Is Microsoft Teams HIPAA compliant? What a dental or medical office should know
Microsoft offers a Business Associate Agreement for its in-scope online services through its data protection terms, by default for customers who are covered entities or business associates, and lists Teams as in scope for Office 365 commercial and GCC. Your office still has to be on a covered subscription and configure Teams as Microsoft requires. Checked October 12, 2026.
This is general information for dental and medical offices, not legal advice. Vendor terms change, so check the linked pages on the day you decide, and talk with your compliance advisor before patient information goes anywhere.
What Microsoft's own pages say
- BAA by default. Microsoft says its HIPAA BAA is available through its online services data protection terms by default to customers who are covered entities or business associates (Microsoft HIPAA/HITECH).
- Teams is in scope. Microsoft lists Teams among in-scope services for Office 365 commercial and GCC.
- A standalone copy exists. Microsoft links the BAA document from its Service Trust Portal.
What we couldn't confirm from Microsoft's page: whether free or personal versions of Teams are covered. Treat them as not covered unless Microsoft says otherwise in writing.
What that means for a dental or medical office
If your practice already runs on a business Microsoft 365 subscription, Teams may be the easiest covered option for internal messaging. Confirm your plan is in scope, then lock down settings like guest access and retention with whoever manages your IT. Teams is still a desk-first tool; for quick chairside signals, many offices use something faster alongside it.
The rule that keeps most offices out of trouble
Whatever app your team uses for quick coordination, keep it to logistics. "Exam ready, room 3." "Need an assistant in 2." "Lab on line one for Dr. Lee." Signals like these tell the team what to do without saying anything about a patient. Names, dates of birth, diagnoses, and treatment details stay in your practice management or EHR software, which your office already covers with the right agreements.
Write the rule down where new hires will see it. The Signal Plan Builder puts it at the bottom of a printable one-page plan.
Where DOC fits
DOC is built for exactly that kind of logistics signal: an iPhone app with an Apple Watch companion where one tap sends "exam ready" or "need an assistant" to the right person. To be plain about it, DOC is not certified or audited for HIPAA compliance, and during the beta it is not approved for patient information. Beta offices use synthetic data only, and no Business Associate Agreement is in effect (Beta Terms).
Frequently asked questions
Does Microsoft sign a BAA for Teams?
Microsoft says its BAA is available by default through its online services data protection terms for covered entities and business associates, with Teams in scope for Office 365 commercial and GCC.
Is the free version of Teams HIPAA compliant?
We couldn't confirm that from Microsoft's page. Treat free and personal Teams as not covered unless Microsoft confirms otherwise.
Do we need to configure anything?
Yes. A BAA covers the service, but your office still has to use it appropriately: access controls, guest access, retention, and training.