Is Teams HIPAA Compliant? Microsoft Teams for Therapists

Is Teams HIPAA compliant? Microsoft Teams can be used in a HIPAA-compliant way, but only the business version, and only once it's set up with care. Microsoft names Microsoft Teams among the in-scope services of its commercial cloud on its HIPAA and HITECH compliance page, and its Products and Services Data Protection Addendum makes the HIPAA Business Associate Agreement (BAA) part of a business customer's agreement. Teams for personal use, the version you sign in to with a personal Microsoft account, is a consumer service under the Microsoft Services Agreement, and Microsoft's BAA isn't part of it. Even with the right account, Microsoft is direct that the BAA is not the finish line: "using Microsoft services doesn't on its own achieve HIPAA compliance."

This guide answers from Microsoft's own pages, which we read on October 25, 2026, and gives the date of each one. You'll find how the BAA reaches you, which plans include Teams, why personal Teams is different, the Teams settings that matter in a therapy session, what HIPAA still asks of you, and a checklist with a setup record you can copy into your compliance file.

It is general information, not legal advice. Where the answer turns on your state, your billing or your exact Microsoft subscription, the article says so; those are the points to take to a healthcare attorney.

The short answer, by account

Which Teams you sign in to decides most of the answer.

What Microsoft's documentation says about Teams and HIPAA

Teams is on Microsoft's in-scope list

Microsoft's page on HIPAA and the HITECH Act (last updated July 29, 2025) lists the Office 365 services in scope for its commercial cloud. Teams is there, along with the other pieces a small practice is likely to touch:

Two details are worth noticing. The list names services, not plans. And Microsoft Bookings isn't named on it, even though Microsoft's getting-started page for healthcare organizations suggests Bookings for appointments when you don't use a supported EHR. If you'd let clients book through Bookings, ask Microsoft whether it's covered before client names go into it.

The BAA comes with your agreement

Microsoft doesn't send a separate BAA to sign. Its Data Protection Addendum (the DPA; the English edition we read is dated May 22, 2026) says that if you are a covered entity or business associate and include protected health information in your data, "execution of Customer's agreement includes execution of the HIPAA Business Associate Agreement." The FAQ on Microsoft's HIPAA page says the same: the BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."

Three practical points follow:

What the BAA doesn't reach

Compliance stays your job

Microsoft's FAQ asks whether having a BAA ensures your compliance and answers "No." It goes on: "Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with your obligations under HIPAA and the HITECH Act." The same page points out that there is no HHS certification standard for HIPAA compliance, so a "HIPAA certified" badge on any video tool means less than it sounds.

Teams for personal use vs business Teams

Microsoft now calls the consumer version "Microsoft Teams for personal use." Its support page on the two versions describes personal Teams as "chatting, calling, and meeting with your contacts to manage personal projects using your personal Microsoft account," and Teams (work or school) as "connecting and collaborating with coworkers, classmates, or others in your organization using a work or school account."

The difference that matters for HIPAA is the agreement underneath. The Microsoft Services Agreement (published July 30, 2026) "governs your use of Microsoft consumer online products and services," and Microsoft Teams is in its list of services. The DPA, where the BAA lives, belongs to Microsoft's business agreements. A personal account has no business agreement and no Microsoft 365 admin center, so there is no BAA to have.

Three things catch therapists here:

If you've already used personal Teams with clients, move client sessions to a business account with the BAA in place or to a platform that signs a BAA with you, stop using the personal account for anything about clients, and ask a healthcare attorney whether what already went through it needs a breach assessment.

Which Microsoft 365 plans include Teams

Microsoft's business plans page (checked October 25, 2026) offers Microsoft 365 Business Basic, Business Standard and Business Premium in versions with Teams and without it. Teams chat, calls, meetings and recording are marked "Included in the version with Teams." Business plans also come with the admin center, which Microsoft lists among the benefits you don't get with Microsoft 365 Personal and Family.

