Microsoft 365 settings that matter for HIPAA

Many small practices run email and files on Microsoft 365. Microsoft will sign a business associate agreement covering its in-scope services, but the BAA does not configure your tenant. Default settings leave real gaps, and those gaps are where most phishing-driven breaches start.

Start with these eight

1. Confirm the BAA. Know where Microsoft's HIPAA BAA applies to your subscription, and keep ePHI in covered services.
2. Require MFA for everyone. Security defaults or Conditional Access, with no exceptions for front-desk or shared accounts.
3. Block legacy authentication. Older protocols bypass MFA entirely.
4. Turn on audit logging. Make sure unified audit logging and mailbox auditing are on, so you can investigate an incident.
5. Encrypt email containing PHI. Set up message encryption and teach staff when to use it.
6. Restrict external sharing. Limit anonymous links in SharePoint and OneDrive.
7. Encrypt devices. BitLocker on Windows laptops, managed and verified where your plan allows.
8. Protect admin accounts. Separate admin accounts, strongest MFA, and as few global admins as possible.

Each of these maps to a Security Rule safeguard: access control, audit controls, integrity, person or entity authentication, and transmission security.