Skip to main content
BAA Directory

Is OneDrive HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for OneDrive for Business. Microsoft includes its HIPAA BAA by default for covered entities and business associates on Office 365 Commercial and GCC.

Automation and workspace. Checked on the vendor's own pages on .

Using OneDrive on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Microsoft says

“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

“If Customer is a “covered entity” or a “business associate” and includes "protected health information" in Customer Data or Professional Services Data, as those terms are defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations promulgated thereunder (collectively, “HIPAA”), execution of Customer’s agreement includes execution of the HIPAA Business Associate Agreement (“BAA”).”

Source: Microsoft Products and Services Data Protection Addendum (May 2026), HIPAA Business Associate, checked .

“Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

What the BAA covers and excludes

Covers, in Microsoft's words:

Excludes or limits, in Microsoft's words:

What this means for ad tracking

OneDrive often holds intake forms, referral letters and exported lead lists, so files that tie a person to their care can end up there.

A BAA with Microsoft covers the files OneDrive for Business stores for you. It does not cover an ad platform, so a lead list or conversion file that goes from OneDrive to Meta or Google Ads leaves that BAA behind and should carry no health details. This directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA.

OneDrive sits under Microsoft 365, and Microsoft sets its sharing at the organization level together with SharePoint. To compare storage providers, see our guide to HIPAA compliant cloud storage.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep OneDrive for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is OneDrive HIPAA compliant?

OneDrive for Business can be used in a HIPAA-compliant way: it is an in-scope service under Microsoft's HIPAA BAA, which Microsoft offers by default to covered entities and business associates. Microsoft says using its services “doesn't on its own achieve HIPAA compliance,” so your sharing and access settings still matter.

Does OneDrive sign a BAA?

Yes, for OneDrive for Business. Microsoft includes its HIPAA BAA by default for covered entities and business associates on Office 365 Commercial and GCC subscriptions. In Microsoft's words: “The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.” We checked Microsoft's own pages on October 26, 2026.

Which OneDrive plans are covered by a BAA?

Microsoft lists OneDrive for Business among the in-scope Office 365 services for Commercial and GCC subscriptions (Microsoft Learn). For a covered entity or business associate whose data includes PHI, Microsoft's Data Protection Addendum says “execution of Customer’s agreement includes execution of the HIPAA Business Associate Agreement” (Microsoft DPA), so there is no separate BAA to sign. A customer can opt out of it by written notice to Microsoft.

Is a personal OneDrive account covered by a BAA?

Not on Microsoft's in-scope list. That list names OneDrive for Business on Office 365 Commercial and GCC subscriptions (Microsoft Learn), and Microsoft's BAA comes through its Data Protection Addendum, which Microsoft says applies “When you subscribe to a Product under the terms of the Product Terms site” (Microsoft). Keep PHI in OneDrive for Business under your organization's subscription, not in a personal OneDrive.

What should I set up before storing PHI in OneDrive?

Start with sharing. Microsoft says “As a SharePoint Administrator in Microsoft 365, you can change the organization-level sharing settings for SharePoint and OneDrive,” and that with “Anyone with the link” sharing “you can't track who has access to shared items or who has accessed shared items” (Microsoft Learn). Microsoft's HIPAA page also says Compliance Manager “offers a premium template for building an assessment for this regulation” (Microsoft Learn).

Can I keep lead or patient lists in OneDrive?

In OneDrive for Business, under Microsoft's BAA, with sharing set the way your policies require. The BAA stops at Microsoft: a lead list or conversion file uploaded from OneDrive to Meta or Google Ads is outside it, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends conversions to ad platforms server-side instead, with a fixed list of fields for each platform.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Microsoft before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call