← Everyday AI for staff (ChatGPT, Copilot, Gemini...) compared
Microsoft Copilot / Copilot Chat (work account)
Microsoft · Productivity suite AI · MedicalDentalTherapy
Verdict: Safe with BAA
The vendor publicly offers a BAA on every plan we list.
BAA fine print (Microsoft 365 commercial / GCC): Copilot's web-search queries to Bing are NOT covered by the BAA; turn web grounding off for PHI. Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection, checked 2026-10-16
Practice fit: General-purpose tool (editorial category).
Not legal advice. Summarized from the vendor's own pages. Confirm with the vendor before entering PHI.
Microsoft 365 commercial / GCC
| Question | Answer | Source & date checked |
|---|---|---|
| BAA available? | Yesyes (BAA included by default in the Data Protection Addendum)Web search queries to Bing are NOT covered by the BAA. | https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech checked 2026-10-16 |
| BAA self-serve? | Yesyes (BAA included by default in the Data Protection Addendum) | https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech checked 2026-10-16 |
| BAA fine print | StatedCopilot's web-search queries to Bing are NOT covered by the BAA; turn web grounding off for PHI. | https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection checked 2026-10-16 |
| Trains on your data by default? | Nono | https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy checked 2026-10-16 |
| Retention | StatedStored with your M365 content; admins set retention in Purview | https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy checked 2026-10-16 |
| SOC 2 | UnverifiedunverifiedNot listed on the Copilot privacy page we checked. | No first-party source found · checked 2026-10-16 |
| ISO 42001 | Yesyes | https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy checked 2026-10-16 |
| HITRUST | Yesyes (services covered by the BAA are HITRUST CSF certified) | https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech checked 2026-10-16 |
| Starting price (as published) | UnverifiedunverifiedNo published price found on pages we fetched. | No first-party source found · checked 2026-10-16 |