Is OneDrive HIPAA Compliant? Personal vs. Business Accounts Explained

The short answer is that it depends entirely on which OneDrive product you are asking about.

OneDrive personal — the free storage account tied to a Microsoft personal account — is not HIPAA compliant. Microsoft offers no Business Associate Agreement for personal accounts. Full stop.

OneDrive for Business, which is included with Microsoft 365 business subscriptions, can be HIPAA compliant. Microsoft covers it under the Online Services Data Protection Addendum, which functions as the HIPAA BAA for Microsoft 365. But “can be” requires action from your organization — accepting that DPA and configuring the right access controls.

The Two Products Are Completely Different

The confusion is understandable. Both are called “OneDrive,” both sync files to the cloud, and the interface looks similar. But they operate under different legal terms.

OneDrive personal is a consumer product. It is governed by the Microsoft Services Agreement, which does not include HIPAA coverage. Microsoft has been clear that it does not sign BAAs for consumer services.

OneDrive for Business is an enterprise product governed by the Microsoft Online Services Terms. Microsoft’s HIPAA Business Associate Agreement — the Online Services Data Protection Addendum — applies to this product when the organization accepts it. OneDrive for Business is explicitly listed as a covered service.

How the Microsoft HIPAA BAA Works

Microsoft does not send you a separate document called “HIPAA BAA.” Instead, HIPAA coverage flows through the Online Services Data Protection Addendum (DPA), which is incorporated into your Microsoft 365 subscription agreement.

To make the BAA effective for your organization:

1. Your organization must be on a qualifying Microsoft 365 plan. Business Basic, Business Standard, Business Premium, and enterprise plans all qualify. Free or personal plans do not.

2. A Microsoft 365 global administrator must accept the DPA in the Microsoft 365 Admin Center. The path is typically: Admin Center > Settings > Org settings > Security & privacy > Customer lockbox or compliance-related settings. Microsoft updates the exact location periodically — search the Admin Center for “Data Protection Addendum” if the path has changed.

3. Once accepted, OneDrive for Business, SharePoint Online, Exchange Online, and other covered services are operating under the BAA.

Microsoft publishes a list of covered services under the DPA. Verify OneDrive for Business appears on that list for your plan before storing PHI.

What the BAA Does Not Cover

The BAA is the legal foundation, not the complete compliance program. The Security Rule still requires your organization to implement:

Access controls. Only authorized workforce members should be able to access PHI in OneDrive for Business. Implement Azure Active Directory conditional access policies to enforce this. Restrict external sharing settings in the SharePoint/OneDrive admin center so files cannot be shared publicly or with unauthorized external parties.

Audit logging. Microsoft Purview (formerly Microsoft Compliance Center) provides unified audit logging for OneDrive for Business activity — who accessed files, who shared them, and when. Enable this and ensure logs are retained for the required period (minimum six years for HIPAA compliance documentation).

Data loss prevention (DLP). Configure Microsoft Purview DLP policies to detect and block sharing of files containing PHI outside the organization. DLP policies can identify patterns like Social Security numbers, medical record numbers, and clinical terms, and prevent accidental or intentional exfiltration.

Encryption. Microsoft encrypts OneDrive for Business data at rest and in transit by default. You do not need to configure this separately, but you should document it as part of your Security Rule risk analysis.

The Personal Account Risk

The most common compliance failure is employees using personal OneDrive accounts to store work files.

An employee who receives a patient document by email and saves it to their personal OneDrive — even on a work laptop — has stored PHI outside any BAA. The organization’s Microsoft 365 BAA does not extend to personal accounts. This is a violation regardless of the employee’s intent.

Mitigations: configure Microsoft Endpoint Manager (Intune) or another MDM solution to block personal cloud storage accounts on managed devices. Use known folder move (KFM) to automatically route desktop, documents, and pictures folders to OneDrive for Business rather than personal sync clients. Train staff that personal cloud storage and work files do not mix.

OneDrive for Business vs. SharePoint

Both are covered under the Microsoft DPA, and both can store PHI under the same BAA. The practical distinction: OneDrive for Business is per-user storage (each staff member’s files). SharePoint Online is shared team and organizational storage (shared drives, project libraries, intranet sites).

Organizations using both operate under the same BAA. There is no need to negotiate separate agreements for each product.

The Bottom Line

If your practice stores any patient files in the cloud and you use Microsoft 365, verify two things: your plan is a qualifying business plan, and your administrator has accepted the Microsoft Online Services DPA. If both are true, OneDrive for Business can legally hold PHI.

If anyone in your organization uses free personal OneDrive accounts for work files, that is the more urgent problem to address. No configuration change makes a personal account compliant — the only fix is moving those files to OneDrive for Business and blocking personal account access on work devices.