Is Microsoft Copilot HIPAA Compliant? Microsoft 365 Copilot vs Free Copilot

Short answer: Microsoft 365 Copilot can be, the free Copilot cannot. Microsoft includes a BAA for its business cloud services, and Microsoft 365 Copilot running inside your organization's tenant can fall under it. The free Copilot app, Copilot Pro, and anything signed in with a personal Microsoft account are outside that BAA and should never see PHI.

Which Copilot is which

• Copilot (free) and Copilot Pro: consumer products tied to a personal account. No BAA.
• Microsoft 365 Copilot (business license, your tenant): can be covered by Microsoft's BAA because it runs on HIPAA-eligible Microsoft 365 services. Confirm with your Microsoft account team or the Microsoft Trust Center that your exact setup is in scope.
• GitHub Copilot: a coding tool. It is not meant for patient data at all.

What HIPAA actually requires

Under HIPAA, a medical practice can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to protect PHI, report breaches, and accept HIPAA obligations. Two details trip practices up: the BAA has to cover the exact product and plan you use, and it does not make you compliant by itself. You still need the right settings, access controls, and staff habits.

The risk nobody mentions: oversharing

Microsoft 365 Copilot can see everything the signed-in user can see. If your SharePoint or OneDrive permissions are loose (and in most small practices they are), a staff member can ask Copilot a harmless question and get back a summary that includes patient files they were never supposed to open. Before turning Copilot on, clean up who can access which folders. HIPAA's "minimum necessary" rule still applies.

Copilot helps with documents. Your patients need a front desk.

Copilot is excellent at Word, Excel, Outlook, and Teams. It does not pick up the phone, text the patient back in under a minute, book into your EHR, or run insurance eligibility. Those are the jobs that cost practices the most staff hours.

What PhiClaw does differently

PhiClaw is a HIPAA AI employee for medical practices. It signs a BAA with every practice on every plan, before any patient data moves. It answers patients on the phone, WhatsApp, iMessage, the web, and its iOS and Android apps, books and reschedules visits in your EHR, runs intake, scribes the SOAP note, handles e-prescribing (including controlled substances), billing, fax, and even your website and social posts. It works with 30+ major EHRs directly and 300+ more through Keragon, or ships its own HIPAA EHR and CRM.

PhiClaw is priced at $1,500 a month flat (4,320 questions/tasks included, unlimited users and locations, month-to-month), with a BAA on every plan. Many practices keep Microsoft 365 for email and documents and let PhiClaw run the patient-facing work.

Frequently asked questions

Is Copilot Pro HIPAA compliant?

No. Copilot Pro and the free Copilot are consumer products on personal accounts, with no BAA. Do not enter PHI.

Does Microsoft sign a BAA for Microsoft 365 Copilot?

Microsoft offers a BAA for its business cloud services, and Microsoft 365 Copilot running in your tenant can be covered. Confirm the scope for your exact license with Microsoft before using it with PHI.

What is the biggest HIPAA risk with Microsoft 365 Copilot?

Oversharing. Copilot can surface any file the user has permission to see, so loose SharePoint and OneDrive permissions can expose PHI to the wrong staff member.

Can Copilot answer patient calls or texts?

No. Copilot works inside Microsoft apps for your staff. It does not answer patients, book appointments in your EHR, or handle intake.

Do I have to drop Microsoft 365 to use PhiClaw?

No. Many practices keep Microsoft 365 for email and documents while PhiClaw handles calls, messages, scheduling, scribing, prescribing, and billing under its own BAA.