Microsoft says Copilot and Copilot Chat support HIPAA compliance for properly configured Microsoft 365 setups, with prompts and responses covered by the Data Protection Addendum and the Business Associate Agreement. Web search is the exception: the queries Copilot sends to Bing sit outside the BAA, so switch web search off for anyone handling patient data.
That one exception is why a simple yes or no fails. Copilot inside Word, Outlook or Teams, reading a patient letter that lives in your own SharePoint, is a very different thing from Copilot reaching out to the web mid-answer. The first stays inside the service boundary your BAA describes. The second sends a short query to a separate service run on different terms. Microsoft's own example shows how it happens: asked to summarise an internal strategy document and say whether a competitor had announced something similar, Copilot took a theme from the document and put it into the query it sent to Bing. The document stayed put; the theme travelled.
What is inside the Microsoft BAA, and what is not
Microsoft states that its HIPAA Business Associate Agreement is available through the Online Services Data Protection Addendum by default to customers who are covered entities or business associates. Its compliance page lists Microsoft Copilot and Microsoft Copilot Chat among the in-scope Office 365 commercial services. And a footnote on its enterprise data protection page says Copilot and Copilot Chat support HIPAA compliance for properly configured implementations, adding that this does not apply to web search queries, which are not covered by the DPA and BAA.
Putting those together gives the working table below. It reflects Microsoft Learn pages as they stood in November 2026, and it is a summary, not a legal opinion.
| Copilot feature or route | Under the BAA? | What to do for patient data |
|---|---|---|
| Prompts and responses in Microsoft Copilot (Word, Outlook, Teams, Excel) with a work account | Yes, when properly configured | Allowed once the checks below are done |
| Microsoft Copilot Chat with a work account | Yes, when properly configured | Same. Chat is web-grounded and works from your prompt, uploads and what is open in front of you; the paid licence adds mail, meetings and files through Microsoft Graph |
| Data pulled from Microsoft Graph (mail, files, meetings the user can access) | Yes, as part of the service | Only as safe as your permissions |
| Web search queries sent to Bing | No: the DPA, the BAA and HIPAA compliance do not apply to them | Switch off for staff who touch patient data |
| Researcher, Analyst and Cowork in Microsoft Copilot | Their web queries: no (same rules as above) | Disable web search for them, or keep patient data out |
| Third-party agents and connectors | Depends on the agent | Read the agent's own privacy terms; default to not covered |
| Personal Copilot app with a personal Microsoft account | No commercial terms apply | No patient data |
The row that surprises people is the web one. Staff are not typing into Bing. They ask a question in Copilot, and Copilot decides, by itself, that some of the words in the prompt would be improved by a web search.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowHow web search leaks a prompt into a different service
Microsoft explains the mechanism on its web search page. When web search is on, Copilot parses the prompt, picks out terms where web information would help, and generates a short search query that it sends to the Bing search service. The query is not the whole prompt (unless the prompt is very short), nor entire Microsoft 365 files or uploaded files, and Microsoft says identifiers from the user's Microsoft Entra ID, such as username, domain and tenant ID, are removed. But the query can still be informed by what the user asked or by content in an open document: Microsoft notes that when a user prompts Copilot inside an app with a relevant document open, or explicitly refers to a document, the generated query may be informed by data in that document. The user's client IP address is also sent to Bing.
Microsoft sets out the commitments it makes about those queries (they are not used to improve Bing, build advertising profiles or train foundation models), but it also says Bing operates separately from Microsoft 365, that the queries are subject to the Microsoft Services Agreement between each user and Microsoft, and that the DPA does not apply. Then the sentence that matters here: HIPAA compliance does not apply to generated search queries. Microsoft acts as an independent data controller for them, not as your processor.
An illustrative leak
Say a physiotherapy clinic manager has a patient letter open in Word and asks Copilot: "Does this plan for a 58-year-old with a torn rotator cuff and a pacemaker match current guidance on shoulder rehab?" Copilot may build a query such as "rotator cuff rehab pacemaker guidance". That string contains no name. It does contain a clinical combination, and it leaves the BAA's boundary. For a larger clinic, many such queries across a month say something about its patient mix. The risk is not dramatic, but it is exactly the kind of thing a covered entity should decide about on purpose, not by default.
