Vendor compliance profile
Is Microsoft Teams HIPAA compliant?
Microsoft Teams may support HIPAA-regulated collaboration when the organization is an eligible Microsoft customer, the applicable Microsoft BAA covers the in-scope services, and the tenant, meetings, chat, recordings, apps, notifications, and data lifecycle are configured appropriately. Teams is not automatically compliant for every plan or workflow.
Direct compliance answer
Microsoft Teams HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-10-01 | Confidence: High
| Direct answer | Microsoft Teams may support HIPAA-regulated collaboration when the organization is an eligible Microsoft customer, the applicable Microsoft BAA covers the in-scope services, and the tenant, meetings, chat, recordings, apps, notifications, and data lifecycle are configured appropriately. Teams is not automatically compliant for every plan or workflow. |
|---|---|
| BAA availability | Microsoft states that its HIPAA BAA is incorporated through the Microsoft Products and Services Data Protection Addendum for eligible customers. Verify the current agreement and exact in-scope Microsoft 365 services rather than assuming every connected feature is covered. |
| Can it handle PHI? | Meeting names, chat, files, recordings, transcripts, attendance reports, notifications, bots, apps, guest access, email, OneDrive, SharePoint, and mobile devices can expose PHI. |
| SOC 2 caveat | Microsoft's Teams security documentation lists SOC 1 and SOC 2 among applicable standards. Obtain current audit reports through Microsoft's Service Trust Portal and match the report scope to the services in use. |
| What to verify | Whether the organization's licensing agreement includes the current Microsoft BAA and the exact Teams and Microsoft 365 services used are in scope. How meeting titles, invitations, chat, recordings, transcripts, attendance data, notifications, email, OneDrive, SharePoint, and mobile access are governed. |
Scope of this profile
Use this profile for Microsoft Teams BAA and in-scope service review, tenant configuration, meetings, chat, recordings, transcripts, apps, guests, and connected Microsoft 365 data paths.
HIPAA status signal
Conditional
BAA public signal
Microsoft in-scope services only
SOC 2 evidence signal
Public evidence
PHI warning: Meeting names, chat, files, recordings, transcripts, attendance reports, notifications, bots, apps, guest access, email, OneDrive, SharePoint, and mobile devices can expose PHI.
Search query answers
Is Microsoft Teams HIPAA compliant?
Microsoft Teams can support some HIPAA-regulated workflows as part of Microsoft's in-scope cloud services, but compliance still depends on the applicable Microsoft agreement, covered tenant and services, customer configuration, workforce controls, integrations, and the exact PHI workflow.
Does Microsoft provide a BAA for Teams?
Microsoft says its HIPAA BAA is available through the Microsoft Products and Services Data Protection Addendum for covered entity and business associate customers using in-scope Microsoft services. Buyers should verify the current licensing agreement and audit-scope listing for their tenant and services.
Can Microsoft Teams meetings or chat contain PHI?
Potentially, but only after BAA scope and configuration are verified. Meeting titles, chat, files, recordings, transcripts, attendance reports, notifications, bots, apps, guest access, and connected storage can move PHI into separate data paths that require review.
Does Teams SOC 2 evidence prove HIPAA compliance?
No. Microsoft lists SOC 1 and SOC 2 among Teams compliance standards, but security evidence does not replace the Microsoft BAA, in-scope service review, tenant configuration, and customer responsibility for the intended PHI workflow.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Microsoft lists Teams within its security and compliance framework and offers a HIPAA BAA for covered entity and business associate customers using in-scope Microsoft services. Customer implementation remains a shared responsibility. |
|---|---|
| BAA | Microsoft states that its HIPAA BAA is incorporated through the Microsoft Products and Services Data Protection Addendum for eligible customers. Verify the current agreement and exact in-scope Microsoft 365 services rather than assuming every connected feature is covered. |
| SOC 2 | Microsoft's Teams security documentation lists SOC 1 and SOC 2 among applicable standards. Obtain current audit reports through Microsoft's Service Trust Portal and match the report scope to the services in use. |
| PHI risk | Meeting names, chat, files, recordings, transcripts, attendance reports, notifications, bots, apps, guest access, email, OneDrive, SharePoint, and mobile devices can expose PHI. |
| Category | HIPAA-Compliant Calendar and Scheduling Software |
| Last checked | 2026-10-01 |
| Confidence | High |
Public evidence and open questions
What public sources say
- Microsoft's HIPAA/HITECH offering page says it enters into BAAs with covered entity and business associate customers for in-scope Microsoft services.
- Microsoft's Teams security and compliance overview lists HIPAA and SOC standards while distinguishing compliance commitments from customer implementation duties.
- Microsoft's BAA does not itself make a customer's Teams tenant, apps, meetings, recordings, bots, or connected workflow compliant.
