Is Microsoft 365 HIPAA Compliant? Outlook, OneDrive, SharePoint and GoDaddy Email

Microsoft 365 can be used with protected health information (PHI). It is not "HIPAA compliant" out of the box, and no software is. Three conditions have to be true together. Your organization has a business associate agreement (BAA) with the vendor. The specific services you use are in scope on a plan that is covered. Your practice has configured those services and trained staff to use them correctly. This page checks Outlook, OneDrive, SharePoint, Teams and GoDaddy's resold Microsoft email against those three conditions. Every vendor policy is marked for verification so you can confirm it against current sources with your privacy officer or IT provider.

The short answer: can you use Microsoft 365 with PHI?

Yes, if three conditions are met:

1. A BAA is in place. Microsoft offers a HIPAA BAA for its in-scope business online services. Check how it applies to your agreement in the Microsoft Product Terms and Data Protection Addendum, and keep the current wording on file.
2. The services you use are in scope. The BAA covers named services, not "everything with a Microsoft logo." Check the current in-scope list Microsoft publishes and note the date you checked it.
3. You configure and use them correctly. That covers encryption for outside recipients, sharing limits, MFA, device controls, audit logs and staff habits.

HIPAA has no official certification program. When a vendor says its product is "HIPAA compliant," it means the vendor will sign a BAA and offers safeguards you can use. Whether your practice is compliant depends on how you set things up and run them. A covered entity is a provider, health plan or clearinghouse that handles PHI. A business associate is a vendor that creates, receives, stores or transmits PHI on the covered entity's behalf. If you need a refresher, see what a business associate agreement (BAA) is.

Consumer accounts are a separate question. Outlook.com, Hotmail, Live.com, personal OneDrive and Microsoft 365 Personal or Family subscriptions are consumer services. Do not assume any BAA covers them. Do not use them for patient information, even when the front desk finds them convenient.

Product	BAA coverage	Plan requirement	Key setting to check
Outlook / Exchange Online	Confirm on Microsoft's in-scope services list	Business or enterprise tenant; not Outlook.com	Message encryption for external PHI; block auto-forwarding
OneDrive for Business	Confirm on Microsoft's in-scope services list	Business or enterprise tenant; not personal OneDrive	External sharing and "Anyone" links restricted
SharePoint Online	Confirm on Microsoft's in-scope services list	Business or enterprise tenant	Site-level sharing, group-based permissions
Microsoft Teams	Confirm on the in-scope list, including any excluded features	Business or enterprise tenant	Guest and external access settings
Microsoft 365 email from GoDaddy	Confirm in writing who signs the BAA: GoDaddy or Microsoft	Confirm whether your GoDaddy email product is Microsoft-based	Written BAA confirmation before any PHI

Which Microsoft 365 and Office 365 plans are covered

"Office 365" and "Microsoft 365" are often used interchangeably. Microsoft has renamed many plans, so check the plan name on your invoice or in the admin center, not what someone remembers buying.

Business plans (for organizations up to 300 users):

• Business Basic: Confirm BAA coverage and the in-scope services for this plan. Includes web and mobile Office apps, Exchange Online, OneDrive and SharePoint.
• Business Standard: Confirm BAA coverage. Adds desktop Office apps.
• Business Premium: Confirm BAA coverage. Typically adds security and compliance tools such as device management and conditional access; check the exact feature list for your subscription.

Enterprise and frontline plans:

• E3 and E5: Confirm BAA coverage. These usually include broader compliance tooling; check which plan includes the message encryption, DLP, retention and audit features you need.
• F1 and F3 (frontline workers): Confirm BAA coverage. Relevant for clinics licensing front desk or support staff on lower-cost seats. Check which mailbox and storage features those seats include, since frontline licenses can include less than full business seats.

Features matter more than plan name. A plan can be in BAA scope and still lack tools you need. Depending on the plan, built-in message encryption or data loss prevention (DLP) may not be included, or may come only with higher tiers such as Business Premium or E3 and above. Check the feature list for your plan before relying on it. If your practice emails PHI to outside parties such as referral offices, labs or billing companies, confirm that your plan includes encryption. Otherwise ask your IT provider or Microsoft partner about adding it.

