Is Copilot Studio HIPAA Compliant? The BAA and Agent Route Review

Microsoft gives a direct answer for the service itself. Its Copilot Studio documentation says the product is covered under Microsoft's HIPAA Business Associate Agreement and can handle protected health information. A healthcare deployment still has to prove that its agreement applies to every connected service and that the agent operates with the safeguards HIPAA requires.

TL;DR

• Microsoft states that Copilot Studio is covered under its HIPAA BAA.
• Microsoft's BAA is available through the Online Services Data Protection Addendum for covered entities and business associates using in-scope services.
• The BAA covers Microsoft's service obligations. Your organization still owns access and configuration; connectors and disclosures; risk analysis; and operating evidence.
• Copilot Studio is excluded from medical-device use in Microsoft's documentation.
• Native Copilot Studio traffic does not automatically pass through DeepInspect. The gateway applies only to authenticated HTTP model traffic deliberately routed through it.

Microsoft's public BAA path covers Copilot Studio

The current Copilot Studio compliance page calls Copilot Studio an Online Service and states that it is covered under Microsoft's HIPAA BAA. Microsoft gives two examples: an agent can ask for health information such as blood pressure or weight, and it can capture health information alongside identifiers such as an IP address or email address.

That product-specific statement supplies the evidence missing from many vendor HIPAA pages. It names the service and the agreement, including PHI handling. Microsoft's broader HIPAA and HITECH offering page explains the contract route. The HIPAA BAA is available through the Microsoft Online Services Data Protection Addendum by default to customers that are covered entities or business associates and use in-scope Microsoft services.

I would still put the applicable DPA and order documents in the procurement file. A web page establishes Microsoft's public position. The executed terms establish what your organization bought.

Coverage stops at the edge of the in-scope service

A Copilot Studio agent rarely operates alone. It can accept a user's message, retrieve knowledge, call a Power Platform connector, invoke an action, send data to another endpoint, and return an answer. Each hop needs its own service owner and contract status.

The clean review artifact is a route register. For every path that can carry PHI, record four groups: the Copilot Studio environment and channel; the knowledge source and destination, plus every connector and action; the identity method and retention location; and the applicable agreement. Attach the Microsoft DPA version reviewed by counsel. If an agent calls a third-party scheduling service or custom API, plus an external model or analytics tool, Microsoft's statement about Copilot Studio cannot establish that supplier's BAA coverage.

Our AI vendor risk guide for health payers uses the same route-based test. The contract should follow the data path rather than the product name on the agent canvas. A blue connector tile can represent another processor with its own retention policy and disclosure.

HIPAA still assigns safeguards to the customer

The BAA defines permitted uses and disclosures plus the business associate's duties. It does not operate the covered entity's compliance program. Microsoft's HIPAA page says the same thing directly: use of Microsoft services alone does not achieve compliance, and the customer remains responsible for its program and internal processes for its particular use.

The legal split is visible in the regulation. 45 CFR 164.504(e) requires the contract to establish permitted uses and disclosures and obligates the business associate to apply safeguards; report improper uses; address subcontractors; and return or destroy PHI where feasible. 45 CFR 164.308 assigns administrative safeguards that include risk analysis and risk management; workforce authorization; security incidents and contingency planning; and periodic evaluation.

For Copilot Studio, those duties become configuration and operating decisions. Limit who can create or publish agents. Restrict approved connectors and knowledge sources. Separate development data from production PHI. Review authentication for every channel. Test incident handling and preserve the result.

An agent needs evidence beyond a signed agreement

A defensible deployment file should let an auditor reconstruct one allowed interaction and one denied interaction. Start with four groups of evidence: the authenticated user, active agent version, environment, and channel; prompt classification and knowledge sources consulted; the invoked connector or action and its destination, plus response treatment; and final outcome.

Microsoft's BAA coverage cannot fill evidence that the application never recorded. Copilot Studio and the connected Power Platform services each expose their own administrative and audit surfaces, so the evidence plan has to identify which record answers each question. Our Microsoft 365 Copilot audit log review shows why a product event name needs field-level testing before a team treats it as a complete decision record.

Run the test with synthetic PHI. Put a visible marker such as TEST-PHI-042 in a controlled prompt, then follow it through retrieval, actions, logs, exports, and deletion. The marker should appear only where the approved design says it will. A screenshot of a successful chat proves almost nothing about the route.

Medical-device use remains excluded

Microsoft's Copilot Studio page adds a specific limit: the service is not intended for use as a medical device. Keep that sentence attached to the HIPAA coverage statement. A BAA addresses PHI handling duties between parties. It does not grant a product a medical-device authorization. It also does not establish clinical safety for diagnosis or treatment, including monitoring.

Classify the use case before launch. An administrative agent that helps a member find a benefit document creates a different risk file than an agent that recommends a dose or interprets a diagnostic result. The second route needs regulatory, clinical-safety, validation, and human-oversight owners outside the HIPAA contract review.

Our broader AI and HIPAA compliance guide covers the Security Rule controls around any system touching PHI. Apply those controls to the intended use, minimum-necessary design, user access, disclosure rules, and clinical boundary.

DeepInspect

DeepInspect can enforce identity-bound policy on authenticated user or agent traffic sent to an LLM over a deliberately routed HTTP path. It can inspect prompt and response content and permit or block the request. It can also produce a per-decision audit record. Native Copilot Studio service traffic sits outside that path unless the deployment explicitly routes a supported model call through the gateway.

Use DeepInspect for the HTTP routes you control. Keep Copilot Studio administration, Microsoft contract coverage, connector governance, medical-device analysis, and downstream supplier BAAs with their assigned owners.

Book a technical deep dive at deepinspect.ai.