Is Microsoft Teams® HIPAA Compliant for Telehealth?

The Bridge Team
December 28, 2022
- HIPAA

Published on December 28, 2022. Updated on September 4, 2024

Is Microsoft Teams HIPAA compliant? The answer depends on the version you use.

If you’re wondering whether Microsoft Teams® is HIPAA compliant for telehealth, you’re not alone. The fact is that the compliance of Microsoft Teams depends on the specific software package and several other factors, many of which are the healthcare organization’s responsibility. Let’s take a closer look.

Is Teams HIPAA Compliant In 2024?

In early 2020, the Department of Health and Human Services (HHS) released new guidelines on HIPAA requirements. These guidelines modified HIPAA’s Privacy Rule to allow previously disallowed video conferencing tools to provide telehealth as an emergency response to the COVID-19 pandemic¹. In 2023, the Consolidated Appropriations Act of 2023 extended many telehealth flexibilities authorized during the public emergency until December 31, 2024².

During this relaxed regulatory period, small practices and large healthcare networks alike relied on popular videoconference platforms such as Microsoft Teams to accommodate the increased number of online appointments.

However, as the deadline approaches, many healthcare organizations are now rushing to find a reliable telehealth software provider that meets adequate security standards, all the while navigating confusing messaging regarding whether certain major telecommunications platforms, such as Microsoft Teams, are HIPAA compliant in 2024 and beyond.

Compliance Templates For Microsoft Teams

When implementing a HIPAA-compliant videoconferencing solution, patients should also be required to complete necessary patient consent forms and agreements. Microsoft Teams is no exception and explicitly places responsibility in the healthcare organization’s hands.

Commonly used consent forms and agreements for online patient portals and telehealth platforms include:

Comparing Microsoft Teams Versions For HIPAA Compliance

Microsoft Teams standard version vs Microsoft 365 Cloud®

The base version of Microsoft Teams is not a HIPAA-compliant telehealth solution. However, Microsoft has stated that users of the Microsoft 365 Cloud platform, of which Microsoft Teams is a part, can configure the software to help enable HIPAA security compliance.

In a recent white paper, the company explains how to configure Microsoft Office 365 and Microsoft Teams to achieve compliance with HIPAA’s rules for covered entities³. A signed HIPAA Business Associate Agreement (BAA) with Microsoft is also required before any entity can use Microsoft services to store ePHI.

However, it is important to note that the covered entity is responsible for ensuring that its use of Microsoft Teams or other software complies with HIPAA rules. Microsoft itself warns in the white paper that incorrect configuration of its software can lead to HIPAA violations.

Not all Microsoft enterprise packages come with Teams. Furthermore, the necessary tools to configure Microsoft 365 and its components to meet HIPAA-compliant standards are either paid modular add-ons or part of more expensive packages.

Microsoft Cloud for Healthcare®

The most comprehensive solution for businesses aiming to use Teams for PHI management is the Microsoft Cloud for Healthcare. This package, designed specifically for healthcare organizations, includes an automatic (and mandatory) BAA for any Covered Entity that subscribes to it. While it includes many useful features, not all healthcare providers may find them necessary or cost-effective.

Several potential issues arise when you sign a BAA with Microsoft. First, Covered Entities cannot store PHI in any directory information maintained within an in-scope service (such as Teams). Second, Microsoft will not fulfill customer right of access requests or report “unsuccessful” security incidents, contrary to official requirements⁴. Microsoft does not allow healthcare organizations to use their own BAA agreements when partnering with Microsoft, so potential partners should proceed with caution⁵.

Explore: HIPAA Compliance And Telehealth

The Verdict: Is Microsoft Teams® HIPAA Compliant?

If healthcare providers want to ensure that they are safely following all HIPAA rules regarding security and privacy, they should reconsider using Microsoft Teams as a HIPAA-compliant telehealth software.

While Microsoft Teams can be configured via premium add-ons or the Microsoft Cloud for Healthcare version, organizations should carefully consider the total and long-term expenses, especially if the upgraded licenses are only required by some users in the domain.

Regardless of the software package used, the provider is responsible for ensuring HIPAA compliance regarding the configuration and use of the software, which also puts a heavy burden of risk on the healthcare organization.

Ultimately, Microsoft Teams can be used as a HIPAA-compliant telehealth platform within certain configurations, but it comes with significant issues. However, there are better alternatives.

HIPAA-Compliant Telehealth Alternative To Microsoft Teams

Rather than adapting an office productivity suite to fit the challenging regulatory environment of healthcare, organizations should consider a communications solution designed for HIPAA compliance from the ground up.

Leveraging a comprehensive patient engagement platform that provides telehealth, and connects with other solutions along the care journey, like scheduling and intake, offers more value to providers and a smooth and connects with other solutions along the care journey, like scheduling and intake, offers providers more value and a patients a smoother experience.

Bridge’s telehealth solution does just that and is entirely HIPAA compliant. It forms part of the BridgeInteract platform, which allows organizations to use a single platform for all their patient engagement needs to streamline workflows, increase patient satisfaction, and improve ROI.

BridgeInteract is SOC 2 certified, demonstrating its commitment to the strictest data security standards. The platform utilizes strong encryption, next-generation firewalls, and HIPAA-compliant cloud services to protect client data and ensure patient information remains secure.

In addition, BridgeInteract is compliant with the ONC Certification Criteria for Health IT and has been certified by an ONC-ACB in accordance with the applicable certification criteria adopted by the Secretary of Health and Human Services._^*

To know more about the certified module, please check https://www.bridgeinteract.io/certifications/

Looking for a secure, healthcare-specialized alternative to Microsoft Teams? Contact us to learn how we can help you deliver a better patient experience with our leading HIPAA-compliant telehealth solution.

REQUEST A DEMO

Explore: HIPAA Compliance And Telehealth

DISCLAIMER: All product and company names are trademarks™ or registered® trademarks of their respective holders. BridgeInteract is not affiliated, endorsed, or sponsored in any way by the service providers mentioned in this article.

*This certification does not represent an endorsement by the US Department of Health and Human Services.

Sources:

Department For Health and Human Services. (2023). Telehealth policy changes after the COVID-19 public health emergency | Telehealth.HHS.gov. [online] Available at: Link. Accessed August 21, 2024. ↩︎
US Congress. 2023) Consolidated Appropriations Act. [online] Available at: Link. Accessed August 21, 2024. ↩︎
Microsoft. (2019). HIPAA COMPLIANCE MICROSOFT OFFICE 365 AND MICROSOFT TEAMS. [online] Available at: Link. Accessed August 21, 2024. ↩︎
National Archives. (2024). Code of Federal Regulations, Title 45. [online] Available at: Link. Accessed August 21, 2024. ↩︎
Microsoft. (2022). Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance. [online] learn.microsoft.com. Available at: Link. Accessed August 21, 2024. ↩︎