Finding the official documentation. Microsoft publishes compliance documentation, including HIPAA/HITECH material and its in-scope services information, on its Service Trust Portal. Page names change, so search the portal for HIPAA. Save a dated copy with your BAA records. Auditors and your privacy officer will want to see what was in scope when you made the decision.

Outlook and Exchange Online: email, encryption and calendar

Outlook is a client, not the service. The Outlook app on a desktop or phone can connect to an Exchange Online mailbox under your business tenant, to a personal Outlook.com account, or to a Gmail account. Coverage depends on the mailbox behind the app. A front desk computer with both the practice mailbox and someone's personal Hotmail in the same Outlook window has one covered account and one uncovered account. Remove the personal account.

TLS is not the same as message encryption. Exchange Online uses TLS to encrypt mail in transit between servers when the receiving server supports it. TLS protects the connection. It does not control what happens after the message lands in a recipient's inbox, and it is not end-to-end encryption. When PHI goes to someone outside your organization, use message-level encryption: Microsoft Purview Message Encryption, previously called Office Message Encryption. Check that your plan includes it. It typically offers options such as Encrypt and Do Not Forward.

How to send an encrypted email in Outlook (menu labels change between versions, so expect small differences):

• Outlook for Windows (desktop): Open a new message → Options tab → Encrypt → choose Encrypt-Only or Do Not Forward → send.
• Outlook on the web: New message → Encrypt in the toolbar, or the … menu → choose the encryption option → send.
• Outlook mobile (iOS/Android): New message → … or settings icon → Encryption / Sensitivity → choose the option → send.

The recipient typically gets a message that opens in their own mail app if supported, or through a secure portal where they verify their identity.

Optional admin rule. Staff forget to click Encrypt. An administrator can create a mail-flow (transport) rule in the Exchange admin center that encrypts outgoing external mail automatically when it matches a keyword (for example, "[secure]" in the subject), a sensitivity label or a DLP match. Test it with a staff member before relying on it.

Outlook calendar. Appointment titles, locations, attendee names and notes can all contain PHI. A calendar entry titled "Maria Lopez – biopsy results call" is PHI. If that calendar is shared with a vendor, synced to a personal phone calendar or visible to everyone in the organization, you have a disclosure problem. Keep calendar sharing internal, limit free/busy detail for external users, and use minimum-necessary titles such as "Callback – Room 2 hold" or "Pt callback (see EHR)." The patient detail stays in your clinical or scheduling system.

Emailing patients directly. Patients have a right of access to their information under HIPAA. HHS has published guidance on sending information to patients by unencrypted email at their request after they have been told the risks. Your privacy officer should review that guidance, decide how to document a patient's preference, and set the policy and the warning wording. Front desk staff should not improvise it.

OneDrive for Business and SharePoint Online: storage and sharing

Business vs. personal. OneDrive for Business is the storage attached to each user in your Microsoft 365 tenant. Personal OneDrive, signed in with a Microsoft consumer account, is a different product. The icons look nearly identical, and staff mix them up. SharePoint Online hosts team sites and document libraries, and OneDrive for Business runs on the same platform. Confirm both services on Microsoft's in-scope list, and keep PHI out of personal OneDrive.

The main risk is sharing configuration. Most OneDrive and SharePoint incidents in small practices come from a share link, not a breach of Microsoft. Someone sends an "Anyone with the link" URL for a spreadsheet of patient balances to an outside billing contact, and that link keeps working for months. In the SharePoint admin center (setting names may differ slightly in your version):

• Set the organization-level external sharing limit to the most restrictive level your workflows allow. Disable "Anyone" links if possible.
• Set the default link type to People in your organization, not "Anyone."
• If external sharing is needed, require guests to sign in or verify by code, and set link expiration (for example, 7 or 30 days).
• Set sharing more tightly on individual sites that hold PHI than on general admin sites.

Access by group, not by person. Grant access to a Microsoft 365 group such as "Billing – North Clinic," not to five named individuals. When someone leaves, removing them from the group removes access everywhere. Add a site permissions review to your offboarding checklist. Use conditional access to block or limit sync to unmanaged devices, so a former employee's home laptop doesn't keep a synced copy of a billing folder. Check that your plan includes conditional access and device management.

