Your practice is on Microsoft 365, or thinking about it, and someone asks whether patient files can go in SharePoint. The short answer is yes. You can use SharePoint in a way that fits HIPAA, but using it does not make you compliant on its own. How it is set up and how your people use it decides that.

Xentric works with businesses across many industries, and we have meaningful experience supporting medical practices. We use the same security tools for every client. For a practice, we configure them to what HIPAA’s technical safeguards call for, and we understand how a clinical office runs. You can read more on our medical practice IT page. The administrative and policy side of HIPAA stays with your practice, ideally with your compliance officer or a healthcare attorney. What follows is what I would want any practice owner to understand before moving patient files into the cloud.

Microsoft 365 and HIPAA compliance

Software is not HIPAA compliant by itself. According to Microsoft, there is no certification standard that the Department of Health and Human Services (HHS) approves for this, and using Microsoft services does not on its own achieve HIPAA compliance. Microsoft says your organization is responsible for having a compliance program and for making sure how you use the services matches your HIPAA obligations.

So the better question is whether you can use Microsoft 365 in a way that meets HIPAA’s requirements. You can. Microsoft signs a Business Associate Agreement (BAA), the contract HIPAA requires with any vendor that handles patient information for you, and it operates its services under the HIPAA Security Rule. The rest comes down to your settings, your policies and your people.

SharePoint and HIPAA compliance

SharePoint Online is on Microsoft’s list of services covered by its BAA, along with OneDrive, Exchange Online, Teams, Intune and Microsoft Entra ID. That means Microsoft takes on its responsibilities as a business associate for those services. It does not control who in your office can open a folder or who you share it with.

Imagine a front-desk employee needs to send a referring office a folder of patient intake forms. SharePoint lets them create a link that opens for anyone who has it, with no sign-in and no expiration. It takes ten seconds and it works. It also puts patient records outside your control, and nothing in the product stops it unless someone set it up to. That is the kind of gap that causes HIPAA problems, and it comes from how the tool is used rather than from what the tool is.

What HIPAA requires of the technology

The Security Rule sorts its safeguards into administrative, physical and technical. Administrative safeguards are your policies, training and risk management. Physical safeguards cover things like locked rooms and secured workstations. The technical safeguards are the ones SharePoint and Microsoft 365 touch directly, and the rule lists five:

  • Access control: only people who have been granted access can reach patient information, and each has a unique login.
  • Audit controls: the system records and lets you review activity involving patient information.
  • Integrity: patient information is protected from improper changes or destruction.
  • Person or entity authentication: you verify that whoever is signing in is who they say they are.
  • Transmission security: patient information is protected while it moves across a network.

HIPAA does not say exactly how to meet each one. It expects safeguards that are reasonable and appropriate for your size and risk. In Microsoft 365, that usually means permissions set by group rather than by person, multi-factor authentication (MFA) so a stolen password is not enough, activity logging, restrictions on external sharing, and encryption. Which of those you already have depends on your plan, which is one reason the license you choose matters.

You can read the technical safeguards for yourself in 45 CFR 164.312.

The Business Associate Agreement with Microsoft

If you are a covered entity and patient information will be in Microsoft 365, you need a BAA with Microsoft. You do not have to track down a separate document. Microsoft’s documentation says its HIPAA BAA is available through the Online Services Data Protection Addendum by default to customers who are covered entities or business associates. The addendum is part of your Microsoft agreement, so confirm that your plan and tenant fall under it, and keep a copy of the terms with your compliance records.

Xentric does not sign a separate BAA, because for Microsoft 365 the agreement is built into Microsoft’s standard terms. Google also offers a BAA that a customer accepts electronically, so the question applies to any cloud service you consider. Whatever you use, confirm how the BAA works before patient information goes in.

What your IT provider can and cannot do

A good IT provider sets up the technical side: MFA, device management, access controls, logging, backup. At Xentric that means the same security tools we use for every client, including Microsoft Intune for managing devices, configured to the HIPAA technical safeguards for a practice. What an IT provider cannot do is make you compliant. HHS expects you to conduct an accurate and thorough risk analysis of where patient information lives and what could go wrong, and to document it. We assist with risk assessments, and your technology gets configured around the answers.

One more thing to keep an eye on. HHS proposed a major update to the Security Rule in January 2025 that would require MFA and encryption explicitly and remove the current distinction between required and addressable safeguards. As of this writing it is not final, and HHS’s agenda points to July 2027 at the earliest. The current rule is fully enforceable now, and MFA is a good idea whether or not it becomes mandatory.

If your practice is already on Microsoft 365 and you want a second set of eyes on how SharePoint sharing, MFA and device management are set up, we’ll take a look at it. It’s up to you whether you start there or with a risk analysis, but I would not wait until a patient file has already gone somewhere it should not. You can reach us through our Microsoft 365 management page.