'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Sign a HIPAA Business Associate Agreement with Microsoft
Question details
The user wants to know how to establish and formalize a HIPAA Business Associate Agreement (BAA) with Microsoft for their organization's cloud services.
- Product
- Microsoft 365 and Azure
- Device & OS
- not provided
- Scenario
- Establishing HIPAA compliance for healthcare data stored or processed in Microsoft cloud services.
- Observed behavior
- The user needs a formalized BAA to ensure regulatory compliance but requires guidance on where to find or execute the agreement within the Microsoft ecosystem.
Ensure you have global administrator or billing administrator privileges in your Microsoft 365 admin center before attempting to review legal agreements or compliance assessments.
Apply the Microsoft BAA via Online Services Terms
Microsoft does not require a physical signature for the BAA; it is automatically provided to eligible customers through the Microsoft Online Services Terms.
If your organization is an eligible covered entity or business associate, Microsoft provides the Business Associate Agreement by default. The agreement applies automatically to in-scope cloud services across Microsoft 365 and Azure.
Ensure the specific Microsoft 365 or Azure services you use are covered by checking the Microsoft Trust Center documentation for HIPAA compliance.
Acknowledge that the BAA is executed automatically as part of the Microsoft Online Services Terms (OST). You do not need to sign a separate physical document to establish compliance.
Log in to the Microsoft Purview compliance portal. Navigate to the 'Compliance Manager' section in the left sidebar to review your built-in HIPAA assessment.
If you need a physical copy of the agreement or have specific billing questions, go to the Microsoft 365 admin center, click 'Support' in the left navigation menu, and select 'Help & support' to open a ticket.
Need a Secure and Lightweight Office Suite Alternative?
While navigating complex enterprise compliance requirements in Microsoft 365, you may also need a fast, reliable, and user-friendly office suite for your daily documentation. WPS Office offers an excellent, secure alternative with full file compatibility and a seamless user experience.
- 1. Download the software: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install and launch: Run the installer, follow the simple on-screen prompts, and open WPS Office once the installation finishes.
- 3. Open your files: Simply double-click your existing Microsoft Word, Excel, or PowerPoint files to open and edit them seamlessly in WPS Office.
Frequently Asked Questions
Do I need to physically sign a HIPAA BAA with Microsoft?
No. For eligible covered entities and business associates, the HIPAA BAA is automatically incorporated and executed through the Microsoft Online Services Terms (OST) when you purchase and use in-scope services.
Which Microsoft cloud services are covered by the BAA?
The agreement applies to a wide range of in-scope enterprise services, including Microsoft 365, Microsoft Azure, Microsoft Dynamics 365, and Microsoft Power Platform. Always verify the latest in-scope list in the official Microsoft Trust Center.
Where can I view my organization's HIPAA compliance status?
You can track your organization's compliance posture by logging into the Microsoft Purview compliance portal and utilizing the Microsoft Compliance Manager, which includes a dedicated HIPAA assessment template.
