Microsoft 365 and HIPAA BAA - do you need to do anything?

[beta]

If you use Microsoft 365 services (like Azure AD, Exchange Online, Teams, etc.) and you are using it to store or process health information, do you need to do anything to enter into a BAA with Microsoft?

We are not a healthcare org, but we are starting to partner with them and will need to be HIPAA compliant and have a BAA in place with our 3rd party vendors.

In doing a little research, I think (but am not sure) that a HIPAA BAA is triggered just by using a service that is covered by Microsoft’s “Products and Services Data Protection Addendum”, which is part of the terms of service you agree to when you subscribe to a service like Exchange Online for example. Then, if you store protected health information in a service covered by this addendum, automatically Microsoft’s BAA is entered into.

So, there isn’t anything you actually need to sign or request. Is this an accurate understanding of how it works?

Anyone who works with healthcare data and M365 could share some info?

Thanks!

[Rod-IT]

You are on the right track.

Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act - Microsoft Compliance | Microsoft Learn

There isn’t a separate document to sign for the Business Associate Agreement (BAA) with Microsoft. When you use Microsoft services covered by the BAA (such as Exchange Online), the agreement is automatically entered into based on the terms of service. Essentially, by using the covered services, you’re already bound by the BAA. It’s a seamless process that doesn’t require additional signatures or requests