The admin switch: Allow web search in Copilot
Microsoft gives administrators a policy for this. It is called "Allow web search in Copilot", and it is available in the Cloud Policy service for Microsoft 365. It applies to both Microsoft Copilot and Microsoft Copilot Chat and can be targeted at users or groups. If you enable the policy, you get three options:
- Enabled in Microsoft Copilot and Microsoft Copilot Chat.
- Disabled in Microsoft Copilot and Microsoft Copilot Chat.
- Disabled in Microsoft Copilot Work mode, but enabled in Web mode and Copilot Chat.
Two details matter. If the administrator does not configure the policy at all, web search is available by default, unless the "Allow the use of additional optional connected experiences in Office" policy is set to Disabled. And a user-side "Web content" toggle exists: if the admin disables web search, the toggle is dimmed and users cannot switch it on. So the safe default for a clinical group is to disable web search for it and leave it enabled for the marketing and admin staff who do not touch patient data. One trap: the users' own privacy setting for optional connected experiences inside Word, Excel or Teams has no effect on web search, so a member of staff who has switched that off has not switched web search off.
The third option deserves a look. It keeps web search available in a separate Web mode and in Copilot Chat, while switching it off in Work mode, where Copilot reasons over your organisation's data. Microsoft adds that this option also disables web search in Researcher and Cowork. That may suit a practice that wants staff to look things up on the open web without mixing it with patient files, but only if staff understand that Chat's web queries are still outside the BAA. For patient-facing groups, option two is simpler and safer.
Admins can also see what happened. Microsoft says web search query logging lets them search, audit and run eDiscovery on the exact queries Copilot derived from prompts, using the audit log and Microsoft Purview. Purview's Data Security Posture Management for AI also shows the search terms next to the original prompt and response. In Copilot Chat, users see the exact queries in the citation section of a response, where they stay in the chat thread for 24 hours; the Copilot pane inside Word or PowerPoint does not show them.
Rolling out Copilot in a nine-person medical practice
Say a practice has three clinicians, two nurses, three front-desk staff and a practice manager, all on Microsoft 365 Business Premium, with Copilot licences for the clinicians, nurses and manager and Copilot Chat for the front desk. The practice manager wants a rollout plan in a week. A sensible set of choices:
| Group | Copilot access | Web search | Reason |
|---|---|---|---|
| Clinicians (3) and nurses (2) | Licensed Copilot in Word, Outlook and Teams | Off | They handle patient letters and messages |
| Front desk (3) | Copilot Chat only | Off | They see patient names in the diary and inbox |
| Practice manager (1) | Licensed Copilot | Off in Work mode, on in Web mode and Chat (policy option three) | Needs web look-ups for policies and suppliers, kept apart from work data |
The plan creates two groups in the admin centre, applies "Allow web search in Copilot" to the clinical and front-desk group with "Disabled in Microsoft Copilot and Microsoft Copilot Chat", and gives the manager's group the Work-mode option. The manager also agrees never to paste patient details into Chat, because Chat's web search stays on under that option. It is a one-day job once the groups exist.
The licence sum is short. Microsoft lists Microsoft 365 Copilot Business at $21 a user a month on an annual commitment, with a first-year offer of $18 for purchases made between 1 July and 31 December 2026. Six licences (three clinicians, two nurses, the manager) cost $126 a month at list, $1,512 a year, or $108 a month in the offer year. The three front-desk seats add nothing, because Copilot Chat comes at no extra cost with eligible Microsoft 365 plans. Confirm the figures on Microsoft's page before budgeting, since offers change.
Oversharing: the risk Copilot makes worse
Microsoft says Copilot only surfaces organisational data to which a user has at least view permission. That sounds reassuring, but it means every over-generous share becomes searchable in seconds. A SharePoint folder opened to "everyone in the organisation" in 2022 for a quick handover, a shared mailbox that the whole front desk can read, or a Teams channel full of referral letters, all become findable by a question like "show me recent referrals for knee replacement".
Before rollout, walk through a short permissions review:
- List every SharePoint site, shared mailbox and Teams team that holds patient information, and who can open each.
- Remove "everyone" and broad group access from any of them; replace with named roles.
- Apply sensitivity labels to the folders that hold patient records, because Microsoft says Copilot honours usage rights set by labels and encryption.
- Check guests and external sharing links, and expire old ones.
- Re-run the review every quarter, as staff change roles.
This is the dull part, and it does more for compliance than any single Copilot setting. For a broader view of what a practice must have in place before any AI tool, see what a small practice needs first for AI.
