Office 365 HIPAA Checklist for Clinics

Our Office 365 HIPAA checklist covers the 29 checks we run first when we take over a clinic's Microsoft 365 tenant.

Microsoft retired the "Office 365" name a few years ago, but plenty of practices still search for it, and the plans are the same ones you buy today as Microsoft 365. Everything below applies either way. Work down the list, tick what you can prove, and note what you can't.

One thing to get straight first. Microsoft will sign a Business Associate Agreement, and its datacenters are well secured. That covers Microsoft's half. HIPAA also cares about how your tenant is configured, who can get into it, and what your staff do with patient data inside it. That half belongs to you (or to whoever manages your IT), and it's where most practices have gaps.

This is a technical checklist, not legal advice. HIPAA also expects a documented risk analysis, written policies, and trained staff, and no pile of settings replaces those.

1. Paperwork: the BAA and the risk analysis

• Confirm the Microsoft BAA applies to your tenant. For commercial Microsoft 365 plans, the HIPAA BAA is built into Microsoft's online services terms (the Data Protection Addendum), so there's usually nothing extra to sign. Where it gets murky is subscriptions bought through a web host or consumer-style bundle. Find out who actually bills you, and get the BAA language for that arrangement in writing. Our write-up on what a BAA actually covers goes deeper, and so does the one on reseller vs. direct Microsoft licensing.
• Check that every other tool touching patient data has its own BAA. Backup software, e-fax, e-signature, the email-security add-on. Microsoft's agreement doesn't stretch to them.
• Have a current security risk analysis on file. The Security Rule requires one, and an auditor will ask for it before they ask about your Conditional Access policies. The M365 settings below feed into it.

2. Sign-in and access control

• Require MFA for every account. That includes the shared front-desk login, service accounts, and the doctor who "doesn't do phones." The Security Rule doesn't spell out MFA by name today, though HHS proposed making it explicit in 2025. Check where that rule stands. Either way, one stolen password is how most small-clinic breaches start. Prefer the Microsoft Authenticator app (with number matching) or a hardware key over text messages.
• Enforce it with Conditional Access, not a polite request. Security defaults work for the smallest tenants. Business Premium includes Conditional Access, which lets you require MFA, block sign-ins from countries you have no staff in, and demand a compliant device for patient-data apps.
• Block legacy authentication. Old protocols like POP, IMAP and basic SMTP auth can't do MFA, so attackers go straight to them. Turn them off unless a specific device truly needs one, and then isolate that device.
• Keep admin accounts separate and few. Nobody should read email from the same account that holds Global Administrator. Two or three admins is plenty. Add one emergency "break-glass" account with a long password stored offline.
• Retire shared logins. If six people use one mailbox password, your audit log can't say who opened a chart. Use shared mailboxes with individual access instead.

3. Devices and encryption

• Enroll every device that touches patient data in Intune. A lost laptop with cached patient email is a reportable event unless the drive was encrypted and you can show it. Intune can push BitLocker on Windows, enforce a screen lock, and wipe a device that walks off.
• Protect personal phones without taking them over. App protection policies let staff read work email on their own phone while the work data stays in a managed container, with a PIN and no copy-paste into personal apps.
• Know what's already encrypted. Microsoft encrypts Exchange, SharePoint and OneDrive data in transit and at rest by default. You don't need to switch that on. Document it in your risk analysis and move on.
• Turn on message encryption for outbound email to outside parties. Microsoft Purview Message Encryption lets staff send PHI to a lab or a payer so that only the recipient can open it. A transport rule can apply it when certain words or patterns show up.

4. Stopping PHI from leaving

• Set up Data Loss Prevention policies. Microsoft ships a built-in HIPAA template that looks for things like Social Security numbers, medical terms and patient identifiers in email and files. Start in "tell the user" mode, watch the reports for a couple of weeks, then switch to blocking. Which workloads DLP covers depends on your license, so check Microsoft's current licensing guide for Teams chat and endpoint protection.
• Block automatic forwarding to outside addresses. Attackers who break into a mailbox often add a quiet forwarding rule. Set the outbound spam policy to disable auto-forwarding, and do the same for inbox rules that redirect mail externally.
• Tighten SharePoint and OneDrive sharing. Turn off anonymous "anyone with the link" sharing for patient folders, limit external sharing to named people, and set links to expire.
• Limit which apps staff can approve. By default a user can click "Accept" and hand a random third-party app access to their mail. Restrict user consent and route requests through an admin approval workflow.
• Review guest accounts every quarter. Old vendor and consultant guests tend to stick around for years.

