How do I start

Hi PATRICIA COLEMAN

HIPPA covered entities and business associates

HIPAA applies to covered entities – doctors’ offices, hospitals, health insurers, and other healthcare companies – that create, receive, maintain, transmit, or access PHI. HIPAA further applies to business associates of covered entities that perform certain functions or activities involving PHI as part of providing services to the covered entity or on behalf of the covered entity. When a covered entity engages the services of a cloud service provider (CSP), such as Microsoft, the CSP becomes a business associate under HIPAA.

Signing HIPPA BAA

There is no separate contract to sign to enter into a HIPAA BAA with Microsoft because the HIPAA BAA is available via the Microsoft Product Terms (formerly Online Services Terms) by default to all customers who are covered entities or business associates under HIPAA.

If you're a SaaS provider of a healthcare solution deployed on Azure, your customers who are healthcare providers or covered entities under HIPAA can sign a BAA directly with you.

They don't need to have a BAA in place with Microsoft to use your SaaS solution. The Microsoft BAA terms incorporated into your licensing agreement with Microsoft wouldn't be applicable to your customers unless they also happen to be Microsoft customers and have separate licensing agreements in place with Microsoft.

Microsoft HIPAA BAA is applicable to Microsoft Online Services such as Azure and made available by default to Microsoft customers via a licensing agreement execution that includes the Microsoft Product Terms (formerly Online Services Terms) and the Microsoft Products and Services Data Protection Addendum (DPA).

HIPPA document location

Here is the document location for HIPPA BAA.

HIPPA compliance

But you will need to initiate respective compliance policy and setup your specific resource accordingly to stay HIPPA compliant. Microsoft don't handle the compliance on your resources.

You can also manage compliance for all resource and generate compliance report Microsoft purview compliance centre.

Reference

Frequently Asked questions on HIPPA BAA

Data protection Addendum

Reference threaddetails of HIPPA-HITRUST

Hope it helps.

Thank you.