Retention, versions, audit and labels. Turn on audit logging. Set retention policies that match your records policy, and apply sensitivity labels to libraries that hold PHI. Availability of these features varies by plan, so check yours. Version history helps you recover from accidental overwrites and ransomware.

A practical folder structure for a clinic:

Library	Contents	Owner	Sharing
Admin & Operations	Policies, vendor contracts, supply lists, facility docs	Practice administrator	Internal only
HR	Staff files, credentials, payroll exports	HR lead	Restricted group, no external
Patient-related	Referral packets, billing exceptions, records requests in progress	Office manager / billing lead	Restricted group; external only via expiring, sign-in links
Location shared	Front desk procedures, daily huddle notes (no PHI)	Clinic manager per site	Internal only

Keep clinical documentation in your EHR, not in SharePoint folders that recreate a shadow chart.

GoDaddy email and HIPAA

Many practices bought their domain and email from GoDaddy years ago. GoDaddy sells Microsoft 365 email as a reseller. In that setup the mailbox runs on Exchange Online, but GoDaddy is the reseller that controls the tenant relationship. That raises the key question: who signs the BAA, GoDaddy or Microsoft? GoDaddy's policy can change, so get its current answer in writing, with a date, before relying on either.

GoDaddy also sells its own Professional Email, which is not Microsoft-based. Ask GoDaddy directly about BAA status for that product. Check which product you have in your GoDaddy account before you assume anything.

If you cannot get a BAA for your GoDaddy mailbox, you have two options:

• Move the tenant to Microsoft directly or to another Cloud Solution Provider (CSP) that will sign a BAA. This usually means taking the tenant away from GoDaddy, sometimes called defederation. Plan it with your IT provider, including the supported path and expected downtime. DNS, licensing and mailbox data are all involved.
• Stop using that mailbox for PHI until coverage is confirmed. That means no referral attachments, no patient names in subjects and no billing exports.

Questions to ask GoDaddy support, in writing:

1. Is our email product Microsoft 365 from GoDaddy or GoDaddy Professional Email?
2. Will GoDaddy sign a BAA for this product? If so, send the agreement.
3. If not, does Microsoft's BAA apply to our tenant while GoDaddy is the reseller?
4. Which plan are we on, and does it include message encryption?
5. What is the supported process to transfer our tenant to another provider?

File the replies with your BAA records. A chat transcript saying "yes, it's HIPAA compliant" is not a BAA.

Checklist: how to set up Microsoft 365 for HIPAA

Hand this to your IT manager or MSP. Each item needs an owner and a date.

Agreement and scope

• BAA confirmed and a copy stored with your compliance records.
• Every service staff actually use (Exchange, OneDrive, SharePoint, Teams, Forms, Bookings and others) checked against the in-scope list.
• Consumer Microsoft accounts removed from practice devices.

Identity

• MFA required for all users, including part-time and per-diem staff.
• Conditional access policies for location and device (confirm your plan includes it).
• Legacy authentication disabled.
• Separate admin accounts. No one reads daily email as a global admin.

Email

• Message encryption available and an encryption mail-flow rule in place.
• DLP rules for identifiers such as SSNs and medical record number formats (confirm your plan includes DLP).
• Automatic forwarding to external domains blocked.

Files

• External sharing restricted at tenant and site level; "Anyone" links off or limited.
• Sensitivity labels and retention policies applied to PHI libraries.
• Audit logging on; access reviews scheduled quarterly.

Devices and people

• Laptops and phones enrolled in device management, with remote wipe (confirm your plan includes device management).
• Offboarding procedure that removes licenses, group memberships, shared mailbox access and synced devices on the last day.
• Annual staff training covering encryption, calendar titles and personal accounts.
• Security risk analysis documented and updated, as the HIPAA Security Rule requires (45 CFR 164.308(a)(1)(ii)(A)); review transmission security (45 CFR 164.312(e)) with your privacy officer or counsel.

For BAA tracking sheets and risk checklists you can adapt, see our free HIPAA tools and templates.

What Microsoft 365 does not cover for a practice

Shared responsibility. Microsoft secures the service: data centers, infrastructure and the application. Your practice owns configuration, user access, device security, staff training and policies. A correctly signed BAA does not fix an "Anyone" link to a patient list.

Third-party add-ins and connectors. Outlook add-ins, e-signature plug-ins, CRM connectors and personal apps on the same phone are run by other vendors. Do not assume Microsoft's BAA covers them. Each one needs its own BAA review, or a policy that it never touches PHI.

The gap many clinics have: staff chat. Email is too slow for "Who can cover front desk at the east location at 7:30?" or "Fax machine down again, who has the vendor number?" So staff fall back on personal text threads and WhatsApp groups. Those threads often drift into patient names and schedules. That is shadow IT outside any BAA, on personal devices you can't wipe when someone leaves.

Teams is part of Microsoft 365 and can be in BAA scope; confirm it, and any features you use, on Microsoft's in-scope list. If your staff already use Teams, configure it under the same checklist. Practices that don't use Teams often pick a separate staff chat. One option is Chanty, internal team chat and task coordination for clinic staff. It is used alongside Microsoft 365 and clinical systems, with HIPAA support under a signed BAA on Business and Enterprise plans (no BAA on Free). It covers operational coordination only, not patient messaging or clinical alerts. See HIPAA-compliant staff chat with a signed BAA or review team chat tools compared on HIPAA.

Other tools to check

• Comparing suites? Read Google Workspace and HIPAA for the same checks on Gmail, Drive, Meet and Calendar.
• Files living outside OneDrive? See Dropbox, iCloud and HIPAA-compliant cloud storage.
• Browse all HIPAA checks for popular tools, including video apps such as Zoom and FaceTime, scheduling, payments and work apps.

FAQ

Is Office 365 HIPAA compliant out of the box?

No. Office 365 / Microsoft 365 can support HIPAA compliance when a BAA is in place, the services you use are in scope and you configure them correctly. Check Microsoft's current BAA terms. Default settings, such as permissive sharing links, may not match your policies.

Which Microsoft 365 plans include a BAA: Business Basic, Standard or Premium?

Confirm coverage for your specific plan against Microsoft's current BAA terms and in-scope services list; do not assume every plan is covered. Even where coverage is the same, features differ. Encryption and DLP may require Business Premium, E3 or an add-on.

Is Outlook email encrypted enough for HIPAA?

TLS in transit is a baseline, not the whole answer, and Outlook is not end-to-end encrypted. For PHI sent outside your organization, use message encryption (Microsoft Purview Message Encryption) if your plan includes it, and confirm your approach with your privacy officer.

How do I send a HIPAA-compliant encrypted email in Outlook?

In a new message, open Options (desktop) or the toolbar/… menu (web, mobile), choose Encrypt or Do Not Forward, then send. Labels vary slightly by version. Ask IT to add a mail-flow rule so encryption also applies automatically.

Is Outlook.com or a personal Hotmail account HIPAA compliant?

Treat them as not usable for PHI. Do not assume a business BAA extends to consumer Microsoft services.

Is OneDrive for Business HIPAA compliant, and what about personal OneDrive?

OneDrive for Business can be used with PHI when it is on Microsoft's in-scope list under your BAA and sharing is locked down. Personal OneDrive is a consumer product. Keep PHI out of it.

Is SharePoint Online HIPAA compliant?

SharePoint Online can be used with PHI under a BAA if it is on Microsoft's in-scope list. Compliance depends heavily on site permissions, external sharing settings, audit logging and retention.

Is GoDaddy email HIPAA compliant, and will GoDaddy sign a BAA?

It depends on which GoDaddy product you have and GoDaddy's current BAA policy, which can change. Get the answer in writing before any PHI goes through the mailbox.

Can I put patient names in Outlook calendar appointments?

Only if the calendar sits in a covered mailbox, sharing is internal and the detail is necessary. A safer habit is minimum-necessary titles ("Pt callback – see EHR"), with patient details kept in your scheduling or clinical system.

Do I need to sign a separate BAA with Microsoft?

Check Microsoft's current Product Terms and Data Protection Addendum to see whether the BAA applies automatically to your agreement or requires separate acceptance. Either way, keep documentation of the BAA and the in-scope services list with your compliance records. Check with your privacy officer or counsel whether that documentation is enough for your organization.