How to be HIPAA Compliant

What Customers Need to Do to Be HIPAA Compliant?

1. Identity & Access

Enable Multi-Factor Authentication (MFA) for all users.

2. Administrative Roles

Assign admin roles only to trusted personnel.

3. Email Protection

Use Microsoft Purview Message Encryption for emails containing PHI.

4. Data Loss Prevention

Set up Data Loss Prevention (DLP) policies.

5. Compliant Storage

Store PHI only in OneDrive for Business or SharePoint Online.

6. Audit Controls

Enable audit logging to track access and changes.

7. Retention Management

Configure retention policies for record-keeping.

8. Staff Education

Train staff on secure handling of PHI.

9. Continuous Monitoring

Use Microsoft Purview Compliance Manager to monitor compliance.

---

How Customers Can Show They’re Compliant?

Demonstrating Compliance

• Maintain internal documentation of all compliance measures.
• Use Compliance Manager (https://purview.microsoft.com) to generate reports.
• Optionally, engage a third-party auditor for a compliance attestation.

---

Note

Microsoft does not issue a HIPAA compliance certificate, since only you can prove how securely you manage PHI.

HIPAA compliance is therefore self-attested, customers must document their own efforts.

Microsoft automatically provides a Business Associate Agreement (BAA) when a tenant is created, confirming that Microsoft 365 services protect PHI through encryption, restricted data center access, and non-disclosure of data.