Is Microsoft Teams HIPAA compliant? BAA coverage and setup

Yes, with conditions. Microsoft Teams can be used with protected health information (PHI) when your Microsoft 365 or Office 365 license includes Microsoft's Business Associate Agreement (BAA) and your admins configure Teams with the right safeguards. Teams is not "HIPAA compliant" on its own, and no other tool is either. This page covers what the BAA includes, a setup checklist, quick answers on Skype and Azure, and when a simpler staff chat may be a better fit for a clinic.

Short answer: Teams can be used under HIPAA, but only with a BAA and the right setup

Microsoft offers a BAA that covers Teams in eligible Microsoft 365 and Office 365 plans ; the BAA is delivered through the Microsoft Online Services Data Protection Addendum (DPA), referenced in the Product Terms, and Microsoft lists "Microsoft Teams" as an in-scope service for Office 365 Commercial and GCC rather than naming specific plans, so confirm your SKUs with your reseller (learn.microsoft.com). If your organization is on a qualifying commercial plan and has accepted those terms, Teams can carry PHI. That includes a front desk coordinator messaging billing about a patient's denied claim or a nurse manager sharing a referral packet in a channel.

To see how other tools compare, read our overview of team chat tools compared for HIPAA.

Three points matter more than the yes/no:

• HIPAA has no certification. No government body certifies software as "HIPAA compliant." The phrase means a covered entity uses a tool under a signed BAA, with administrative, physical and technical safeguards, written policies and staff training in place.
• Responsibility is shared. Microsoft secures the service and its infrastructure. Your practice configures who has access, how long messages are kept, which devices can connect, and what staff are allowed to post.
• Some things fall outside the BAA. Third-party apps and bots added to Teams are typically governed by their own vendor terms, not Microsoft's BAA Microsoft states that partner apps in Teams are not owned or controlled by Microsoft and are subject to their own terms and privacy statements, and admins can allow or block them. (learn.microsoft.com). Free or personal Teams accounts are a separate product from commercial Microsoft 365, so don't assume Microsoft's BAA extends to them.

What Microsoft's BAA covers in Teams: chat, calls, meetings, files

Microsoft publishes a list of services in scope for HIPAA. For Teams, the workloads to confirm are chat, channels, meetings, calling, and files, which are stored in SharePoint and OneDrive ; note that Microsoft's list names "Microsoft Teams" as a single service, alongside SharePoint Online and OneDrive for Business, rather than listing individual Teams workloads (learn.microsoft.com).

Teams workload	BAA status	What to check
1:1 and group chat	In scope as part of the "Microsoft Teams" service (not listed separately) (learn.microsoft.com)	Retention policy, DLP availability on your license
Channels and channel files	In scope; Teams shares files through SharePoint Online and OneDrive for Business, both in-scope services (learn.microsoft.com)	SharePoint site permissions, external sharing links
Meetings and calling	In scope as part of the "Microsoft Teams" service (not listed separately) (learn.microsoft.com)	Lobby settings, external and anonymous join
Recordings and transcripts	Recordings in scope, stored in the organizer's OneDrive (non-channel meetings) or the channel's SharePoint site (channel meetings); confirm transcript storage separately (learn.microsoft.com)	Who can access them, how long they're kept
Copilot and Teams Premium features	Microsoft Copilot and Microsoft Copilot Chat are listed as in scope (Commercial and GCC); Teams Premium is not listed separately, so confirm with Microsoft (learn.microsoft.com)	Confirm coverage before enabling for any PHI workflow
Third-party apps and bots	Outside Microsoft's BAA; partner apps follow their own vendor terms and privacy statements (learn.microsoft.com)	Each vendor's own BAA and data handling
Teams free / personal	Listed as in-scope service? (learn.microsoft.com)	Keep PHI out unless confirmed

You usually don't sign a separate paper BAA. Microsoft includes its HIPAA BAA in its online terms for qualifying licenses, so it applies through your agreement rather than a one-off signature ; it is incorporated through the Microsoft Online Services Data Protection Addendum (DPA) referenced in the Product Terms, Microsoft says there is no separate contract to sign, and a copy of the BAA is available on the Microsoft Service Trust Portal (learn.microsoft.com). Your compliance officer should still keep a copy of the terms with your HIPAA documentation.

