Compliance Problems

Does Microsoft OneNote Include a HIPAA Business Associate Agreement?

Maira Mehtab Sep 27, 2026 869 views

Question details

Organizations and individuals need to know if a HIPAA Business Associate Agreement (BAA) is automatically included when using OneNote for handling protected health information.

Product: Microsoft OneNote
Device & OS: not provided
Scenario: Using OneNote for HIPAA-related work involving protected health information (PHI).
Observed behavior: Determining the contractual and licensing requirements for obtaining a Microsoft BAA to ensure HIPAA compliance.

Before you start

Ensure you have access to your Microsoft 365 administrative portal and subscription details to verify your current plan's eligibility.

Solution 1Recommended

Obtain a BAA through an Eligible Microsoft 365 Plan

OneNote does not automatically include a BAA. You must use an eligible Microsoft 365 enterprise or business subscription to obtain one.

Microsoft provides a BAA only with specific commercial subscriptions, such as Microsoft 365 Business, Business Premium, E3, and E5. Personal and family plans are not eligible.

Verify your subscription

Log into the Microsoft 365 admin center and navigate to the 'Billing' or 'Your products' section to ensure your plan is Business, Business Premium, E3, or E5.

Review compliance documentation

Visit the Microsoft Service Trust Portal to review the current HIPAA and HITECH compliance documents and understand your responsibilities regarding PHI.

Contact Microsoft Support

Reach out to Microsoft Support or your dedicated account representative to request and apply the Business Associate Agreement to your organization.

Important for Small Practices: A single-owner S corporation or self-employed mental health therapist must still purchase a qualifying commercial or enterprise plan to be eligible for a BAA.

Free Microsoft Office alternative

Try WPS Office for a Lightweight Document Solution

While handling protected health information requires specific Microsoft enterprise plans and a formal BAA, you may also need a fast, reliable office suite for standard administrative tasks. WPS Office serves as a highly compatible, free, and lightweight alternative for your general document processing needs, offering a familiar user interface and seamless file compatibility.

1. Download the installer: Visit the official WPS Office website and click the free download button.
2. Install the software: Run the downloaded file and follow the straightforward on-screen instructions to install the suite.
3. Start creating documents: Open WPS Office to instantly view, create, or edit your standard office files with ease.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture ensures fast installation and smooth operation on any device.Familiar user interface requires no learning curve.Built-in PDF editing tools for secure and easy document handling.

microsoft office alternative - wps office

Frequently Asked Questions

Can a self-employed therapist get a BAA for OneNote?

Yes, but they cannot use a standard personal or family Microsoft account. They must purchase an eligible commercial Microsoft 365 subscription, such as Business Premium, and formally execute the BAA with Microsoft.

Does the free version of OneNote include a HIPAA BAA?

No. The free or consumer versions of OneNote do not include a BAA and are not compliant for handling Protected Health Information (PHI).

Which Microsoft 365 plans include a BAA?

Microsoft typically provides a BAA with specific enterprise and business subscriptions, including Microsoft 365 Business, Business Premium, E3, and E5.

Is OneNote automatically HIPAA compliant once I upgrade my plan?

No. Software is not inherently HIPAA compliant out-of-the-box. You must have an executed BAA with Microsoft and properly configure OneNote and Microsoft 365 with appropriate access controls, encryption, and safeguards.

Microsoft Office Security Issues