Is Microsoft Copilot HIPAA Compliant? M365, GCC, and the Real Answer for 2026

Short answer: Microsoft Copilot can be used with protected health information (PHI) by HIPAA-covered entities, but only under the Microsoft HIPAA BAA and with the right tenant configuration. Microsoft's HIPAA page lists Microsoft Copilot and Microsoft Copilot Chat among the in-scope Office 365 services, and says the BAA is available through the Online Services Data Protection Addendum by default to customers that are covered entities or business associates. The consumer Copilot at copilot.microsoft.com on a personal Microsoft account has no such agreement behind it. Data-protection features and HIPAA coverage are different things, and the two are often confused. This guide explains, in 2026, what HIPAA actually requires of an AI tool, which Copilot products can be made compliant, what GCC and GCC-High change, and how to keep PHI from leaking when staff use personal Copilot accounts.

What HIPAA requires of any AI tool

HIPAA is implemented through three rules that all attach when an AI vendor processes PHI on your behalf:

• Privacy Rule — defines PHI and the conditions under which it may be used or disclosed.
• Security Rule — defines administrative, physical, and technical safeguards for electronic PHI (ePHI).
• Breach Notification Rule — defines what counts as a breach and the timelines for reporting it.

For Microsoft to lawfully process PHI on a covered entity's behalf via Copilot, three things must be true:

1. Microsoft qualifies as a business associate because it creates, receives, maintains, or transmits PHI on the covered entity's behalf for a regulated function or activity.
2. The covered entity has the Microsoft HIPAA BAA in place. Microsoft says it is available through the Online Services Data Protection Addendum by default to customers that are covered entities or business associates, and it must meet the content requirements of 45 CFR 164.504(e).
3. The Copilot product, in the configuration you actually use, supports the Security Rule's technical safeguards.

A covered entity may disclose PHI to a business associate only after obtaining satisfactory assurance that it will safeguard the information, documented in a written contract (45 CFR 164.502(e)). Without that, sending PHI to Copilot is an impermissible disclosure, no matter how mature Microsoft's underlying infrastructure is.

Last reviewed October 1, 2026 against the regulations and vendor documentation listed under Sources and primary references.

Data-protection features are not HIPAA coverage

A privacy feature and a HIPAA agreement are different things, and they are often confused. Microsoft's own Copilot privacy article describes what Copilot does with your data:

• Prompts, responses, and data accessed through Microsoft Graph are not used to train foundation models.
• Microsoft stores data about interactions, including the user's prompt and Copilot's response with citations. Admins can view and manage that data with Content search or Microsoft Purview and set retention policies. Users can delete their own Copilot activity history.
• Copilot surfaces only organizational data to which the user has at least view permissions.
• Web search is optional. Copilot generates a search query and sends it to the Bing Search service, and turning off optional connected experiences makes web search unavailable.
• Admins decide whether Copilot uses third-party models such as Anthropic and OpenAI models, and additional terms may apply.

None of that is a HIPAA agreement. The agreement is the BAA. You need both: the BAA in force for your tenant, and a Copilot configuration that does not send PHI outside the covered services. Earlier versions of this guide described a "Commercial Data Protection" feature under which chat data is not retained beyond the session. Microsoft's current Copilot privacy article does not use that term and states that interaction data is stored, so do not assume prompts disappear when a session ends.

Where Microsoft stands on HIPAA + Copilot in 2026

As of October 1, 2026, Microsoft's HIPAA and HITECH page says the following.

• The BAA. It is available through the Microsoft Online Services Data Protection Addendum by default to all customers that are covered entities or business associates under HIPAA, and also for in-scope Microsoft Professional Services. Microsoft cannot use a customer's own BAA, because it offers standardized multitenant services.
• In-scope Office 365 services. In the commercial and GCC environments, the list includes Microsoft Copilot and Microsoft Copilot Chat. In the commercial table it also names Exchange Online, Microsoft Teams, OneDrive for Business, Microsoft Entra ID, and the Microsoft Purview portal. The table we reviewed does not show GCC High or DoD, so confirm those with Microsoft.
• Other in-scope platforms. Azure and Azure Government, Power Apps, Power Automate, Power BI, Dynamics 365, Microsoft Copilot for Security, and Microsoft Healthcare Bot Service are listed. For specific Azure AI services such as Azure OpenAI, Foundry, and Azure AI Search, check Microsoft's Azure HIPAA offering and its service-scope documentation, because the pages we reviewed name Azure at the platform level only.
• Not on the list. GitHub does not appear on Microsoft's in-scope lists. See Is GitHub Copilot HIPAA Compliant?.
• Consumer Copilot. Copilot at copilot.microsoft.com on a personal Microsoft account is a consumer service, and nothing on Microsoft's HIPAA page puts it in scope.
• Third-party models. Microsoft's privacy article says admins decide whether Copilot uses Anthropic and OpenAI models, and that additional terms may apply. If you enable them for PHI workflows, confirm those terms fit your BAA.
• A BAA is not compliance. Microsoft's page says using Microsoft services does not on its own achieve HIPAA compliance, and that no HHS-approved certification standard exists for business associates.

