Skip to main content
BAA Directory

Is SharePoint HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for SharePoint Online. Microsoft includes its HIPAA BAA by default for covered entities and business associates on Office 365 Commercial and GCC.

Automation and workspace. Checked on the vendor's own pages on .

Using SharePoint on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Microsoft says

“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

“If Customer is a “covered entity” or a “business associate” and includes "protected health information" in Customer Data or Professional Services Data, as those terms are defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations promulgated thereunder (collectively, “HIPAA”), execution of Customer’s agreement includes execution of the HIPAA Business Associate Agreement (“BAA”).”

Source: Microsoft Products and Services Data Protection Addendum (May 2026), HIPAA Business Associate, checked .

“Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.”

Source: Microsoft Learn, HIPAA and HITECH Act, checked .

What the BAA covers and excludes

Covers, in Microsoft's words:

Excludes or limits, in Microsoft's words:

What this means for ad tracking

SharePoint sites, document libraries and lists can hold intake files, referral letters and lead trackers, so information that ties a person to their care can end up there.

A BAA with Microsoft covers the content SharePoint Online stores for you. It does not cover an ad platform, so a lead list or conversion file that goes from SharePoint to Meta or Google Ads leaves that BAA behind and should carry no health details. This directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA.

SharePoint sits under Microsoft 365, and Microsoft sets its sharing at the organization level together with OneDrive. To compare storage providers, see our guide to HIPAA compliant cloud storage.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep SharePoint for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is SharePoint HIPAA compliant?

SharePoint Online can be used in a HIPAA-compliant way: it is an in-scope service under Microsoft's HIPAA BAA, which Microsoft offers by default to covered entities and business associates. Microsoft says using its services “doesn't on its own achieve HIPAA compliance,” so your site permissions and sharing settings still matter.

Does SharePoint sign a BAA?

Yes, for SharePoint Online. Microsoft includes its HIPAA BAA by default for covered entities and business associates on Office 365 Commercial and GCC subscriptions. In Microsoft's words: “The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.” We checked Microsoft's own pages on October 26, 2026.

Which SharePoint plans are covered by a BAA?

Microsoft lists SharePoint Online among the in-scope Office 365 services for Commercial and GCC subscriptions (Microsoft Learn). For a covered entity or business associate whose data includes PHI, Microsoft's Data Protection Addendum says “execution of Customer’s agreement includes execution of the HIPAA Business Associate Agreement” (Microsoft DPA), so there is no separate BAA to sign. A customer can opt out of it by written notice to Microsoft.

Are SharePoint and OneDrive under the same BAA?

Yes. Microsoft lists both “OneDrive for Business” and “SharePoint Online” as in-scope services under its HIPAA BAA (Microsoft Learn). Their sharing settings are linked too: Microsoft says “The OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive” (Microsoft Learn). See the OneDrive entry.

What should I set up before storing PHI in SharePoint?

Start with sharing. Microsoft says “As a SharePoint Administrator in Microsoft 365, you can change the organization-level sharing settings for SharePoint and OneDrive,” and “You can configure more restrictive settings for specific sites if needed” (Microsoft Learn). Microsoft's HIPAA page also says Compliance Manager “offers a premium template for building an assessment for this regulation” (Microsoft Learn).

Can I keep lead or patient lists in SharePoint?

In SharePoint Online, under Microsoft's BAA, with site permissions and sharing set the way your policies require. The BAA stops at Microsoft: a lead list or conversion file uploaded from SharePoint to Meta or Google Ads is outside it, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends conversions to ad platforms server-side instead, with a fixed list of fields for each platform.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Microsoft before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call