5. Logging, retention and backup

• Verify the unified audit log is on. It's enabled by default on most tenants now, but check it rather than assume. The log is how you answer "who opened this mailbox and when." You can't turn it on after the fact for events that already happened.
• Know how long you keep it. Audit (Standard) keeps records for 180 days. HIPAA's six-year requirement applies to your policies and documentation, and it doesn't set a retention period for raw logs. If your policy says longer, export the logs or move up to a plan with longer retention.
• Confirm mailbox auditing is on. It is by default, and it should stay that way. It records actions like mailbox access by delegates and admins.
• Write down a retention policy and apply it. Purview retention policies can keep email and files for the period your records policy calls for, and stop people from deleting them early. State laws vary on how long medical records last, so match yours.
• Decide what happens to a departed employee's mailbox. A deleted user's mailbox is purged after 30 days unless it's on hold or converted. We wrote a separate piece on former-employee mailboxes.
• Back up Microsoft 365 with a separate tool. Microsoft keeps the service running. It doesn't promise to restore a file your office manager deleted eight months ago. A third-party backup needs its own BAA too.

6. Threat protection

• Turn on anti-phishing and Safe Links / Safe Attachments. Business Premium includes Defender for Office 365 Plan 1. Many tenants have it licensed and never configured, so check the policies exist and apply to everyone.
• Configure SPF, DKIM and DMARC for your domain. They make it harder for someone to send mail that looks like it came from your clinic, and your patients get fewer fake billing emails.
• Watch the alerts. A setting nobody looks at is not a control. Decide who receives security alerts and what they do when one fires.

7. People and process

• Train staff on phishing and PHI handling, then keep records. Annual training with sign-off sheets is the baseline. Short quarterly reminders work better.
• Write an offboarding checklist and use it. Disable the account, revoke sessions, convert or hold the mailbox, collect the laptop, remove access to shared folders. All on the same day.
• Keep evidence. Screenshots of settings, plus dated notes on what you changed and why. If HHS asks, "we think it's configured" won't carry much weight, and a binder will.

What to do with the list

Count the boxes you couldn't tick. A few misses on a first pass is normal. A tenant on Business Basic or Standard with MFA "encouraged" will miss most of sections 2 through 6, because the tools that enforce them sit in Business Premium. For most clinics under 300 users, the price difference per seat is small next to one breach notification mailing.

Microsoft's own Secure Score and Compliance Manager will help you track progress, and Compliance Manager includes a HIPAA assessment template. Neither tells you that you're HIPAA compliant. They measure settings. Compliance also means policies, training and a risk analysis that match how your clinic really runs.

If you'd rather have someone else walk the list, that's what we do. We audit the tenant, fix what's off, and hand you the documentation. You can talk to us here, or see what we handle for healthcare practices.

Frequently asked questions

Is Office 365 HIPAA compliant out of the box?

No. Microsoft 365 can support HIPAA compliance, and Microsoft will sign a BAA for eligible plans, but compliance depends on how the tenant is set up and used. MFA, device encryption, DLP, retention and logging all need to be configured and documented by the practice or its IT provider.

Does Microsoft sign a BAA for Microsoft 365?

For commercial Microsoft 365 plans, Microsoft includes HIPAA BAA terms in its online services terms, so most customers don't need a separate signature. If you bought through a reseller, web host or bundle, confirm in writing that the BAA applies to your subscription.

Which Microsoft 365 license do I need for HIPAA?

Many small clinics choose Microsoft 365 Business Premium, because it bundles Conditional Access, Intune device management, Defender protection and basic DLP and retention. Licensing changes over time, so check Microsoft's current plan comparison against the controls you need.

Can I put patient information in Teams, OneDrive and SharePoint?

Yes, when your tenant is covered by Microsoft's BAA and you've set up access control, sharing limits, retention and logging. Keep PHI out of personal accounts and any apps that don't have a BAA.

How long should I keep Microsoft 365 audit logs?

HIPAA requires you to keep policies and documentation for six years, but it doesn't set a number for raw audit logs. Standard auditing in Microsoft 365 keeps events for 180 days. Set a period in your own policy and export or upgrade if you need longer.

Does a good Secure Score mean I'm HIPAA compliant?

No. Secure Score measures configuration against Microsoft's recommendations. HIPAA compliance also requires a risk analysis, written policies, staff training and signed BAAs.