Is OneDrive HIPAA Compliant? BAA Coverage and Required Settings

OneDrive is where PHI ends up whether you planned it or not. Every Word document a clinician saves, every desktop folder synced through Known Folder Move, every “can you look at this?” attachment shared from a phone – it all lands in the same cloud storage. So the question “is OneDrive HIPAA compliant” usually arrives after the fact, from someone who just realized how much patient data is already sitting there.

Here’s the answer up front. OneDrive for Business – the version bundled with commercial Microsoft 365 plans – is listed in Microsoft’s Business Associate Agreement (BAA) scope, so it can support HIPAA compliance. Personal OneDrive, the free or consumer version tied to a personal Microsoft account, is not covered and never will be under those terms. And as with every Microsoft service, being in BAA scope is a starting condition, not a result. Compliance depends on how your tenant handles sharing links, DLP, retention, auditing, and device access. That configuration work is yours.

Covered by the BAA, but only the business version

Microsoft’s HIPAA position is contractual. There’s no certified-compliant product – the Department of Health and Human Services approves no certification standard for HIPAA at all, as Microsoft’s HIPAA documentation notes. What Microsoft does is enter into a Business Associate Agreement with covered entities and business associates, folded into the Data Protection Addendum that commercial customers accept. OneDrive for Business is named in the Office 365 in-scope services list that BAA covers.

That makes the contractual side straightforward for most organizations: if you’re on a commercial Microsoft 365 plan and you’re a covered entity, the BAA is available to you by default. We walked through how that agreement works across the whole suite in our Office 365 HIPAA guide. What’s left is the part no contract can do for you – configuring the tenant so PHI in OneDrive is actually protected the way the HIPAA Security Rule expects.

Personal OneDrive vs OneDrive for Business

Two products, one name, very different legal standing. Personal OneDrive – the storage attached to a personal Microsoft account, including Microsoft 365 Personal and Family plans – runs under the consumer Microsoft Services Agreement. It has no BAA, no tenant admin, no DLP, no audit log your compliance officer can query. It does not appear in Microsoft’s HIPAA in-scope services list.

The dangerous part is how easily the two blur on a device. Windows will happily sign into both a work and a personal OneDrive side by side, and the folders look identical in File Explorer. A tired clinician saving a patient report into the wrong OneDrive isn’t being malicious. They’re being human. Which is why the device controls later in this post matter as much as the tenant settings.

Encryption is the solved problem

If you’re evaluating OneDrive against the Security Rule’s encryption expectations, Microsoft’s side of the ledger is in good shape. Per Microsoft’s encryption documentation, OneDrive content at rest gets BitLocker disk-level encryption plus per-file encryption, where each file – and each update to each file – has its own AES 256-bit key, FIPS 140-2 compliant, with keys stored physically separate from content. In transit, client connections run over TLS.

So encryption is not where OneDrive HIPAA projects fail. We’ve never walked into an assessment and found Microsoft’s storage encryption to be the gap. The gaps are always in what happens above the encryption: who can create a link, where files sync to, and whether anyone is watching the logs.

The sharing problem: anyone links and external defaults

OneDrive’s whole reason to exist is sharing, and its sharing model is where PHI leaks. The worst offender is the Anyone link. Microsoft’s own sharing documentation describes it plainly: people using an Anyone link don’t have to authenticate, and their access can’t be audited. The link is a transferable secret key. Whoever holds it, has the file – forward it, post it, paste it into a group chat, it still works.

For a covered entity, that combination is disqualifying. You cannot demonstrate who accessed PHI through a link that records no identity. Anyone links have no place in a healthcare tenant, and turning them off is a two-minute change in the SharePoint admin center’s external sharing settings. While you’re there, set the default link type to “specific people” – leaving it at “people in your organization” quietly turns every casual share into org-wide access, which is how oversharing accumulates one casual share at a time.

Key point: An Anyone link on a file containing PHI is an unauthenticated, unauditable disclosure channel. If a breach investigation asks “who accessed this record,” your honest answer is “we have no way to know.” That sentence should never be true in a HIPAA environment.