Confirm your exact license SKU. Microsoft licensing has many plan names, add-ons and regional variants. Before staff start discussing patients in Teams, ask your Microsoft reseller or MSP to confirm in writing that your specific SKUs and any add-ons, such as recording, transcription or AI features, are covered.

Is Teams HIPAA compliant for telehealth?

Microsoft positions Teams for virtual visits under its BAA, including scheduling features for virtual appointments ; however, the Virtual Appointments app in Teams is no longer available, scheduling now runs through Microsoft Bookings (advanced features such as SMS notifications and the appointment queue require Teams Premium), and EHR-launched visits need Microsoft Cloud for Healthcare or the Teams EHR connector plus a license that includes Teams meetings (learn.microsoft.com). So the answer for telehealth is the same as for chat: it can be used if your license covers it and you configure it properly.

During the COVID-19 public health emergency, HHS's Office for Civil Rights relaxed enforcement for good-faith use of video tools in telehealth. That enforcement discretion has ended (the notifications of enforcement discretion expired at 11:59 p.m. on May 11, 2023, and the telehealth transition period ended at 11:59 p.m. on August 9, 2023; 88 FR 22380) (federalregister.gov), so a BAA and standard HIPAA safeguards now apply to video visits.

A note on scope: this page is mainly about staff communication. Patient-facing video visits need their own evaluation, which covers patient experience, identity verification, documentation in the EHR, and state telehealth rules. Chanty, which appears later on this page, is a staff chat tool and is not a telehealth or patient video platform.

If you run visits in Teams, a few practical habits help:

• Turn on the lobby so the clinician admits each patient. This keeps the next patient from joining while the previous visit is still going.
• Use unique, authenticated meeting links per appointment rather than one recurring "telehealth room."
• Keep PHI out of meeting titles and calendar invites. "Follow-up visit, 2:30" is fine. A patient's name and condition is not, because titles show up in calendars, notifications and email previews.
• Decide in advance whether visits are ever recorded, and where recordings live.

How to make Microsoft Teams HIPAA compliant: an admin checklist

Use this as a starting point for your IT lead or MSP. Setting names and license requirements vary by plan.

1. Confirm licensing and BAA coverage.

   • Record which SKUs you hold and confirm Teams and any add-ons are in scope.
   • Document Teams in your HIPAA risk analysis: what PHI goes into it, who uses it, and what safeguards apply.

2. Lock down identity and access.

   • Require multifactor authentication for every account, including the shared front desk login if you still have one. Better still, replace shared logins with named accounts.
   • Use conditional access to limit sign-ins by device or location ; Conditional Access requires Microsoft Entra ID P1 or P2, which is included in Microsoft 365 Business Premium but not in Entra ID Free or Office 365 plans alone (learn.microsoft.com).
   • Restrict guest access and external access (federation) to the domains you actually work with, such as your billing company ; in the Teams admin center, go to Users > External access and choose "Allow only specific external domains," while Users > Guest access is only an on/off switch with per-feature settings, so guest domain limits are handled in Microsoft Entra ID (learn.microsoft.com).

3. Set retention and data protection.

   • Create retention policies for Teams chats and channel messages that match your records policy.
   • Configure eDiscovery so your privacy officer can respond to a complaint or legal hold.
   • Apply sensitivity labels to teams that handle PHI, and DLP policies to flag patient identifiers where your license allows ; DLP for Teams chat and channel messages requires Office 365 or Microsoft 365 E5/A5/G5 or the E5 Compliance or Information Protection add-ons, while E3 covers DLP for files shared in Teams through SharePoint and OneDrive (learn.microsoft.com).