For most US health systems, the practical question is: "Is our tenant under the BAA, is Copilot licensed and in scope, and are the configuration and workforce behavior right?"

What a HIPAA-aligned Copilot deployment looks like

A health system, payer, life-sciences org, or digital-health vendor that wants to use Microsoft 365 Copilot on PHI typically needs to:

1. Confirm the Microsoft HIPAA BAA applies to your tenant. Microsoft says it is available through the Online Services Data Protection Addendum by default to covered entities and business associates. Confirm with your Microsoft representative how it applies under your agreement and that the services you use, including Copilot, are in scope.
2. Verify Copilot licensing and scope for the relevant users. Microsoft's in-scope list is organized by service and environment, so confirm that the environment you are in (commercial, GCC, or another) is the one listed.
3. Set retention and review how interactions are stored. Microsoft says Copilot stores prompts and responses, that admins can manage them with Microsoft Purview retention policies, and that users can delete their own activity history. Set the policy deliberately rather than inheriting a default.
4. Configure data sources. Copilot grounds its responses in tenant data via Microsoft Graph and, per Microsoft, surfaces only organizational data the signed-in user has at least view permissions to. That makes your permissions the control: lock down SharePoint sites, OneDrive shares, Teams, and Outlook so Copilot cannot surface PHI to workforce members who should not see it.
5. Restrict workforce access. Block consumer Copilot endpoints (copilot.microsoft.com on personal Microsoft accounts) at the network or identity layer. Force SSO through Entra ID with the work account.
6. Decide on web search. When web search is used, Microsoft says Copilot generates a search query from the prompt and sends it to the Bing Search service. For users handling PHI, consider whether a prompt could leak into that query. Microsoft says turning off optional connected experiences makes web search unavailable.
7. Log access to satisfy the Security Rule's audit-control standard. Microsoft says admins can use Content search and Microsoft Purview to view stored Copilot interaction data; configure retention and review per your policy.
8. Train the workforce specifically on what may and may not be sent (workforce training is required). A signed BAA does not authorize pasting any PHI, only PHI the workforce member is otherwise permitted to disclose.
9. Document risk assessment, BAA, configuration, and training records, because the Security Rule requires written policies and records of required actions and assessments, retained for six years (45 CFR 164.316(b)).

Two steps that are easy to underestimate are #4 (oversharing) and #5 (preventing personal-account Copilot use on work devices).

The "shadow Copilot" problem

A common HIPAA exposure in 2026 is workforce members using consumer AI tools — including the free Copilot, ChatGPT Plus, Gemini Advanced, and Claude Pro — for clinical and administrative tasks because the personal account is faster than the sanctioned workflow. A Wolters Kluwer Health survey of 518 providers and administrators, fielded by CITE Research in December 2025, found that 40 percent had encountered an unauthorized AI tool at work and nearly 20 percent admitted to using one. One in 10 said they had used an unauthorized tool for a direct patient-care use case, and half pointed to a need for faster workflows.

Two technical controls help materially:

• Device-level redaction. Locke 1.0 detects PHI categories — names, dates, MRNs, diagnoses, drug names, payer IDs — locally and replaces them with one-way placeholders before the prompt leaves the device. Even when staff use a non-sanctioned Copilot, ChatGPT, Claude, or Gemini account, the unmasked PHI never crosses the wire. Reversible tokenization is planned shortly after 1.0.
• Egress controls for AI domains. Add copilot.microsoft.com, m365.cloud.microsoft, chat.openai.com, claude.ai, gemini.google.com, and similar destinations to your DLP and CASB rules. Treat them the same way you treat traffic to a personal cloud-storage provider.

