A healthcare Copilot rollout requires both Microsoft’s BAA coverage and health system controls. That’s why health systems ask “is Microsoft Copilot HIPAA compliant” before deployment. Microsoft lists Microsoft 365 Copilot and Microsoft 365 Copilot Chat as in-scope services under its HIPAA business associate agreement. Its own documentation ties that coverage to how the tenant is configured.
There’s no Department of Health and Human Services (HHS) certification program for the Health Insurance Portability and Accountability Act (HIPAA), so the question requires a two-part answer. Microsoft’s BAA addresses its responsibilities for covered services, while each health system remains responsible for its own HIPAA obligations, configuration, access controls, risk analysis, and governance. If you’re the CISO or compliance lead making the call on Copilot, you’re carrying that second half.
Healthcare AI adoption is outpacing its guardrails, and ordinary Copilot use can blur the line between covered and uncovered services. A clinician pastes a patient note into the consumer Copilot app on a personal phone, outside any BAA. An HR analyst asks enterprise Copilot a benefits question and receives treatment notes from a SharePoint site overshared years ago.
Each can turn a HIPAA-eligible tool into a compliance incident. This article unpacks where Microsoft’s coverage ends, where the covered entity’s work begins, and how to build the controls that connect the two.
Key takeaways
- Microsoft 365 Copilot is HIPAA-eligible only when used through covered enterprise services in a properly configured tenant, and Microsoft’s BAA doesn’t make a healthcare organization compliant on its own.
- Consumer Copilot, GitHub Copilot, and web-search queries fall outside the relevant HIPAA coverage, so health systems must keep PHI away from personal accounts and other uncovered paths.
- Governance must extend beyond native tenant controls to address shadow AI, prompt intent, data exfiltration, and runtime threats such as prompt injection.
- Copilot Studio agents need the same oversight as human users, including restricted service-principal access, traceable human authorization, and pre-execution controls over tools and workflows.
What “HIPAA compliant” means for Microsoft Copilot
HIPAA compliance requirements for a cloud AI service depend on its contracts and operations. HHS has no certification program through which a cloud provider acting as a business associate can demonstrate compliance.
A vendor can offer a business associate agreement (BAA) that covers a defined list of services. A service is “in scope” when it appears on that list, and “HIPAA-eligible” is the correct term.
Microsoft’s compliance documentation names Microsoft 365 Copilot and Microsoft 365 Copilot Chat among in-scope commercial services. Microsoft’s enterprise data protection documentation says Copilot and Copilot Chat “support HIPAA compliance for properly configured implementations” and excludes web search queries from that coverage.
Under HIPAA’s shared responsibility model, the BAA governs how Microsoft handles protected health information (PHI) on its infrastructure. Whether a hospital’s Copilot deployment is compliant depends on how it configures, monitors, and governs it.
Stop Choosing Between AI Innovation and Security
WitnessAI lets you observe, protect, and control your entire AI ecosystem without slowing down the business. Enterprise AI adoption, without the risk.
See How It WorksWhich Copilot versions fall inside the HIPAA BAA
Coverage depends on the product and account type. The same logo appears on a covered enterprise service and an uncovered consumer app, and a clinician on a phone may not tell them apart. The split below shows which Copilot surfaces sit inside the BAA, which sit outside it, and where health systems need to draw the line before PHI crosses it.
Enterprise Copilot, Copilot Chat, and Copilot Studio are in scope
Microsoft 365 Copilot and Copilot Chat carry enterprise data protection when users sign in with Microsoft Entra accounts. Those commitments cover encryption at rest and in transit and tenant isolation. Microsoft also pledges not to use prompts and responses to train foundation models.
Copilot Studio is covered under the BAA as a platform, so organizations can build agents that handle PHI. Coverage for a custom agent depends on the connectors and services it calls; a connector or preview feature outside the HIPAA-eligible list takes that path out of scope.
Consumer Copilot, GitHub Copilot, and web searches aren’t
Consumer Copilot under a personal Microsoft account or a Microsoft 365 Family plan runs under the Microsoft Services Agreement. Microsoft’s guidance is that PHI shouldn’t be entered into Copilot features on those plans. Microsoft’s Zero Trust guidance also states that enterprise data protection is not included in Copilot Chat for personal use.
