Skip to main content
BAA Directory

Does Microsoft 365 sign a BAA?

The answer

Signs a BAA

Yes. Microsoft offers its HIPAA BAA by default to covered entity and business associate customers, for in-scope services such as Office 365.

Automation and workspace. Checked on the vendor's own pages on .

On this page

What Microsoft says

“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

“Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

What the BAA covers and excludes

Covers, in Microsoft's words:

  • Microsoft's in-scope list includes "Office 365, Office 365 U.S. Government", "Dynamics 365 and Dynamics 365 U.S. Government", and Power BI, Power Apps and Power Automate "either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite".

What this means for ad tracking

Microsoft 365 holds the email, spreadsheets and Teams chats that marketing teams use to pass leads around. The BAA covers the in-scope services that hold them.

Microsoft's in-scope list on that page does not include Microsoft Advertising or Microsoft Clarity, so conversions from your site need their own route to your ad platforms.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Microsoft 365 for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Microsoft 365 sign a BAA?

Yes. Microsoft offers its HIPAA BAA by default to covered entity and business associate customers, for in-scope services such as Office 365. In Microsoft's words: “Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.” We checked Microsoft's own pages on September 29, 2026.

Is Microsoft 365 HIPAA compliant once the BAA is signed?

A BAA is Microsoft's commitment to protect the PHI it handles for you. How you set up Microsoft 365 still matters, and the BAA does not reach ad platforms that receive data from your site or from Microsoft 365.

Does a BAA with Microsoft 365 cover my ad pixels?

No. A BAA covers the data Microsoft handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Microsoft.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Microsoft before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call