Both controls are additive, not substitutes for a BAA. They reduce the size and severity of a leak when policy slips.

Examples: what is and is not allowed

The lines below assume a covered entity has accepted the Microsoft HIPAA BAA and licensed Microsoft 365 Copilot for the relevant users. Without that BAA, the answer to every "yes" example is "no, this is an unpermitted disclosure."

The pattern: keep PHI inside the BAA boundary, lock down the tenant data Copilot can ground on, and remove PHI before any prompt leaves the device for an unsanctioned tool.

How Copilot compares to ChatGPT, Claude, and Gemini for healthcare

All four major providers can be configured for HIPAA workloads under a BAA. The 2026 differences:

• Workforce productivity integration. Microsoft 365 Copilot is uniquely deep inside the productivity surfaces clinicians already use (Outlook, Word, Teams, Excel, OneDrive, SharePoint). For organizations standardized on M365, this is the lowest-friction option.
• Government clouds. Microsoft's HIPAA page describes GCC, GCC High, and DoD environments for Office 365. Compare each vendor's government offerings against your own requirements.
• Training and retention terms. Microsoft says prompts, responses, and Graph data in Copilot are not used to train foundation models. OpenAI says API data is not used for training unless you opt in (API data controls). Anthropic says consumer chats are used to improve its models if you choose to allow it (data-use article). Terms differ by plan and change, so read the current terms for the exact product.
• Oversharing risk. Copilot's depth of integration is also its largest 2026 risk — over-permissive SharePoint and OneDrive sharing surfaces PHI to Copilot grounding for users who shouldn't see it. ChatGPT, Claude, and Gemini do not have this surface unless explicitly connected to your data.
• Audit and admin controls. Microsoft Purview is the most mature audit and compliance plane of the four.

The product-level "which is more HIPAA-friendly" question matters less than the organizational question: which BAA do you already have, where does your workforce already work, and how well can you keep them inside the covered tenancy?

Frequently asked questions

Does the Microsoft HIPAA BAA cover Microsoft 365 Copilot automatically?

Microsoft's HIPAA page lists Microsoft Copilot and Microsoft Copilot Chat as in-scope services in the commercial and GCC Office 365 environments, and says the BAA is available through the Online Services Data Protection Addendum by default to covered entities and business associates. Confirm with your Microsoft representative that the BAA applies under your agreement and that the environment and services you use are on the list.

Are Microsoft's Copilot data protections enough for HIPAA?

No. Microsoft's privacy article says prompts and responses are not used to train foundation models, which is privacy-friendly, but it also says interaction data is stored and managed under your retention policies. Neither is the same as a BAA, which HIPAA requires (45 CFR 164.502(e)). The data protections plus the BAA is the correct posture.

Is the free Copilot at copilot.microsoft.com HIPAA compliant if I just use it for "general questions"?

If the prompts contain no PHI, HIPAA does not apply. The risk is that "general questions" routinely creep into specific cases — and free Copilot is not under a BAA. For any workforce that handles PHI, block the consumer endpoint and require sign-in to the work account.

What about Copilot for Microsoft 365 GCC, GCC-High, and DoD?

Microsoft's HIPAA page lists Microsoft Copilot and Copilot Chat as in scope for the commercial and GCC Office 365 environments. The table we reviewed does not show GCC High or DoD, so confirm those with your Microsoft account team. Feature parity with commercial Copilot also varies, so check it before planning clinical workflows.

Can Copilot accidentally surface another patient's PHI?

Yes, through oversharing. Microsoft's privacy article says Copilot surfaces only organizational data to which the user has at least view permissions. If SharePoint sites or OneDrive folders are over-permissioned, Copilot can retrieve PHI the user can technically see but should not. Review your permission model before rollout, and treat tight permissions as a requirement for clinical workloads, not an optional hardening step.

What if my staff already pasted PHI into a personal Copilot account?

