Azure HIPAA Compliance
Complete Implementation Guide

Microsoft includes its HIPAA Business Associate Agreement (BAA) in the Microsoft Product Terms (formerly Online Services Terms) for customers under a qualifying volume-licensing, Enterprise Agreement, CSP, or Microsoft Online Subscription agreement. There is no separate document to sign for most customers — coverage is granted automatically, but you should confirm your agreement type and keep records of the BAA terms in force.

Azure is not "HIPAA certified" — HIPAA has no certification. Microsoft signs a BAA and supports HIPAA across most Azure services. Compliance is shared: Microsoft secures the infrastructure, and you are responsible for configuring services correctly and documenting your controls through a Security Risk Assessment.

Most Azure services are in scope, including Azure Health Data Services, Blob Storage, Azure SQL Database, Virtual Machines, Functions, Cosmos DB, AKS, Key Vault, Azure Monitor, Azure Backup, and Private Link. Coverage is broad but not universal, so confirm a specific service in Microsoft's current HIPAA documentation before placing PHI on it.

You own security of your configuration and data: customer-managed encryption keys, Microsoft Entra ID (Azure AD) access control with conditional access, Azure Monitor audit logging, guest-OS patching on VMs, network security groups and Private Link, Azure Backup, and your application. Microsoft secures the physical infrastructure and hypervisor.

Use Azure Backup for VMs and databases with encryption and geo-redundancy, enable point-in-time restore on Azure SQL, apply immutable (WORM) policies on Blob Storage, and consider Azure Site Recovery for disaster recovery. Backups containing PHI must themselves be encrypted and access-controlled, and your retention policy should match your BAA and HIPAA requirements.