Is Microsoft 365 Outlook (Exchange Online) HIPAA compliant?

Yes, with a signed BAA

Exchange Online and Microsoft Teams are listed as in-scope services, and the HIPAA BAA applies by default through the Microsoft Online Services Data Protection Addendum for covered entities and business associates. Customers remain responsible for configuring encryption and access controls.

What to use instead

Sources

• learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech

Last verified 2026-09-24. General information, not legal advice.