Prompts that stay inside the boundary, and ones that do not
Staff benefit from one worked pair of prompts on the wall. These are illustrative.
Safe, inside the tenant, web search off:
"Using the open referral letter, write a short summary for the GP in three bullet points. Keep wording factual and do not add anything that is not in the letter."
Riskier, invites web search:
"Is this treatment plan consistent with the latest guidance? Search the web for current recommendations."The second prompt asks for web search by name, which is exactly the behaviour you have switched off for clinicians. With the policy in place, Copilot either declines or answers from what it has. Without it, the generated query goes to Bing. Teach staff to separate two activities: working on the document in front of them, and looking up published guidance, which can be done in a normal browser with no patient detail.
A before and after for the front desk
Before: a receptionist asks Copilot Chat "Draft a reply to Mrs Ortiz about her missed scan on Tuesday and check the hospital's cancellation rules online." After: "Draft a polite reply template for a patient who missed a scan, with [name] and [date] placeholders, and no clinical detail." The second version works with web search off, produces a template the receptionist can reuse, and leaves the name and the date to be added by hand in the practice system.
Checks the admin should run before the first patient letter
- Confirm in your agreement that the HIPAA BAA applies to your tenant, and save the document.
- Confirm Copilot and Copilot Chat are in the in-scope services list for your cloud environment (commercial, in most small practices).
- Apply "Allow web search in Copilot" to the groups that touch patient data.
- Review who can see what in SharePoint, OneDrive, Teams and shared mailboxes.
- Decide which agents and connectors are allowed, and read each one's terms; Microsoft's own advice is to check each agent's privacy statement.
- Decide whether third-party models, which Microsoft lets admins turn on or off, are in use, and note their terms. Microsoft states that models from Anthropic and OpenAI can act as subprocessors, and extra terms may apply.
- Set retention for Copilot interactions in Purview, and decide who can search them.
- Write the staff rules and brief the team.
Item 6 is easy to miss. If your tenant has third-party models enabled, the data-handling terms for those models are a further document to read. Do it once, record the decision, and revisit when Microsoft changes the list.
A dental practice, a billing firm and a solo counsellor
A dental practice with two surgeries. Mostly clinical notes and patient letters in a dedicated dental system, with Microsoft 365 for email and documents. Copilot on the admin side, web search on for the practice manager, off for everyone else, and no Copilot near the clinical system.
A billing company for several clinics. It is probably a business associate itself, so Copilot touching claims data needs the company's own BAA with Microsoft in place and its own agreements with each clinic. The permissions review is the heavy lift, because many clients' data sits in one tenant.
A solo counsellor on Microsoft 365 Business Basic. Copilot Chat comes at no extra cost with eligible Microsoft 365 plans, but session notes live elsewhere. The counsellor can use Copilot Chat for newsletters and policies with web search left on, and keep it away from anything that identifies a client. The AI secretary tutorial for doctors shows what routine letter work can look like with a covered tool.
What to say to patients and what to log
A practice that uses Copilot near patient information should be able to describe it in plain words if asked. A short paragraph for the privacy notice or a patient who enquires might read: "We use Microsoft 365 tools, including an AI assistant, to help our staff draft letters and summaries. These tools run inside our Microsoft 365 service under an agreement that covers patient information. Staff review everything before it is sent." Have your own adviser approve the final wording, because notice requirements differ between services and states.
On the logging side, keep three records in one folder. First, a dated note of which Copilot features are enabled for which groups, including the web search policy setting. Second, the BAA and the list of in-scope services you checked. Third, the permissions review with the date and the person who did it. If something goes wrong later, those three pages answer most of the questions anyone will ask.
A permissions review sum for a small tenant
To see how long the oversharing check takes, take a practice with 14 SharePoint sites, 5 shared mailboxes and 9 Teams teams. Sorting them into "holds patient information" and "does not" takes an hour with the manager and the person who set things up. Say 6 sites, 2 mailboxes and 3 teams are marked as patient-related. Reading the access list for each is 5 to 10 minutes: roughly two hours for 11 items. If four of them turn out to be open to everyone in the organisation, narrowing those is another hour. So a half-day clears the main risk in a practice that size. The figures are illustrative, but they make the point that the work is hours, not weeks.
Staff rules for Copilot, ready to paste
Copilot at [practice name]
- Use Copilot only with your work account, never a personal Microsoft account.
