Skip to Content
AddonsTrust CenterFrameworksHIPAA Framework

HIPAA Framework

Assess and maintain HIPAA compliance for Microsoft 365 tenants handling protected health information (PHI). OpsPilot365 Trust Center maps M365 security configurations to HIPAA Security Rule requirements, tracks Business Associate Agreement (BAA) coverage, and monitors PHI protection controls.

Note: HIPAA compliance monitoring is part of the Trust Center add-on. It covers Administrative, Physical, and Technical safeguards from the HIPAA Security Rule, with automated assessments tailored for MSPs managing healthcare client tenants in Microsoft 365.

HIPAA Security Rule Overview

The HIPAA Security Rule establishes national standards for protecting electronic protected health information (ePHI). It requires covered entities and business associates to implement safeguards across three categories: Administrative Safeguards (24), Physical Safeguards (10), and Technical Safeguards (16).

Administrative Safeguards

HIPAA ReferenceRequirementM365 ImplementationStatus
164.308(a)(1)Security Management ProcessSecure Score, risk assessments, compliance policiesAuto
164.308(a)(3)Workforce SecurityUser provisioning/deprovisioning, access reviews, role assignmentsAuto
164.308(a)(4)Information Access ManagementRBAC, SharePoint permissions, sensitivity labelsAuto
164.308(a)(5)Security Awareness and TrainingAttack simulation training, compliance training assignmentsPartial
164.308(a)(6)Security Incident ProceduresAlert policies, Defender incidents, automated investigationAuto
164.308(a)(7)Contingency PlanBackup configurations, recovery procedures, data retentionPartial

Physical Safeguards

HIPAA ReferenceRequirementM365 ImplementationStatus
164.310(b)Workstation UseIntune compliance policies, device configuration profilesAuto
164.310(c)Workstation SecurityBitLocker encryption, screen lock policies, Defender for EndpointAuto
164.310(d)Device and Media ControlsRemote wipe, selective wipe, device retirement policiesAuto

Technical Safeguards

HIPAA ReferenceRequirementM365 ImplementationStatus
164.312(a)(1)Access ControlUnique user IDs, Conditional Access, emergency access accountsAuto
164.312(b)Audit ControlsUnified Audit Log, mailbox auditing, sign-in logsAuto
164.312(c)(1)Integrity ControlsDLP policies, versioning, change tracking, retention locksAuto
164.312(d)Person or Entity AuthenticationMFA enforcement, passwordless authentication, identity verificationAuto
164.312(e)(1)Transmission SecurityTLS enforcement, message encryption, S/MIME, transport rulesAuto

Business Associate Agreement (BAA) Tracking

Note: Microsoft offers a BAA as part of the Online Services Terms for eligible M365 services. OpsPilot365 validates which M365 services are covered under the Microsoft BAA and identifies any services in use that may fall outside BAA coverage, requiring additional review.

ServiceBAA StatusePHI Handling
Exchange OnlineCoveredEmail communications containing PHI
SharePoint OnlineCoveredDocument storage and collaboration with PHI
Microsoft TeamsCoveredChat, meetings, and file sharing with PHI
OneDrive for BusinessCoveredPersonal file storage containing PHI
Microsoft IntuneCoveredDevice management for ePHI-accessing devices
Third-party M365 AppsReview RequiredSeparate BAA may be needed per vendor

PHI Protection in Microsoft 365

  • Data Loss Prevention — HIPAA-specific DLP policy templates enabled, PHI sensitive information types configured, policy tips for end-user awareness, incident reports for DLP policy matches.
  • Encryption — Message encryption for PHI-containing emails, TLS enforcement on all mail flow connectors, BitLocker on managed endpoints via Intune, sensitivity labels with encryption for PHI documents.
  • Access Controls — MFA enforced for all users accessing PHI, Conditional Access restricting PHI access to compliant devices, session timeout policies for PHI-containing applications, automatic sign-out after inactivity periods.
  • Audit and Monitoring — Unified Audit Log enabled with extended retention, mailbox auditing for PHI-containing mailboxes, alert policies for unusual PHI access patterns, eDiscovery hold for breach investigation readiness.

Evidence Requirements

Evidence CategoryArtifacts CollectedHIPAA Reference
Access ManagementMFA status reports, CA policy exports, PIM assignments164.312(a), 164.312(d)
Audit LoggingAudit log configuration, retention settings, sample logs164.312(b)
EncryptionTLS settings, message encryption rules, BitLocker status164.312(a)(2)(iv), 164.312(e)
Data ProtectionDLP policies, sensitivity labels, retention policies164.312(c), 164.530(j)
Device ManagementIntune compliance reports, device encryption status164.310(b), 164.310(c)

Note: For healthcare clients, always verify that the Microsoft BAA is executed before enabling any M365 service for PHI processing. Use OpsPilot365 HIPAA DLP policy templates as a starting point and customize the PHI sensitive information types to match the specific data your client handles. Enable extended audit log retention (minimum 6 years as required by HIPAA) for all tenants handling ePHI.

API Reference

  • GET /api/addons/trust-center/frameworks/hipaa/status — Get HIPAA compliance status summary for a tenant
  • GET /api/addons/trust-center/frameworks/hipaa/safeguards — List safeguard requirements with assessment results
  • GET /api/addons/trust-center/frameworks/hipaa/baa-status — Get BAA coverage status for all M365 services in use
  • GET /api/addons/trust-center/frameworks/hipaa/phi-controls — Get status of PHI-specific protection controls
  • POST /api/addons/trust-center/frameworks/hipaa/scan — Trigger a HIPAA compliance assessment scan
  • GET /api/addons/trust-center/frameworks/hipaa/evidence — Export evidence package for HIPAA audit or OCR investigation
  • GET /api/addons/trust-center/frameworks/hipaa/risk-assessment — Generate HIPAA-specific risk assessment report
Last updated on
GDPR FrameworkISO 27001 Framework