Consumer Copilot operates under different data-protection terms from Microsoft 365 Copilot. Health systems should follow Microsoft’s current consumer-service guidance and keep PHI out of services that are not covered by the applicable BAA.
GitHub Copilot is absent from the in-scope list. Even inside an enterprise tenant, web search queries fall outside the DPA and BAA because Bing operates under the Microsoft Services Agreement with Microsoft as an independent data controller.
That split creates a Shadow AI governance gap a BAA doesn’t reach. In a December 2025 healthcare worker survey, 17% of healthcare workers admitted using unauthorized AI tools, and more than 40% knew of colleagues doing so. A patient note pasted into the personal Copilot app is routed outside the covered tenant, on the same device the hospital licensed for enterprise Copilot.
Use network-level AI governance controls to monitor and enforce policy across supported Copilot and other AI interactions, and pair those controls with workforce training to keep PHI out of personal Copilot accounts. Training should cover the fact that the two apps look alike.
Your Employees Are Already Using AI. Are You Governing It?
WitnessAI gives you full visibility into employee AI usage, classifies intent behind every interaction, and enforces smart policies, without slowing anyone down.
Learn About WitnessAI For EmployeesWhat the BAA leaves to the covered entity
The business associate agreement (BAA) covers Microsoft’s obligations as a business associate and stops there. HHS limits a cloud provider’s liability to unauthorized uses or disclosures, failures to safeguard ePHI, and failures to notify of a breach. Microsoft states that having its BAA doesn’t, by itself, make an organization HIPAA compliant.
The covered entity is still responsible for core administrative safeguards: risk analysis, information access management, audit review, workforce training, and sanction policy.
The organization still needs appropriate access controls, audit capabilities, retention practices, and rules governing where PHI may go; controls such as MFA and conditional access may form part of that implementation based on the organization’s risk analysis.. The remaining obligations track the deficiencies OCR cites most often.
Four responsibilities shape a defensible Copilot rollout:
- Copilot-specific risk analysis: Document the risks and vulnerabilities that Copilot introduces to ePHI. Treat the BAA as the first control, then record how the organization will manage the remaining exposure.
- Permission remediation: Review SharePoint and OneDrive access before rolling out Copilot broadly. Overshared clinical content can become available through otherwise ordinary prompts.
- Content-level audit trails: Preserve enough interaction detail to show what users asked and what Copilot returned. Purview captures interaction metadata, while prompt and response text may require complementary controls or mailbox searches.
- Minimum-necessary enforcement: Apply controls to the meaning and intent of prompts. Clinical notes can contain PHI without matching a Social Security number or another predefined sensitive information type.
Start with the required risk analysis, then address permissions and audit trails. Add minimum-necessary controls at the prompt.
The Security Rule requires a thorough assessment of the risks and vulnerabilities to ePHI, and OCR’s cloud computing guidance expects the covered entity to conduct its own analysis. In April 2026, OCR settled four ransomware investigations for a combined $1,165,000, each citing risk analysis failures.
OCR Acting Director Anthony Archeval put it plainly: “Risk analysis often foreshadows a future HIPAA breach.” A Copilot rollout with no documented AI risk analysis fits that pattern. Treat the BAA as the first control, then document a Copilot-specific risk analysis that names the deficiency OCR cites most often.
That analysis should account for permissions. Copilot surfaces organizational data to which users have at least view permissions, and Microsoft warns that “overshared or poorly governed content can affect Copilot results and increase risk.” A clinical site shared with “Everyone except external users” becomes answerable to an HR analyst’s prompt, which is why Microsoft’s deployment guidance puts remediating SharePoint and OneDrive oversharing ahead of guardrails and regulatory settings.
Permissions also shape the audit trail. Audit controls are a required standard under 45 CFR 164.312(b), with no addressable alternative. Microsoft provides native Copilot audit and eDiscovery capabilities through Purview. The exact interaction content available, retrieval workflow, retention period, and licensing requirements should be described according to Microsoft’s current Purview documentation. Pairing Purview with a platform that adds context for routed interactions lets an investigation show what was asked and returned without a mailbox search.