What remains unconfirmed
- Whether the buyer's exact Microsoft agreement, tenant, licenses, Teams services, support paths, data region, and professional services are in current BAA scope.
- Whether recordings, transcripts, Copilot or AI features, bots, apps, guest access, PSTN, meeting add-ons, OneDrive, SharePoint, Exchange, and third-party connectors remain inside the reviewed boundary.
- Whether retention, legal hold, audit, identity, mobile, external access, and notification controls satisfy the buyer's intended workflow.
What it may be used for
- Covered collaboration and meeting workflows in an eligible Microsoft tenant after BAA scope, in-scope services, licensing, identity, retention, and sharing controls are verified.
- Healthcare operations that can govern meeting metadata, recordings, transcripts, chat, files, guests, apps, and connected Microsoft 365 services together.
- Vendor review where Teams security evidence and HIPAA agreement scope are evaluated separately.
What not to use it for
- Discussing or recording PHI in consumer, personal, unmanaged, or otherwise uncovered Teams environments.
- Using bots, apps, Copilot or AI features, guest access, external federation, recording, transcription, or PSTN integrations without separate scope review.
- Assuming a Microsoft BAA automatically covers every Teams add-on, third-party app, tenant configuration, or user behavior.
What to verify with the vendor
- Whether the organization's licensing agreement includes the current Microsoft BAA and the exact Teams and Microsoft 365 services used are in scope.
- How meeting titles, invitations, chat, recordings, transcripts, attendance data, notifications, email, OneDrive, SharePoint, and mobile access are governed.
- Whether apps, bots, Copilot or other AI features, PSTN services, guests, external federation, APIs, support, and third-party integrations are covered or excluded.
- Whether administrators can enforce MFA, conditional access, least privilege, retention, deletion, audit, eDiscovery, recording, transcription, guest, and app policies.
Safer alternatives and related profiles
Safer alternatives to consider
- Zoom only on an eligible paid account after Zoom's BAA, covered-product scope, recording, AI, and configuration requirements are verified.
- A healthcare-specific telehealth or patient communication platform when identity, consent, clinical messaging, recordings, and patient workflows need one governed product.
- Microsoft Teams only after agreement scope, tenant controls, connected Microsoft services, and third-party apps are reviewed together.
FAQ
Is Microsoft Teams HIPAA compliant?
Microsoft Teams can support some HIPAA-regulated workflows as part of Microsoft's in-scope cloud services, but compliance still depends on the applicable Microsoft agreement, covered tenant and services, customer configuration, workforce controls, integrations, and the exact PHI workflow.
Does Microsoft provide a BAA for Teams?
Microsoft says its HIPAA BAA is available through the Microsoft Products and Services Data Protection Addendum for covered entity and business associate customers using in-scope Microsoft services. Buyers should verify the current licensing agreement and audit-scope listing for their tenant and services.
Can Microsoft Teams meetings or chat contain PHI?
Potentially, but only after BAA scope and configuration are verified. Meeting titles, chat, files, recordings, transcripts, attendance reports, notifications, bots, apps, guest access, and connected storage can move PHI into separate data paths that require review.
Does Teams SOC 2 evidence prove HIPAA compliance?
No. Microsoft lists SOC 1 and SOC 2 among Teams compliance standards, but security evidence does not replace the Microsoft BAA, in-scope service review, tenant configuration, and customer responsibility for the intended PHI workflow.
Will Microsoft Teams sign a BAA?
Microsoft states that its HIPAA BAA is incorporated through the Microsoft Products and Services Data Protection Addendum for eligible customers. Verify the current agreement and exact in-scope Microsoft 365 services rather than assuming every connected feature is covered.
Can Microsoft Teams be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Microsoft Teams is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Microsoft Teams with PHI?
Whether the organization's licensing agreement includes the current Microsoft BAA and the exact Teams and Microsoft 365 services used are in scope. How meeting titles, invitations, chat, recordings, transcripts, attendance data, notifications, email, OneDrive, SharePoint, and mobile access are governed. Whether apps, bots, Copilot or other AI features, PSTN services, guests, external federation, APIs, support, and third-party integrations are covered or excluded. Whether administrators can enforce MFA, conditional access, least privilege, retention, deletion, audit, eDiscovery, recording, transcription, guest, and app policies.
Last checked and source notes
- Last checked
- 2026-10-01
- Confidence
- High
- Dataset rows
- 280 vendors
- Reviewed Microsoft's HIPAA/HITECH offering and Teams security and compliance documentation on 2026-10-01.
- Microsoft Teams suitability depends on the buyer's agreement, in-scope services, tenant configuration, apps, recordings, transcripts, integrations, and workforce controls.
- ComplySaaS did not verify a private Microsoft agreement, Service Trust Portal report, tenant settings, or customer-specific implementation.
- Microsoft HIPAA and HITECH offering
- Microsoft Teams security and compliance overview
- Microsoft cloud services in audit scope