Yes, with conditions: Microsoft Teams on a paid commercial plan is covered by Microsoft's HIPAA Business Associate Agreement (BAA), the contract HIPAA requires before a vendor handles patient information, and Microsoft says that BAA applies by default through its Online Services Data Protection Addendum. The free consumer version of Teams is not listed as in scope, and the BAA is the starting line, not the finish.
The short answer and why
Microsoft is unusually direct. As of November 2026, its compliance documentation says: "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." Microsoft Teams is listed among the in-scope Office 365 commercial services. Terms change, so verify on Microsoft's site and keep a copy of the addendum.
The words matter. HIPAA applies to covered entities (your practice) and business associates (vendors that handle patient information for you). Before a vendor handles protected health information (PHI), anything that identifies a patient and relates to their health, care or payment, the practice needs a Business Associate Agreement (BAA), the contract where the vendor agrees to protect it (45 CFR 164.502(e)). Microsoft folds it into the standard terms of its commercial plans.
The catch is the word "commercial." The free Teams anyone can download is not listed among the in-scope services. If your office runs on free Teams, or on a mix of work and personal accounts, you do not have the coverage you think you have.
What HIPAA actually asks of a chat app
A BAA is one row on HIPAA's list. Here is the rest.
| What the rule needs | What Microsoft Teams offers per its own site | |
|---|---|---|
| Signed BAA | A contract with the vendor before any PHI is shared | By default through the Online Services Data Protection Addendum on commercial plans; free consumer Teams not listed in scope |
| Access controls | Only current staff, with roles that limit who sees what | Work accounts on business plans for 1 to 300 users; guest access and chat with personal accounts exist and need an admin decision |
| Audit log | A record of who sent, read and exported what | Not described on the pricing or BAA pages we read; confirm what your plan includes |
| Encryption in transit and at rest | An addressable safeguard for data moving and stored | Compare page lists "Data encryption for meetings, chats, calls, and files" on all business plans |
| Retention and deletion | Keep and delete on a schedule you control | Not described on the pages we read; set your policy and confirm your plan can enforce it |
| Minimum necessary | Share only what the other person needs | A policy you write; Microsoft notes a BAA does not by itself make a customer compliant |
What Microsoft says
Beyond the BAA statement, Microsoft says its in-scope services are audited for ISO/IEC 27001 and HITRUST CSF, and it notes that a BAA does not by itself make a customer HIPAA compliant. Hear that as a prompt to do your part.
On price, Microsoft's pages show Teams Essentials at $4.00 per user per month paid yearly (chat, calling, video meetings, 10 GB of cloud storage per user, no Office desktop apps or business email), Microsoft 365 Business Basic at $7.00 paid yearly (web and mobile Office apps, business email, Teams, 1 TB per user), Business Standard with Copilot at $23.50, and Teams Premium as a $10.00 add-on. All are annual subscriptions that auto-renew. For 5 people that is $20 a month on Teams Essentials or $35 on Business Basic, billed for the year.
What a practice would have to do
- Be on a paid commercial plan, Teams Essentials or a Microsoft 365 Business plan, not free Teams.
- Confirm the Online Services Data Protection Addendum applies to your subscription, through Microsoft or your reseller, and keep the document.
- Put every staff member on a work account. Guest access and chat with personal accounts are features, and also doors; decide in writing whether they stay open.
- Name an admin who adds and removes people. Offboarding on the day someone leaves is the most skipped step.
- Write retention, device and minimum-necessary policies, train staff, and check whether third-party apps you add bring their own BAA.
When a simpler tool fits. If you already pay for Microsoft 365 for email, Teams is the obvious choice and the BAA is already there. If you do not, know what you are buying: 30-hour meetings, Planner, Bookings, Shifts, Forms, more than 250 integrations and an admin center, on an annual commitment, for an office that wanted a place to say "room 3 is ready."
The real risk in a small practice
A chiropractic office buys Microsoft 365 for email and starts using Teams for chat. It goes fine until the owner adds the part-time biller as a guest from her personal account. Then the new front desk hire is told to "just download Teams," installs the free version, and chats with the office from there. Six months in, half the conversations about patients happen across accounts nobody set up, with no retention policy, no offboarding owner and x-rays shared as files in a chat that will live forever.
The BAA covers Microsoft's obligations, not a tenant nobody administers. "Microsoft is HIPAA compliant so we are fine" is the specific way a Teams office gets into trouble: the paperwork is genuinely in place and the setup is not.
Alternatives with a BAA
If Teams is more than you want to run, lighter tools also sign a BAA. Prices are as of November 2026; check each vendor's site.
Yodl is $10 a month per location for 5 users, 20 GB of file storage and a signed BAA on every plan, month to month with no annual commitment. It is staff chat only: channels, DMs, threads, file sharing and search, with invite-only workspaces, channel roles (Manager, Member, Viewer), an audit viewer with CSV export, retention controls and legal hold, and a 13-gate HIPAA readiness checklist in the admin panel so setup is a list rather than a guess. It has no video calls and no email. See Yodl vs Microsoft Teams.
Google Workspace Business Starter is $7 per user per month on the annual plan or $8.40 on the flexible plan, and Google Chat is covered once an admin accepts Google's BAA in the Admin console, so it suits an office already on Gmail. Trillian offers a BAA on its Enterprise tier at $7.99 per user per month billed annually with a 5-user minimum. Teams remains right for an office that lives in Microsoft 365, holds video visits, or uses Shifts and Bookings.
If you want staff chat with a BAA and no annual contract, Yodl is $10 a month for 5 people with a signed BAA at yodl.cc/pricing.
Microsoft Teams on a paid commercial plan comes with Microsoft's BAA by default, a real HIPAA option from $4 per user per month paid yearly. The free version is not in scope, and the BAA does not set up your accounts, policies or staff habits for you.
Frequently asked questions
Does encryption make Microsoft Teams HIPAA compliant?
No single feature does. Microsoft lists data encryption for chats, calls, meetings and files on all business plans, and the BAA applies by default on commercial plans. Compliance still depends on your accounts, policies and training.
Can I use Microsoft Teams for non-PHI scheduling messages?
Yes, and on a paid commercial plan you can use it for PHI too, within your policies. The trap is mixing in free or personal accounts for convenience, which takes those conversations outside the covered setup.
Is the free version of Microsoft Teams HIPAA compliant?
Microsoft does not list the free consumer Teams among its in-scope services. Treat it like any consumer app: no PHI.
Do I have to sign anything to get Microsoft's BAA?
Microsoft says the BAA is available by default through the Online Services Data Protection Addendum to customers who are covered entities or business associates. Confirm it applies to your subscription and keep a copy.
Is there a HIPAA certification for Microsoft Teams?
No. HIPAA has no certification program for any app. Microsoft's in-scope services are audited against ISO/IEC 27001 and HITRUST CSF, which are separate frameworks, and Microsoft says a BAA alone does not make a customer compliant.