Native DLP controls can enforce policies around configured sensitive-data types, but clinical PHI can also appear in unstructured, contextual language that static patterns alone may not reliably characterize. Intent- and context-aware controls can complement those mechanisms. Medication histories can be considered clinical PHI and may fall outside predefined patterns. Together, these controls turn BAA eligibility into a governed Copilot program with evidence that compliance leaders can evaluate.
What Does AI Compliance Look Like?
WitnessAI automatically logs every AI interaction, masks sensitive data in real time, and enforces regulatory policies across every region and business line. Audit-ready from day one.
See WitnessAI For ComplianceHow AI risk management closes the gaps the BAA leaves open
The BAA leaves gaps that only the covered entity can close, and those gaps sit outside the Microsoft tenant as often as they sit inside it. A covered entity’s risk analysis and minimum-necessary controls must account for AI usage that never touches Microsoft at all, which is why a HIPAA-compliant Copilot program depends on controls that reach beyond the tenant.
A unified AI governance platform can help healthcare organizations observe and control AI activity across human employees and autonomous AI agents. For a covered entity, that means visibility and audit evidence to support a Copilot-specific risk analysis, prompt-level enforcement of minimum-necessary policies, and AI audit trails that record what was said.
Microsoft Purview delivers native Copilot governance for the tenant. Complementary AI governance tooling can extend visibility and policy enforcement beyond the Microsoft tenant and add content- and context-aware controls where required. The sections that follow walk through three areas where that extended visibility matters most.
1. Seeing PHI flows across enterprise and personal Copilot
Purview sees the Microsoft tenant; a covered entity increasingly benefits from seeing the personal Copilot app and the other AI tools its workforce uses.
When deployed through supported network-level integrations, WitnessAI can build an AI application inventory without browser extensions or endpoint clients and provide visibility into browser and embedded AI applications, including supported Microsoft Copilot interactions.
That visibility can help organizations identify Shadow AI and apply risk- and intent-based policies to supported AI interactions, including controls designed to reduce inappropriate PHI exposure.
2. Governing prompts by intent rather than pattern
Intent-based classification evaluates a prompt’s purpose rather than matching it against fixed patterns. Intelligent policies can then take one of four actions: allow, warn, block, or route the query to an approved internal model. A discharge summary headed for a web-grounded query can be warned or routed.
Where configured, sensitive identifiers can be tokenized before reaching the AI model and restored for the authorized downstream workflow. Audit trails for interactions routed through a governance layer can capture both prompt and response, a content-level record the Purview audit schema was not designed to carry.
3. Applying runtime controls to Copilot surfaces against prompt injection attacks
EchoLeak, tracked as CVE-2025-32711, was rated at 9.3 severity. A crafted email led Microsoft 365 Copilot to disclose internal data with no user action. Microsoft applied a server-side fix that required no customer action. An arXiv paper called it “the first known case of a prompt injection being weaponized to cause concrete data exfiltration in a production AI system.” The technique used Copilot’s own permissions, so the retrieval looked authorized.
Runtime guardrails complement existing network security controls by inspecting conversational context. Effective guardrails against jailbreaking, prompt injection and overrides apply bidirectional runtime controls: prompts are inspected before a model or agent acts and responses before they reach users.
Runtime AI Threats Need Runtime Defense.
WitnessAI’s enterprise AI firewall delivers bidirectional runtime defense, blocking prompt injections, jailbreaks, and data exfiltration before they reach your models or your customers.
Explore ProtectBuilding the confidence layer around Copilot in healthcare
Microsoft 365 Copilot is HIPAA-eligible, which answers the vendor half of the question. For the covered entity, that includes a Copilot-aware risk analysis, appropriate permission management, sufficient audit evidence, and controls designed to support minimum-necessary handling of PHI in AI interactions. Governance also has to reach personal Copilot apps and Copilot Studio agents.
WitnessAI can provide CISOs and compliance leaders with audit evidence showing how configured AI governance and security controls are being applied. To see how that applies to your Copilot deployment and your agent roadmap, schedule a demo.