How do you configure Microsoft 365 for HIPAA?

Key facts

• Microsoft includes HIPAA Business Associate terms for in-scope services through its Data Protection Addendum.
• HIPAA does not certify software; covered entities and business associates must implement safeguards.
• Business Premium covers most technical controls a small practice needs.
• Encryption, access control and audit logging map directly to Security Rule safeguards.
• Only use in-scope Microsoft services and approved third-party apps for PHI.

Start with the agreement and scope

Microsoft offers HIPAA Business Associate Agreement terms for in-scope cloud services, provided through the Microsoft Products and Services Data Protection Addendum for most commercial customers. Confirm with your licensing contact or Microsoft's documentation that your agreement includes it and which services are covered.

Next, decide where PHI is allowed to live. Typical in-scope locations are Exchange Online, SharePoint, OneDrive and Teams. Keep PHI out of consumer services, unapproved third-party apps and preview features that are not covered. Document this in your policies so staff know the rules.

Lock down access to PHI

The HIPAA Security Rule requires access controls, unique user identification and procedures to verify identity. In Microsoft 365 that means a solid identity and device baseline.

• MFA for all users through Conditional Access, with phishing-resistant methods for admins.
• Block legacy authentication.
• Require compliant, Intune-managed devices to access mail and files containing PHI.
• Use app protection policies for phones so PHI stays inside managed apps.
• Unique accounts only; no shared logins for clinical or billing staff.
• Session timeouts and sign-in frequency policies for shared workstations.
• Regular access reviews for groups and sites that hold PHI.

Protect the data itself

Microsoft 365 encrypts data at rest and in transit by default. For email sent outside the organization, use Microsoft Purview Message Encryption, triggered by a mail flow rule, a sensitivity label or user choice, so patients and partners receive protected messages.

Use Purview DLP with built-in sensitive information types for health and US personal data to detect PHI in email, SharePoint, OneDrive and Teams. Start in simulation, tune, then enforce. Sensitivity labels can mark and encrypt confidential files so protection travels with them. Limit SharePoint and OneDrive external sharing to authenticated guests and disable anonymous links for sites holding PHI.

Logging, retention and recovery

HIPAA requires audit controls and the ability to review activity. Confirm the unified audit log is on, understand how long your licenses retain audit records, and export or extend retention if your policies require longer.

Set retention policies for mail and files in line with your record retention schedule. Retention is not the same as backup, so decide how you would restore PHI after accidental deletion, ransomware or a compromised account, and test it. Document all of this, since it supports the contingency plan requirement.

What Microsoft 365 does not do for you

Technology covers only part of HIPAA. You still need a documented risk analysis, policies and procedures, workforce training, business associate agreements with your other vendors, breach notification procedures and periodic evaluation. Configuration evidence from Microsoft 365 feeds into those, but it does not replace them.

Work with your compliance officer, legal counsel or assessor to confirm that your configuration meets your obligations. Keep a record of what was configured, when and why.

How Accred Consulting approaches it

Accred Consulting configures Microsoft 365 controls that support a client's HIPAA program; the client and its assessor own compliance, and Accred does not certify it. Discovery reviews licensing, where PHI lives, current access and sharing. The proposal sets a clear scope, fixed price and timeline. US-based specialists then implement MFA and Conditional Access, Intune device and app protection, Purview Message Encryption, DLP for PHI, audit logging and retention, with structured check-ins. Handover includes configuration documentation your compliance officer can use, knowledge transfer, and optional support retainers.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions