Is Microsoft Azure HIPAA Compliant? What Healthcare Organizations Need to Know
Azure can hold Protected Health Information lawfully, and Microsoft will sign the Business Associate Agreement that HIPAA requires. The harder question — the one that decides whether you would survive an OCR investigation — is whether the subscription you actually built is configured to earn that protection.
Microsoft extends its HIPAA Business Associate Agreement to eligible customers through the Microsoft Products and Services Data Protection Addendum, at no additional cost, and publishes the list of Azure services that fall in scope.
Plan / requirement: Available under Enterprise Agreement, Microsoft Customer Agreement, and most commercial and government licensing. PHI must stay inside in-scope, generally available services — preview features are not covered.
Sources: Microsoft HIPAA/HITECH compliance offering, Microsoft Service Trust Portal, HHS HIPAA Security Rule. Last reviewed 2026-08-02.
Does Microsoft sign a HIPAA BAA for Azure?
Yes, and you do not have to negotiate it. HIPAA does not certify cloud platforms — there is no such thing as a “HIPAA-certified” cloud. What the rule requires is that any vendor processing PHI on your behalf executes a Business Associate Agreement and upholds the Security Rule safeguards.
Microsoft satisfies that through the Data Protection Addendum, which incorporates HIPAA BAA terms automatically for eligible agreements. There is no separate document to countersign. Retrieve a copy from the Service Trust Portal and file it — auditors ask for the artifact, not the assurance.
Two conditions decide whether the BAA actually covers what you are doing:
- The service must be in scope. Microsoft publishes the HIPAA/HITECH in-scope service list. It is long, but it is not everything.
- The service must be generally available. Preview and beta features sit outside the BAA regardless of how useful they look.
Which Azure services are covered — and which are not?
This is where Azure differs sharply from Microsoft 365, and where most healthcare deployments go wrong. With Microsoft 365 the surface is small and well-trodden. With Azure you are assembling infrastructure, and every component you add is a scope decision.
| Situation | Where you stand |
|---|---|
| PHI in Azure SQL, Storage, Virtual Machines, App Service under a signed DPA | Covered, provided you configured the safeguards |
| PHI processed by a preview or beta feature | Outside the BAA. Do not do this. |
| PHI sent to a third-party service from the Azure Marketplace | Outside Microsoft’s BAA. You need a separate agreement with that vendor. |
| PHI in an unencrypted storage account with public network access | Technically in scope, practically indefensible |
Compliance review
Not sure your Azure subscription holds up to an audit?
Cobrix reviews your Azure configuration against the safeguards your practice actually operates under, then fixes what does not pass and documents it.
Where Microsoft stops and you begin
Azure is infrastructure. That means the shared-responsibility line sits much further toward you than it does with Microsoft 365 — and the most expensive misunderstanding in healthcare cloud projects is assuming a signed BAA finished the job.
| Where responsibility sits |
|---|
| Microsoft secures the physical datacenter, hypervisor, and platform services, and signs the BAA. |
| You own identity and access configuration, network isolation, encryption key management, patching of any VM you run, audit logging, and retention. |
| You own the decision about which services touch PHI at all. |
| PHI placed in a personal or trial subscription outside your licensing agreement falls outside the BAA’s protection. |
How do you configure Azure for HIPAA compliance?
A defensible Azure environment in a healthcare organization comes down to an ordered checklist. None of it is exotic; the failures are almost always omissions, not sophistication gaps.
- Confirm your agreement carries the Data Protection Addendum, and download the BAA from the Service Trust Portal for your records.
- Inventory every service touching PHI and check each against Microsoft’s in-scope list. Remove or replace anything that is not covered.
- Enforce multi-factor authentication for every account via Entra ID Conditional Access, and require it for all administrative access without exception.
- Apply role-based access control on least privilege, and put standing administrative roles behind Privileged Identity Management with time-bound elevation.
- Enable encryption at rest and in transit everywhere. Decide deliberately whether platform-managed keys are sufficient or whether you need customer-managed keys in Key Vault.
- Remove public network exposure. Use Private Endpoints and service firewalls so storage and databases are not reachable from the open internet.
- Turn on diagnostic logging to a Log Analytics workspace, and set retention to meet your documentation obligations — not the default.
- Enable Microsoft Defender for Cloud and act on the recommendations rather than collecting them.
- Use Azure Policy to enforce the above continuously, so drift is prevented rather than discovered.
What quietly voids Azure HIPAA compliance
- Assuming a personal, trial, or Visual Studio subscription carries the BAA. It does not.
- Leaving a storage account’s public network access enabled — the most common finding in cloud healthcare assessments.
- Running PHI through a preview service because it shipped a useful feature.
- Installing Marketplace appliances that process PHI without a separate BAA with that publisher.
- Enabling diagnostic logs but leaving retention at the default, so the evidence is gone before the investigation starts.
- Treating a compliance score in Defender for Cloud as an audit outcome. It is a signal, not a finding.
Where Cobrix fits
Cobrix is a California MSP and MSSP that configures and monitors Microsoft environments for healthcare, legal and accounting practices, then documents the controls so they survive scrutiny. Microsoft gives you the BAA. The configuration, the monitoring, and the paper trail are what actually keep you compliant — and that is the part we own.
Free resource
Azure HIPAA configuration checklist
The configuration steps above as a printable checklist your team can work through and keep on file for audit.
Frequently asked questions
Is Microsoft Azure HIPAA compliant?
Azure can be used in a HIPAA-compliant way. Microsoft extends a HIPAA Business Associate Agreement to eligible customers through its Data Protection Addendum, and publishes a list of Azure services in scope. The BAA is necessary but not sufficient: compliance depends on how you configure encryption, access control, logging and network isolation.
Does Microsoft sign a HIPAA BAA for Azure?
Yes. The BAA is extended through the Microsoft Products and Services Data Protection Addendum at no additional charge for eligible commercial and government agreements. Retrieve a copy from the Microsoft Service Trust Portal for your compliance records.
Are all Azure services covered by the HIPAA BAA?
No. Microsoft publishes a list of in-scope services for HIPAA/HITECH. Preview features and services outside that list are not covered, and placing PHI in one falls outside the BAA’s protection.
What is the difference between Azure and Microsoft 365 for HIPAA?
Both are covered by Microsoft’s BAA, but the responsibility split differs. Microsoft 365 is software as a service, so Microsoft manages more of the stack. Azure is infrastructure, so you own operating systems, network design, identity configuration and key management — more control, and more ways to be non-compliant.
Does a BAA alone make Azure compliant?
No. HIPAA compliance follows a shared-responsibility model. Microsoft secures the platform; your organization is responsible for configuration, access controls, audit logging, encryption key handling and staff procedures.
Need this handled rather than researched? Cobrix configures and documents HIPAA and FTC Safeguards controls for California firms — see IT compliance services.