Is Microsoft Teams HIPAA Compliant for Therapists?
Quick Answer
Yes, on a paid commercial Microsoft 365 subscription — not on free or personal Teams accounts. Microsoft's own compliance documentation states the BAA is available by default to covered entities and business associates on commercial plans, through its standard Online Services Data Protection Addendum, with no separate contract needed. Teams, Exchange Online, SharePoint, and OneDrive are all named as in-scope services.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified August 2026 against Microsoft's official HIPAA/HITECH compliance documentation
BAA Available?
Yes
On Which Plan
Paid commercial Microsoft 365/Office 365 plans
Microsoft is explicit that having the BAA in place does not by itself equal compliance — you are still responsible for configuring Teams correctly (access controls, retention settings, who can be added to a chat or call) and training your staff, the same as with any HIPAA-covered platform.
What to Use Instead for Client Work
If you want the BAA and clinical workflow bundled together without managing Microsoft 365 admin settings separately, SimplePractice's telehealth and messaging come pre-configured under its own BAA.
Affiliate link — we may earn a commission at no extra cost to you.
It's About the Subscription Type, Not One Named Tier
Microsoft's own documentation ties BAA eligibility to being a commercial (paid, business) subscriber rather than naming one specific required plan like Business Premium or E3. Free or personal Microsoft accounts don't qualify, but beyond that, Microsoft's language is broader than some third-party blogs suggest — confirm your specific plan's eligibility with Microsoft directly rather than assuming a named tier is required.
What's Actually Covered
Microsoft names Teams, Exchange Online (email), SharePoint, and OneDrive as in-scope services under its standard commercial agreement. This means a therapist on a qualifying Microsoft 365 business plan can reasonably use Teams for video sessions and Exchange for email under the same BAA — but as with Google's covered-services list, newly added Microsoft features aren't automatically guaranteed to be included.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Microsoft Teams and HIPAA
Do I need a specific Microsoft 365 plan like Business Premium for a BAA?
Microsoft's own documentation ties BAA eligibility to commercial (paid business) subscriptions broadly, rather than naming one required tier. Confirm your specific plan's eligibility directly with Microsoft rather than assuming a named tier like Business Premium or E3 is strictly required.
Is the free or personal version of Microsoft Teams HIPAA-compliant?
No. Free and personal Microsoft accounts are not covered — a paid commercial Microsoft 365 subscription is required for BAA eligibility.
Does having a Microsoft BAA mean I'm automatically HIPAA-compliant?
No. Microsoft states directly that the BAA alone does not equal compliance — you still need to configure Teams correctly (access controls, meeting settings, retention) and train your staff on proper use.