4. Control devices, apps and sharing.

   • Enroll phones and laptops in mobile device management, or use app protection policies on personal phones so you can wipe Teams data when someone leaves ; Microsoft 365 Business Premium includes Intune, which is an in-scope service under Microsoft's BAA (learn.microsoft.com).
   • Block third-party apps by default, then approve only those with their own BAA where they touch PHI.
   • Set SharePoint and OneDrive sharing links to "people in your organization" so a forwarded link to a lab report doesn't open for anyone.

5. Cover the people side.

   • Write a one-page policy that says what PHI belongs in chat (for example, scheduling and billing follow-up) and what stays in the EHR (clinical notes and orders).
   • Train staff at onboarding and once a year. Include part-time and float staff.
   • Add Teams to your offboarding checklist: disable the account, remove the device, and reassign team ownership.
   • Review guest accounts and team membership quarterly.

Microsoft Teams for healthcare: where it fits and where clinics struggle

Where it fits. If your organization already runs on Microsoft 365, with Outlook, SharePoint, Entra ID and an IT team or MSP that manages them, Teams is usually the logical choice. Licensing is often bundled. Files live in SharePoint, which you already govern. Meetings and calendars connect to Outlook, and Teams-native meetings and telephony are available , although Teams Phone is a paid add-on for Business Basic, Standard and Premium, Microsoft 365 E3 and Office 365 E1/E3 (it is included only in E5-level plans), and calling regular phone numbers also needs a Calling Plan or another phone-line option (learn.microsoft.com). Your existing identity, retention and device policies extend to Teams.

Microsoft also offers healthcare-specific resources, including Teams templates for care teams and Microsoft Cloud for Healthcare ; Microsoft confirms Teams includes templates designed specifically for healthcare organizations, and its industry offering is now presented as Microsoft for Healthcare (some Teams pages still say Microsoft Cloud for Healthcare) (learn.microsoft.com). Larger groups may find these useful as starting structures.

Where small clinics report friction. These are planning considerations, not judgments of Teams' quality:

• Admin effort. Getting the checklist above right touches several admin centers and license tiers. A two-location practice without in-house IT often relies on an MSP to configure it.
• Setup time. Teams, channels, permissions, retention and device policies all need decisions before go-live.
• Training for frontline staff. Front desk, medical assistants and part-time staff who rarely sit at a desk may need extra help with teams vs. channels vs. chats, and with where files end up.

If you're comparing Microsoft against other suites, see Is Slack HIPAA compliant? and Google Chat and HIPAA.

Is Skype HIPAA compliant? (legacy check)

• Consumer Skype was not covered by Microsoft's BAA and has been retired, with users directed to Teams ; Skype was retired on May 5, 2025, with users pointed to Teams Free, and consumer Skype does not appear on Microsoft's HIPAA in-scope services list (support.microsoft.com).
• Skype for Business Online was retired in favor of Teams on July 31, 2021 (learn.microsoft.com).
• Skype for Business Server (on-premises) is a separate case. It runs on your own infrastructure, so your organization carries the security responsibility, and its support lifecycle is limited ; Skype for Business Server 2015 and 2019 reached end of support on October 14, 2025, and only Skype for Business Server Subscription Edition remains supported under the Modern Lifecycle Policy (learn.microsoft.com).

Takeaway: don't use Skype for PHI. If a provider is still using an old Skype account for quick consults or sharing images, move that workflow to a tool covered by a BAA. The same logic applies to personal messengers; see why WhatsApp groups are risky for PHI.

Is Azure HIPAA compliant?

Azure is Microsoft's cloud platform, which is different from Teams. Microsoft offers a BAA for Azure that covers a published list of in-scope services ; the BAA is provided through the Product Terms and Data Protection Addendum, and the in-scope services appear on Microsoft's "Cloud services in audit scope" page (learn.microsoft.com). Whether a given Azure deployment meets HIPAA depends on how you build it.