OneDrive is SharePoint storage under the hood

One architectural fact simplifies all of this: OneDrive for Business is SharePoint. Each user’s OneDrive is a personal SharePoint site, running on the same storage platform, governed by the same admin center, covered by the same Purview tooling. That’s good news, because it means everything we documented in our SharePoint HIPAA guide – permissions, sharing governance, site-level controls – applies to OneDrive directly. It also means the reverse: a tenant that locked down SharePoint but left OneDrive sharing defaults untouched has a hole exactly the size of every user’s personal file store. The two are one compliance surface. Treat them as one project.

DLP, sensitivity labels, and retention

Three Purview capabilities turn OneDrive from “storage that happens to hold PHI” into something you can defend in an audit.

Data loss prevention

Purview DLP policies scan content in OneDrive against sensitive information types – medical record numbers, health conditions, insurance identifiers – and act on matches: block the external share, warn the user, notify compliance. This is your technical control against the well-meaning employee who tries to email a patient list to a partner clinic. Without DLP, your safeguard for that scenario is hope.

Sensitivity labels

Enable sensitivity labels for Office files in SharePoint and OneDrive so labeled and encrypted files keep their protection inside the service – searchable, co-authorable, but still access-controlled by the label’s encryption wherever the file travels. A “Patient Data” label that applies encryption protects the file even after someone downloads it, which is precisely the scenario sharing controls can’t reach.

Retention

HIPAA expects records kept for defined periods, and state law usually extends them. Purview retention policies applied to OneDrive keep deleted files recoverable for the retention window and stop a departing employee’s OneDrive from taking six years of records with it. Pair retention with a process for departed-user OneDrives; by default that content has a shelf life, and finding out during litigation is the expensive way to learn it.

Audit logging: who touched which file, when

OneDrive file operations – views, downloads, shares, deletions, sync events – flow into the Microsoft 365 unified audit log, with specific logged activities for file and sharing operations. This is your HIPAA Security Rule audit-controls story for OneDrive, and it mostly runs itself once auditing is confirmed on. Two things still go wrong in practice: nobody ever reviews the log until there’s an incident, and retention of audit records doesn’t match the organization’s documented policy. Decide who looks at OneDrive sharing reports, on what schedule, and write it down. An audit log nobody reads satisfies the letter of the control and none of its purpose.

The personal-device problem

The scenario that should worry you most isn’t in the tenant at all. A clinician installs OneDrive on a home laptop, signs in with work credentials, and syncs their whole document library – PHI included – onto an unencrypted family PC that the kids also use. Every tenant-side control you configured still applies to the cloud copy. The local copy is just files on a disk you don’t manage.

Microsoft gives you three tools to close this, in rising order of strictness:

Unmanaged device controls let you block OneDrive access entirely from devices that aren’t Intune-compliant or hybrid-joined, or degrade them to browser-only access with no download, print, or sync. Sync restrictions limit the OneDrive sync client to devices joined to your domains. And on mobile, Intune app protection policies wrap the OneDrive app itself: PIN required, corporate data encrypted on the device, no copy-paste into personal apps, selective wipe when someone leaves. All of it rides on the identity layer, so if you haven’t built conditional access policies yet, start with our conditional access guide – it’s the enforcement point everything above plugs into.

Required tenant configuration for PHI in OneDrive

The settings that separate “in BAA scope” from “defensibly configured”:

Where OneDrive fits in your Microsoft 365 HIPAA posture

OneDrive doesn’t get its own compliance program. It shares one with SharePoint, because it is SharePoint, and it depends on the same tenant foundations as Teams and Exchange – the BAA, identity controls, Purview policies, device management. Configure those once, apply them everywhere PHI lives, and OneDrive stops being a special worry.

If you want a straight answer on where your tenant actually stands – which links exist, what syncs where, whether the audit trail would hold up – our Microsoft 365 security assessment checks OneDrive and SharePoint against exactly this list and hands you the findings, ranked by how much they’d hurt in a breach investigation.

Frequently Asked Questions

Patrick Sandu

Patrick Sandu is a Microsoft-certified security engineer specializing in Microsoft 365 and Azure security for SMBs. He leads security assessments and managed detection services at Falconer Security.

Learn more about our team