Microsoft 365 for Healthcare

What default M365 doesn't give you automatically.

Microsoft offers HIPAA-compliant infrastructure — but the default tenant configuration is not compliant. The infrastructure meets HIPAA requirements when properly configured; the default setup does not. Practices routinely deploy M365 with consumer-grade defaults and assume compliance they don't have. Proper HIPAA-compliant M365 requires:

• Signed BAA with Microsoft. Business Associate Agreement must be executed through the Microsoft 365 admin center — it's not automatic even on business/enterprise licenses. Standard M365 Business Premium, Business Standard, E3, and E5 all support BAA execution; consumer plans (Personal, Family) do not.
• Email encryption at rest and in transit. Default Exchange Online provides encryption at rest by Microsoft's standards. Additional configuration for encrypted email to external recipients (Office 365 Message Encryption, S/MIME where appropriate), TLS enforcement, and mobile device message protection requires explicit setup.
• Data Loss Prevention (DLP) policies. DLP rules detecting PHI patterns (SSNs, medical record numbers, diagnosis codes in common formats) in email, SharePoint, OneDrive, and Teams. Without DLP, staff can accidentally share PHI via unsecured channels. Default DLP is off.
• Multi-factor authentication universal enforcement. MFA requirement on all users, including shared mailboxes and service accounts. Default MFA is optional; strong HIPAA posture makes it universally required with phishing-resistant methods where possible.
• Retention and deletion policies. HIPAA doesn't require specific retention periods, but state laws and practice policies do. Retention policies in Exchange, SharePoint, OneDrive, and Teams must align with practice policy — neither under-retained (losing required records) nor over-retained (holding data beyond necessary).
• Audit log configuration. Unified audit log enabled across services, with retention adequate for HIPAA audit defense (typically minimum 6 years for covered entities). Default audit retention is shorter than HIPAA requirements on some license tiers.
• Conditional access policies. Restricting M365 access to known devices, known locations, or specific conditions. Prevents credential-only-based access from unmanaged devices — a common attack vector when credentials are phished.

How medical practices actually use M365.

Exchange Online (email)

Practice email, calendar, contacts. With proper configuration, supports secure external communication, encrypted attachments for PHI sharing, shared mailboxes for billing/front desk/clinical teams, and mobile access with device-level protection. Advanced Threat Protection (Defender for Office 365) adds anti-phishing and malware sandboxing.

Teams

Clinical team collaboration, provider chat, internal calls, video meetings. Teams for Healthcare features include virtual visits (patient-facing video), secure messaging with PHI handling, and EHR integration (Teams-Epic and Teams-Cerner integrations exist). Configuration for healthcare includes disabling external sharing by default, enabling retention policies, and managing guest access tightly.

SharePoint & OneDrive

Document storage, internal collaboration, policy libraries, training materials. For practices: policies and procedures, workforce training records, meeting minutes, contract files. Healthcare-appropriate governance includes: default private SharePoint sites, external sharing restrictions, version history, and DLP rules on PHI-handling document libraries.

Intune (device management)

Mobile device management for practice-owned and BYOD devices accessing M365. Enforcing device encryption, remote wipe capability, app-level data protection, and conditional access based on device compliance. Essential for any practice where staff access practice email or PHI on mobile devices.

Defender for Office 365 / Defender for Endpoint

Microsoft's security stack — email protection, endpoint detection and response, identity protection. Included in E5 plans; available as add-on to lower tiers. Often the highest-leverage security investment for practices already on M365.