• Shared responsibility is heavier here. You design the architecture: encryption, logging and monitoring, access control, backups, and network isolation. You must also use only in-scope services for PHI.
• Relevance to Teams. Teams is a Microsoft 365 software-as-a-service product. You don't need to manage Azure to use Teams. Azure matters if you host a custom patient intake app, a reporting database, or a vendor's software in your own cloud tenant.
• Where to start. Microsoft publishes HIPAA/HITRUST blueprint and reference architecture guidance for Azure ; Azure Blueprints is being retired (phased from July 31, 2026, fully retired January 31, 2027), so start with the Azure Policy regulatory compliance built-in initiative for HIPAA/HITRUST at learn.microsoft.com/en-us/azure/governance/policy/samples/hipaa-hitrust-9-2 (learn.microsoft.com). Your developer or MSP should map your design against it.

For other platforms, see more HIPAA tool checks.

An alternative for clinics not built on Microsoft 365: Chanty

Who this suits. Outpatient clinics, multi-location practice groups, and healthcare admin teams that want staff chat, calls, announcements, files and assigned tasks in one app, used alongside their EHR. It fits best for practices that don't run on Microsoft 365, or that want a simpler tool for front desk and deskless staff. Read more about HIPAA-compliant chat for staff.

Compliance, stated precisely. Chanty offers HIPAA compliance with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not hold PHI. As with Teams, the customer still configures roles, access, offboarding, device security, and staff policies. Third-party integrations connected to Chanty are outside Chanty's BAA scope. See Chanty security, HIPAA and BAA details.

Relevant controls:

• Encryption in transit (TLS 1.2+) and encrypted file storage on all plans
• On Business: 2FA, SSO, customizable roles and retention, IP allowlisting, 120+ permission settings, and guest access limited to selected conversations (useful for an outside billing company or IT contractor)
• On Enterprise: SAML SSO, directory sync and SCIM, DLP and governance controls, and data residency options in the US, EU or APAC

Day-to-day fit. The interface is WhatsApp-like, so front desk and part-time staff need little training. Message history is unlimited and searchable. Any message can become a task with an owner and a deadline. For example, "Mrs. R's prior auth needs resubmitting" becomes a task assigned to the referral coordinator, due Thursday, tracked on a Kanban board. Group calls and screen sharing are included on Business. Apps run on iOS, Android, macOS, Windows and web. AI agents are available on Enterprise only, and BAA coverage of agent processing isn't documented. Confirm with Chanty before using agents in any workflow that involves PHI.

Honest limits. Chanty has a smaller native integration catalog than Teams (Chanty's apps page lists 32 entries, including Zapier, Make, n8n, its built-in Tasks and a OneDrive integration for new-file notifications) (chanty.com), extended through Zapier, Make and n8n. It has no Teams-style telephony and no shift scheduling. It is not a telehealth, patient messaging, clinical alerting or EHR tool. It does not integrate with Microsoft 365.

	Microsoft Teams (Microsoft 365)	Chanty
BAA	Included in Microsoft's online terms (DPA referenced in the Product Terms) for qualifying plans	Signed BAA on Business and Enterprise
Free tier and PHI	Separate consumer product; keep PHI out unless Microsoft confirms coverage	Free plan: no BAA, no PHI
Chat, channels, files	Yes	Yes
Group calls and meetings	Yes	Yes (group calls and screen sharing on Business)
Telephony	Teams Phone (paid add-on except on E5-level plans; external calling also needs a Calling Plan or other phone-line option) (learn.microsoft.com)	No
Patient video visits	Positioned for virtual visits (via Microsoft Bookings or the Teams EHR connector)	Not supported (staff tool only)
Tasks from messages	Via Planner/To Do (Planner is an in-scope service) (learn.microsoft.com)	Built in, with Kanban board
Integrations	Large Microsoft and partner ecosystem	Smaller catalog; Zapier, Make, n8n
Identity	Entra ID; conditional access requires Entra ID P1 or P2 (included in Microsoft 365 Business Premium)	2FA and SSO on Business; SAML SSO and SCIM on Enterprise
Price per user	Business Basic $7.00, Business Standard $14.00, Business Premium $22.00 per user/month paid yearly ($8.40, $16.80, $26.40 with monthly billing); Teams Essentials $4.00 per user/month paid yearly (microsoft.com)	Business: $3 per user/month billed annually or $4 billed monthly (chanty.com); Enterprise: Contact sales for pricing (chanty.com)

FAQ

Is Microsoft Teams HIPAA compliant?

Teams can be used with PHI when your Microsoft 365 or Office 365 license includes Microsoft's BAA and you configure appropriate safeguards ; Microsoft lists "Microsoft Teams" as an in-scope service for Office 365 Commercial and GCC rather than naming eligible plans, so confirm your SKUs with your reseller (learn.microsoft.com). No tool is HIPAA compliant by itself, and HIPAA has no certification.

Does Microsoft sign a BAA for Teams, and how do I confirm it applies to my account?

Microsoft provides its HIPAA BAA through its online terms for qualifying licenses rather than as a separate paper agreement ; the BAA is incorporated through the Microsoft Online Services Data Protection Addendum (DPA), referenced in the Product Terms, and applies by default to customers who are covered entities or business associates (learn.microsoft.com). Ask your reseller or MSP to confirm your SKUs are in scope, and check how acceptance is recorded in your admin center ; Microsoft's documentation doesn't describe an admin-center record of BAA acceptance, so download a copy of the BAA from the Microsoft Service Trust Portal for your HIPAA documentation (servicetrust.microsoft.com).

Is Teams chat HIPAA compliant, or only meetings?

Microsoft lists chat, channels, meetings, calling and files among the Teams workloads to check in its HIPAA in-scope services ; in fact, Microsoft's list names "Microsoft Teams" as one service, alongside SharePoint Online and OneDrive for Business, and does not list individual Teams workloads (learn.microsoft.com). Chat needs the same configuration as meetings: retention, access controls and DLP where available.

Is Microsoft Teams HIPAA compliant for telehealth visits?

Microsoft positions Teams for virtual visits under its BAA ; the Virtual Appointments app is no longer available, so schedule visits through Microsoft Bookings (advanced features require Teams Premium) or launch them from your EHR with the Teams EHR connector (learn.microsoft.com). The COVID-era enforcement discretion has ended (it expired May 11, 2023, and the telehealth transition period ended August 9, 2023) (federalregister.gov), so use a covered license, the lobby, unique meeting links, and keep PHI out of meeting titles.

Is the free version of Teams covered by a BAA?

Free or personal Teams is a separate product from commercial Microsoft 365. Unless Microsoft confirms coverage, don't use it for PHI.

Can I add third-party apps to Teams and stay HIPAA compliant?

Yes, if each app that touches PHI has its own BAA and you approve it deliberately. Third-party apps and bots are generally governed by their own vendor terms, not Microsoft's BAA ; Microsoft says partner apps are not owned or controlled by Microsoft and are subject to their own terms and privacy statements (learn.microsoft.com). Block apps by default and allow them one by one.

Is Skype or Skype for Business HIPAA compliant?

Consumer Skype was not covered by Microsoft's BAA and has been retired (retired May 5, 2025; it is not on Microsoft's HIPAA in-scope services list) (support.microsoft.com). Skype for Business Online was retired in favor of Teams (July 31, 2021) (learn.microsoft.com). Don't use either for PHI.

Is Azure HIPAA compliant?

Microsoft offers a BAA for Azure covering a list of in-scope services ; the BAA comes through the Product Terms and DPA, and the in-scope services appear on Microsoft's "Cloud services in audit scope" page (learn.microsoft.com). Compliance depends on your architecture, including encryption, logging, access and backups. You don't need Azure to use Teams.

What is a HIPAA-compliant alternative to Teams for clinic staff chat?

For clinics not built on Microsoft 365, Chanty provides staff chat, calls, announcements, files and assigned tasks, with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA. Chanty is for internal staff communication, not patient visits or messaging, and your practice still configures access and policies.