- Web search is switched off for clinical and front-desk staff. Do not ask Copilot to "search the web" or "check online" while working with anything from a patient file.
- Ask Copilot about the document in front of you. Do not paste patient information into any other app, website or chat.
- Copilot can show you things you already have access to. If it shows you a file you should not see, report it to [IT lead] at once.
- Always check the output. You are responsible for anything sent or filed.
- Do not enable new agents, plug-ins or connectors without the IT lead's approval.Note the fourth line. If Copilot surfaces something a user should not see, that is a permissions problem to fix, not a Copilot problem to work around. Treat the report as a gift.
Re-reading Microsoft's pages each quarter
Microsoft's Learn pages now call the work assistant "Microsoft Copilot", while its pricing page still says Microsoft 365 Copilot Business, so expect both names. Researcher, Analyst and Cowork follow the same web search rules, Microsoft says; Researcher has its own Web search toggle in the input box, while Analyst and Cowork have none for users, so only the admin policy controls them. New features arrive monthly. Put a recurring entry in the diary, every quarter, to re-read Microsoft's HIPAA offering page, the enterprise data protection page and the web search page, and note anything that has changed. If you want to see how Copilot's agent features differ for business use, the Copilot agents tutorial covers the product side. And if you would like someone to sit with your team and mark which features are in and out of bounds, that is the sort of job my AI implementation consultation handles.
None of this makes a practice compliant by itself. Microsoft's own page says a BAA does not ensure compliance and that your organisation must have an adequate compliance programme and processes. Treat the checks above as part of that programme, and have your legal adviser confirm the details for your service.
Questions medical practices ask about Copilot and the BAA
Do I have to sign a separate BAA to use Copilot?
Microsoft says its HIPAA BAA is available through the Online Services Data Protection Addendum by default to customers who are covered entities or business associates. Check that your agreement includes it and that Copilot is in the in-scope services list, then keep a copy on file.
Is the free Copilot app on my phone covered?
Not by the commercial terms described here. Those terms apply to Copilot and Copilot Chat used by organisations with a work account. The personal Copilot app signed in with a personal Microsoft account is a consumer service, so keep patient information out of it.
Does Copilot Chat count, or only the paid Copilot licence?
Microsoft's enterprise data protection page covers both Microsoft Copilot and Microsoft Copilot Chat as used by organisations, and its compliance page lists both as in scope. The paid licence adds reasoning across your emails, meetings and files. Confirm which experiences your staff actually use.
What stops Copilot showing a receptionist the wrong patient file?
Only your permissions. Copilot surfaces what a person already has at least view access to, so loose SharePoint or mailbox permissions become Copilot's problem too. Tidy sharing before rollout, then use sensitivity labels and access reviews to keep it that way.
Can staff use Researcher or agents on patient data?
Only if you have checked each one. Web search applies to Researcher and similar features, and Microsoft tells you to read the privacy statement of any agent you enable. Treat each new feature as out of scope for patient data until you have confirmed it is covered.
Further reads
- Is ChatGPT HIPAA Compliant? Free, Business and Clinician Plans — A plan-by-plan BAA check for ChatGPT.
- Is Claude HIPAA Compliant? Which Plans Offer a BAA — Which Claude plans can sign a BAA and which cannot.
- AI Usage Policy for a Medical Practice: Template and HIPAA Rules — A fuller AI usage policy for a medical practice.
- HIPAA-Compliant AI Receptionist: A BAA and Retention Checklist — BAA and retention checks for an AI front desk.
- HIPAA-Compliant AI Assistants for a Medical Office: BAA by Plan — Which plan of ChatGPT, Claude, Gemini and Copilot can carry a BAA for a small practice, what each excludes, and a tracker to record it.
- Is Gemini HIPAA Compliant? What a Workspace BAA Covers — The Workspace BAA covers the Gemini app and Gemini in Workspace apps, not Gemini in Chrome. Here is the scope and the admin step that comes first.
- Is There an AI Tool for Pharmacists? What US and UK Teams Can Use — Yes: ChatGPT for Clinicians for verified US pharmacists, general business-plan tools elsewhere. What to use them for and what to keep out.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: Microsoft Learn pages Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat; Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat; Microsoft Copilot privacy; HIPAA and HITECH Act offering; Microsoft 365 Copilot Business pricing page (all read 4 November 2026).