Treat it as a presumed breach. Investigate the account's data and retention settings and document the disclosure. Under 45 CFR 164.402, an impermissible disclosure is presumed to be a breach unless you can demonstrate a low probability that the PHI has been compromised, based on a risk assessment of at least four factors: the nature and extent of the PHI involved and the likelihood of re-identification; who received it; whether it was actually acquired or viewed; and how far the risk has been mitigated. Document that assessment. If you cannot show low probability, notify affected individuals without unreasonable delay and no later than 60 days after discovery (45 CFR 164.404), and notify HHS (45 CFR 164.408): at the same time for breaches of 500 or more individuals, otherwise in an annual submission within 60 days after the end of the calendar year.

Your exposure does not depend on leadership knowing. A covered entity is liable for violations by workforce members acting within the scope of their agency, and a breach is treated as discovered when any workforce member other than the person who caused it knows of it, or would have with reasonable diligence.

How does Locke relate to HIPAA when staff use Copilot?

Locke is not a covered entity or business associate. It is a privacy layer that runs entirely on the user's device and never receives PHI or any other data. By detecting PHI categories on-device and replacing them with one-way placeholders before the prompt leaves the device, Locke materially reduces the surface where PHI can leak — including to non-BAA Copilot, ChatGPT, Claude, or Gemini accounts. It is complementary to a properly executed BAA program, not a substitute for one.

A short HIPAA + Copilot checklist

• Confirm the Microsoft HIPAA BAA applies to your tenant and that the Copilot services and environment you use are in scope.
• License Copilot for the relevant users in an in-scope environment.
• Set Purview retention for Copilot interactions; do not assume data protections replace the BAA.
• Lock down SharePoint, OneDrive, and Teams permissions so Copilot grounding cannot surface PHI to the wrong user. Use Microsoft Purview and SharePoint Advanced Management.
• Block or proxy consumer Copilot endpoints at the network and identity layers.
• Deploy a local-first redaction tool to every browser used by clinical and administrative staff.
• Add AI-bound traffic to your DLP, CASB, and audit-log review.
• Train staff specifically on what may and may not be sent — verify with periodic walk-throughs.
• Re-assess annually; the Online Services BAA service list and Copilot feature set change frequently.

The bottom line

In 2026, "Is Microsoft Copilot HIPAA compliant?" is the wrong question. The right questions are: which Copilot product am I using, is the Online Services BAA accepted in this tenant, is the licensing on a HIPAA-eligible plan, are SharePoint and OneDrive permissions tight enough that Copilot cannot surface PHI to the wrong user, am I sure my workforce isn't on the personal Copilot account, and what happens when they slip? Get those right and Copilot becomes the most workflow-integrated option available to a US health system. Skip any one of them and you are running on luck.

Sources and primary references

Reviewed October 1, 2026. Regulations are cited to the eCFR. Vendor statements are cited to the vendor's own documentation as it read on that date; vendors revise these pages, so confirm before relying on them.

• 45 CFR 160.103, definition of business associate — who counts as a business associate, including subcontractors.
• 45 CFR 164.502(e), disclosures to business associates — satisfactory assurance, documented in a written contract.
• 45 CFR 164.504(e), business associate contracts — what the contract must contain.
• 45 CFR 164.312, technical safeguards — access control, audit controls, integrity, authentication, transmission security.
• 45 CFR 164.316, documentation — written policies and six-year retention.
• 45 CFR 164.514, de-identification — Safe Harbor and Expert Determination.
• 45 CFR 164.402 to 164.410, breach notification — the presumption of breach, the four-factor assessment, and notification deadlines.
• 45 CFR 160.402(c), agency liability — liability for workforce members and business associates acting within the scope of agency.
• Wolters Kluwer Health survey press release, January 22, 2026 — 518 healthcare professionals, fielded December 2025.
• Microsoft, HIPAA and HITECH offering — the BAA through the Data Protection Addendum, in-scope services, shared responsibility.
• Microsoft, Data, privacy, and security for Microsoft Copilot — interaction storage, Purview retention, permissions, web search, third-party models.
• Microsoft, Azure HIPAA offering — Azure-level HIPAA guidance.
• OpenAI, API data controls — API training statement.
• Anthropic, Is my data used for model training? (consumer plans) — when consumer chats may be used to improve models.

Related HIPAA guides

• Is ChatGPT HIPAA Compliant?
• Is Claude HIPAA Compliant?
• Is Gemini HIPAA Compliant?
• Is GitHub Copilot HIPAA Compliant?
• Is Perplexity AI HIPAA Compliant?
• HIPAA-Compliant AI: A Complete Checklist for 2026