Skip to main content
BAA Directory

Is Microsoft Copilot HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat used with a work or school account, which Microsoft lists as in-scope services under its BAA. Web search queries are not covered.

AI assistants. Checked on the vendor's own pages on .

Using Microsoft Copilot on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Microsoft says

“Microsoft Copilot Chat supports the BAA and HIPAA compliance for prompts and responses for properly configured implementations. HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA.”

Source: Microsoft Learn, Frequently asked questions about Microsoft Copilot Chat, checked .

“Microsoft Copilot and Microsoft Copilot Chat support HIPAA compliance for properly configured implementations.”

Source: Microsoft Learn, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, checked .

“The use of Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor.”

Source: Microsoft Learn, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, checked .

What the BAA covers and excludes

Covers, in Microsoft's words:

Excludes or limits, in Microsoft's words:

  • "HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA." (Microsoft Learn, Copilot Chat FAQ)
  • Enterprise protections follow the work account: "For users signed in with a Microsoft Entra account, Microsoft Copilot Chat offers enterprise data protection (EDP)." (Microsoft Learn, Copilot Chat FAQ) For the Copilot app, Microsoft says "Work and personal accounts remain separate." (Microsoft Support)

What this means for ad tracking

Marketing teams use Copilot to summarize campaign exports, call notes and lead lists. Whatever goes into a prompt is shared with Microsoft.

Under Microsoft's BAA, Copilot and Copilot Chat are covered for prompts and responses on a work or school account, but not for web search queries. On a personal Microsoft account, keep patient details out. Campaign and conversion data that carries no health information is the safer input either way.

Curve Compliance gives your team conversion data to work from that has been checked for PHI-like patterns and sent server-side under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve checks every conversion event for PHI-like patterns before it goes out, so the conversion data your team works from is not a set of patient records.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • A fixed field list per platform, so each ad platform receives only the fields set for it.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • When identifiers are enabled, Curve hashes them with SHA-256.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Microsoft Copilot HIPAA compliant?

Yes, for Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat used with a work or school account, which Microsoft lists as in-scope services under its BAA. Web search queries are not covered. With a signed BAA, Microsoft Copilot can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Microsoft Copilot sign a BAA?

Yes, for Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat used with a work or school account, which Microsoft lists as in-scope services under its BAA. Web search queries are not covered. In Microsoft's words: “Microsoft Copilot Chat supports the BAA and HIPAA compliance for prompts and responses for properly configured implementations. HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA.” We checked Microsoft's own pages on October 5, 2026.

Is Copilot on a personal Microsoft account covered by a BAA?

Microsoft's HIPAA statements cover Microsoft Copilot and Copilot Chat as used by organizations, signed in with a Microsoft Entra work or school account. Microsoft keeps the Copilot experience on a personal Microsoft account separate from work accounts, and its HIPAA pages do not extend the BAA to it, so keep PHI out of Copilot on a personal account.

Should I paste patient data into Copilot to analyze campaigns?

Only on a work or school account covered by Microsoft's BAA, and not in prompts that trigger web search, which the BAA does not cover. Otherwise, work from conversion data without health information. Curve checks every conversion event for PHI-like patterns before it goes to your ad platforms.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Microsoft before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call