Some features that matter in a therapy practice depend on the plan or on add-ons:

Before you rely on a plan, open the Microsoft 365 admin center and note the exact name of your subscription. If it's Teams Essentials, a plan bought through a reseller, or anything you're unsure of, ask Microsoft support to confirm that the BAA covers it, and keep the answer with your records.

What HIPAA asks of you, whatever the tool

First, are you a covered entity?

HIPAA applies to health care providers "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as billing health insurance electronically (HHS, Covered Entities and Business Associates). A therapist who sees only private-pay clients, with nobody billing insurance for them, may not be a covered entity. State privacy law, your licensing board and your professional code still apply, and many therapists follow HIPAA either way. Our guide to who HIPAA applies to walks through the edge cases.

A BAA with the video vendor

HHS's telehealth site puts it plainly: covered providers "must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (Telehealth.HHS.gov). With business Teams, the DPA takes care of the agreement. With personal Teams, there isn't one.

Safeguards and a risk analysis

The Security Rule asks for "reasonable and appropriate administrative, physical, and technical safeguards" (HHS, Summary of the HIPAA Security Rule). HHS calls a risk analysis "the first step in identifying and implementing safeguards" (Guidance on Risk Analysis), and HHS and ONC publish a Security Risk Assessment Tool built for small practices. For a Teams setup, the analysis is where you decide things like whether to record, whether you need end-to-end encryption, and who else can sign in to your account.

The COVID-era flexibility ended in 2023

In 2020, HHS's Office for Civil Rights said it would not penalize providers for good-faith telehealth over "non-public facing" apps during the public health emergency, even without a BAA (Notification of Enforcement Discretion for Telehealth). The same notice listed "Skype for Business / Microsoft Teams" among vendors that said they offer HIPAA-compliant video and will sign a BAA, while noting that "OCR has not reviewed the BAAs offered by these vendors."

That notice expired at 11:59 pm on May 11, 2023. OCR allowed a 90-day transition that ended at 11:59 p.m. on August 9, 2023 (HHS, HIPAA and Telehealth). Since then, a session on any Teams account falls under the ordinary HIPAA Rules. If you started seeing clients on personal Teams in 2020, this is the change that made it a problem.

Teams settings that matter in a therapy session

You manage most of these in the Teams admin center under Meetings, then Meeting policies. On a small practice account you are usually the admin. The meeting organizer can also change several of them for a single meeting from the meeting's Options. None of this is a flaw in Teams. Its defaults suit an office of colleagues more than a private session with one client.

The lobby

Microsoft's admin page on lobby options (last updated June 30, 2025) explains that the lobby holds people until an organizer, co-organizer or presenter admits them. For sessions, set Who can bypass the lobby to Only organizers and co-organizers. Microsoft's lobby guide for users describes it simply: "Everyone else will wait in the lobby." At the other end, Everyone lets anyone with the link straight in.

Two related settings: leave Anonymous users and dial-in callers can start a meeting off (Microsoft recommends leaving it off, and it's off by default), and keep People dialing in can bypass the lobby off. Leave Anonymous users can join a meeting on unless every client has a Microsoft work account: it's how clients without one get in, and the lobby does the screening. A client who joins from a browser without signing in can show up as Unverified, which is normal. You see the name and admit only the person you expect.

One meeting per client, a neutral title, no forwarding

Create a separate meeting for each client, or a separate recurring series for each client, rather than one standing link for everyone. Use a neutral title such as "Session": the meeting invite goes to the client's inbox and sits in your Outlook calendar, so keep reasons for visit and diagnoses out of it. Microsoft's lobby guide also notes you can turn off Allow Forwarding in the invitation if you don't want it passed on.

Meeting chat

Microsoft's page on chat in sensitive meetings says: "By default, all meeting attendees can chat both during and after a meeting." The organizer can turn meeting chat off or allow it only while the meeting is in progress. People who join anonymously only have chat access while they're in the meeting. Either way, chat is not where clinical content belongs.

