Is OneDrive HIPAA compliant?

Only on some plans

Only on some plans. Microsoft lists OneDrive for Business as an in-scope Office 365 service, and its HIPAA BAA applies by default through the Microsoft Online Services Data Protection Addendum to customers who are covered entities or business associates. That covers OneDrive in a Microsoft 365 business subscription. Microsoft's HIPAA page covers its enterprise services, not personal OneDrive accounts.

What to use instead

See also: Is Dropbox HIPAA compliant? · Is Box HIPAA compliant? · Is Google Drive HIPAA compliant? · Is SharePoint HIPAA compliant?

Sources

• learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech

Last verified 2026-10-01. General information, not legal advice.