Microsoft Copilot: which plan do I need for patient data?
Short answer
Plans with a BAA: Microsoft Copilot / Copilot Chat (work account): Microsoft 365 commercial / GCC.
No BAA: Microsoft Copilot (personal Microsoft account): Free / Microsoft 365 Personal / Family.
Only a plan with a signed BAA should be used with PHI. Staff on other plans, including personal accounts, shouldn't enter patient data.
| Plan | BAA? | How you get the BAA | Trains on your data? | Retention | Fine print |
|---|---|---|---|---|---|
| Microsoft Copilot (personal Microsoft account): Free / Microsoft 365 Personal / Family | Nono[source] | n/a | Unverified | Unverified | n/a |
| Microsoft Copilot / Copilot Chat (work account): Microsoft 365 commercial / GCC | Yesyes (BAA included by default in the Data Protection Addendum)[source] | Yesyes (BAA included by default in the Data Protection Addendum)[source] | Nono[source] | Stored with your M365 content; admins set retention in Purview[source] | Copilot's web-search queries to Bing are NOT covered by the BAA; turn web grounding off for PHI.[source] |
Full detail and certifications: Microsoft Copilot (personal Microsoft account), Microsoft Copilot / Copilot Chat (work account). Checked 2026-10-16.
Not legal advice. From the vendor's own pages on the date shown. Confirm the current terms with the vendor.