Portal document page.
You may need to sign in with a Microsoft account tied to your organization before the portal shows the document. If your organization uses Microsoft 365 for work, sign in with the same work account you use for Microsoft 365 administration or compliance review.
- Open aka.ms/baa or go to the Microsoft Service Trust Portal.
- Sign in with the Microsoft work account connected to the organization.
- Open the Microsoft HIPAA Business Associate Agreement document.
- Save the document or record where it is stored for your organization's vendor and BAA records.
2. What the BAA does and does not do
Microsoft states that it offers a Business Associate Agreement for covered entity and business associate customers, and that the Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default for customers covered under HIPAA.
That does not mean Microsoft 365 usage automatically makes an organization HIPAA compliant. Your organization still has to configure services appropriately, train staff, manage access, keep policies current, review vendors, and document how PHI is protected in day-to-day workflows.
3. What to document after you find it
After finding the Microsoft BAA, treat it as one piece of your vendor record. Record the vendor name, the service being used, whether the vendor may create, receive, maintain, transmit, or access PHI, and where the agreement evidence is stored.
If your organization uses Microsoft 365, SharePoint, OneDrive, Teams, Exchange Online, Power Platform, Azure, or other Microsoft cloud services for PHI-related work, review Microsoft's in-scope service list and confirm that your actual subscription and configuration match the way your organization intends to use the service.
- Track Microsoft as a vendor if Microsoft services support PHI-related workflows.
- Record BAA status and where evidence is stored.
- Review staff access, MFA, sharing settings, retention, device access, and audit logging separately.
- Revisit the record when services, subscriptions, or PHI workflows change.
4. Important note
This page is educational and is not legal, regulatory, or cybersecurity advice. For legal interpretation, contract questions, or organization-specific HIPAA obligations, involve qualified counsel or compliance advisors.
Resources
These sources support the educational material on this page. They are not legal advice.
Explains Microsoft's HIPAA/HITECH offering, in-scope services, and Business Associate Agreement availability.
Directs Microsoft customers to the Service Trust Portal location for the Microsoft HIPAA Business Associate Agreement.
Supports business associate identification, contracts, and vendor oversight involving PHI.
Supports business associate contract requirements for vendors that create, receive, maintain, or transmit PHI.
45 CFR §164.502(e)|Disclosures to business associatesSupports business associate requirements for certain disclosures of PHI to vendors or service providers.