Transcription and Copilot

In new meeting policies, transcription is "On by default" (Microsoft, transcription and captions, last updated July 9, 2026). Turn it off unless you've decided otherwise. If your plan includes Copilot, Microsoft's Copilot meeting settings let the organizer set Copilot to Off for a meeting, and that choice "disables recording and transcription for the meeting." Whether to use generated meeting notes in therapy is a question of consent, clinical judgment and state law, not of settings. A generated summary is not the progress note you write and sign.

Recording

If you allow recording at all, know where the file goes. Microsoft's recording storage page (last updated September 23, 2026) says the recording saves to the organizer's OneDrive, and "all meeting invitees, except for external participants, automatically get a personally shared link." Your client, outside your organization, doesn't get the file unless you share it. A colleague or assistant inside your organization who was invited does.

Recordings and transcripts also expire: by default they move to the recycle bin after 120 days (Microsoft, recording expiration). Recording is optional. If you do record, get written consent, check your state's recording consent law, and decide in advance how long the file is kept and where.

Guests and external access

Guest access gives people outside your organization access to "teams, documents in channels, resources, chats, and applications" (guest access). A client doesn't need any of that to attend a session: a meeting link and the lobby are enough. Don't add clients as guests to a team, where they could see files and other people's names.

External access is a different switch. It controls whether people in other organizations, and people on personal Teams, can find you, chat and call. Microsoft's external access page (last updated November 19, 2025) says allowing all external domains is "the default setting in Teams," and you can separately allow or block chat with "unmanaged Teams accounts" such as personal Teams. Decide on purpose whether clients can message you in Teams at all.

Chat retention

Without a retention policy, Teams chats stay until someone deletes them. Microsoft Purview retention policies can keep chats or delete them after a set period (retention for Teams, last updated June 3, 2026). A Teams chat is not your clinical record. If a client message matters clinically, put what matters in the session note, and let your state's record retention rules govern the record itself.

Sign-in and encryption

Microsoft's security defaults include "requiring all users to register for multifactor authentication." Keep them on, give anyone who helps you their own account, and never share a login.

Teams encrypts data "in transit and at rest" by default (Encryption in Microsoft Teams, last updated August 28, 2026). End-to-end encryption is an extra layer with trade-offs. Microsoft's end-to-end encryption page (last updated October 6, 2026) says meetings need a Teams Premium license for the organizer; recording, transcription and live captions don't work in them; and web clients aren't supported, so a client joining from a browser is blocked. Microsoft's encryption page also notes that end-to-end encryption doesn't cover chat, and that HIPAA treats encryption as an "addressable" specification. Your risk analysis decides what is reasonable for your practice.

A Microsoft Teams checklist for therapists

Work through this once when you set up, then again when your plan changes or you add an app.

A setup record you can copy

Paste this into your compliance file and fill it in. One field per line, so it reads on a phone.

How video sessions work in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. If you'd rather not run a Microsoft 365 setup just for sessions, here is how the same jobs are handled.

The sessions section of practice.tranqbay.health shows what a video session and its notes look like. One more point: TranqBay's BAA covers TranqBay. If you keep using Outlook or Teams for anything about clients, keep Microsoft's BAA and the settings above in place for those too.

If you are weighing other video tools, we answer the same question for Zoom and FaceTime, and compare the main options in our guide to HIPAA compliant telehealth platforms.

Frequently asked questions about Microsoft Teams and HIPAA

Before your next session

Check which Teams account you're in, confirm your subscription includes Teams, save a copy of Microsoft's BAA, set the lobby to Only organizers and co-organizers, turn off transcription and chat after the meeting, and fill in the setup record above. Most of the risk with Teams sits in those defaults and in the meeting invite, not in the video call itself. For the same checks on Google's tools, see our guides to Google Meet and Gmail, and our comparison of HIPAA compliant telehealth platforms.

If you'd like booking, video sessions and notes connected without meeting links or lobby settings to manage, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources