Official documentation checked October 14, 2026.
Microsoft Copilot and Copilot Chat can support HIPAA compliance in properly configured organizational implementations, but a subscription alone does not authorize every patient-data workflow. Your organization must verify contract scope, data flows, safeguards, and the intended use before submitting protected health information.
This is a deployment review guide, not legal advice or approval for clinical use. Involve the organization’s privacy, security, and clinical governance owners.
Confirm the agreement and exact service
Microsoft explains that its HIPAA Business Associate Agreement is provided through the Online Services Data Protection Addendum for covered entities and business associates using in-scope services. Do not assume a separate negotiated amendment is always required, or rely on a supposed Copilot admin screen showing “BAA active.” Have the contracts owner verify the actual agreement and service coverage.
Distinguish organizational Copilot from personal chat, previews, Copilot Studio agents, and custom applications. Record the exact feature and enabled model. Where an agent or model has separate terms, resolve their applicability before approval.
A BAA supports compliance; it does not certify your organization’s deployment. Microsoft makes this distinction explicitly. Keep the contract evidence with the use-case approval, not merely a screenshot of a purchased license.
Map where patient information could go
Microsoft’s enterprise data protection guidance states that web-search queries are not covered by the DPA and BAA. For a workflow that may contain PHI, have the administrator enforce an approved web-search configuration; do not depend on users remembering to omit patient information.
Review every agent, connector, action, and external model separately. Do not assume that all are prohibited or all are covered. The model-provider documentation distinguishes configurations with different contractual and retention terms.
List the source record, prompt, generated response, feedback path, retained interaction, and exported output. Decide where each may be stored and who may access it. A copied summary can become a new sensitive record even if the source permissions were correct.
Choose safeguards and licenses from the assessment
There is no general Microsoft rule that only E5 or G5 can support a HIPAA-related Copilot deployment. Copilot eligibility and the licenses for your chosen security, audit, and retention controls are separate questions.
The HHS Security Rule summary covers risk assessment, access controls, audit controls, and documentation. It does not prescribe Microsoft Customer Key as the universal solution for unique user identification. Select and document safeguards appropriate to your obligations; do not substitute a product checklist for that assessment.
Verify underlying access permissions and the behavior of configured labels or DLP policies. A label’s name does not replace authorization, and the absence of a label does not give Copilot permission to bypass file access controls.
Keep audit-event retention and content retention separate. HHS’s six-year rule concerns required compliance documentation; it is not a blanket statement that every raw Copilot audit event must be retained for six years. Have the records owner establish the applicable schedule and confirm the technical retention capability.
Pilot with synthetic data before approving production
- Define a narrow administrative use case and the prohibited uses. Do not treat general-purpose Copilot as validated clinical decision support.
- Use synthetic patient examples, not real records, to test the approved configuration.
- Test intended access, prohibited access, web-search restrictions, and relevant audit and content-retention evidence.
- Require a qualified person to compare summaries against their sources. Check patient identity, dates, negations, medication details, and omitted context before accepting any clinical text.
- Record approval, unresolved gaps, incident reporting, and a review trigger for feature or model changes.
If PHI is sent to an unapproved destination, stop further disclosure, preserve the facts, and follow the organization’s incident procedure. Deleting the visible conversation is not a complete incident response or proof that every retained copy is gone.