Short article / HIPAA

Is Your Microsoft 365 Environment Properly Protecting Patient Information?

Harris Ejiofor, CISM – CyberShield Advisory

Microsoft 365 can support HIPAA safeguards, but only when it is configured and managed for them. Here are the areas healthcare organizations should review first.

For many healthcare practices, Microsoft 365 is where the work happens. Staff email referring providers, share intake forms in Teams, keep spreadsheets in OneDrive and SharePoint, and sign in from the office, from home and from their phones. That means patient information very likely lives in your Microsoft 365 environment, whether or not anyone planned it that way.

The question is not whether Microsoft 365 can be used in a HIPAA-regulated organization. It can. The question is whether yours is set up and managed to protect that information.

Microsoft's role and yours

Microsoft offers a business associate agreement (BAA) for in-scope Microsoft 365 services, and it secures the underlying cloud platform. That matters, but it is only part of the picture.

Cloud services work on a shared responsibility model. Microsoft is responsible for its data centers and core services. Your organization is responsible for how your environment is configured: who has accounts, how they sign in, what they can reach, how files are shared, and whether anyone is watching for unusual activity. A signed BAA does not make those decisions for you.

Five areas to review first

How people sign in. Multi-factor authentication (MFA) is one of the most effective protections against stolen passwords. Check that it applies to every account, including administrators, shared mailboxes that allow sign-in, and accounts used by vendors. Older sign-in methods that cannot use MFA should generally be blocked. If you want rules based on location, device or risk, that is done with Conditional Access, which requires Microsoft Entra ID P1 or higher.
Who has administrator rights. Global administrators can change anything in your environment. Keep the number small, give administrators separate accounts for admin work, and review the list regularly. Remove accounts for people who have left, including former IT providers.
How files and messages leave your organization. Review your external sharing settings in SharePoint, OneDrive and Teams. "Anyone with the link" sharing can be convenient and risky at the same time. Also decide how staff should send patient information by email, for example by using message encryption, and make sure people know the approved method.
Whether you can see what happened. If an account is misused, you will want to know what was accessed and when. Confirm that audit logging is turned on, understand how long your license keeps logs, and decide who reviews alerts. Unexpected mailbox forwarding rules are a common sign that an account has been compromised.
The devices people use. Phones and laptops that reach patient information should be protected: screen locks, encryption, current updates, and a way to remove company data if a device is lost. Microsoft offers device management tools for this, depending on your license.

Licensing shapes your options

Many of these protections depend on which Microsoft 365 plan you have. Some features, such as security defaults, are available broadly. Others, such as Conditional Access, data loss prevention and advanced threat protection, come with specific plans or add-ons. Before changing settings, it helps to know exactly what you own, so that you are neither paying for features you do not use nor assuming protections you do not have.

Connecting it to HIPAA

The HIPAA Security Rule does not name Microsoft 365 settings. It expects you to identify risks to electronic patient information and put reasonable safeguards in place, including access controls, audit controls, authentication and transmission security. Your Microsoft 365 configuration is where many of those safeguards are actually carried out, so it belongs in your HIPAA risk analysis.

Take the next step