Call now for cybersecurity help: 888-646-1616
Josh Ablett

Office 365 HIPAA Compliance - 6 best features and how it works?

Office 365 HIPAA Compliance is crucial for the healthcare industry as more and more entities are looking to secure their patient's sensitive information. The good news is corporate giants like Microsoft are making great investments and innovations in both robust security settings and HIPAA compliance for many of their most popular products.

Office 365 has been becoming the go-to name for the healthcare industry, and Microsoft is leaving no stone unturned as far as medical practices, HIPAA and IT Security are concerned.

So let's look into the top six features that make Office 365 HIPAA compliance great.

Office 365 HIPAA Compliance business associate agreement

Microsoft will execute a HIPAA BAA that covers Microsoft365 & Office 365 HIPAA compliance. It's handled automatically by accepting their end-user license.  You can check out their FAQ by downloading this pdf and going through the details.

Download HIPAA FAQ for Business Associate Agreement Info

Anyone who touches your sensitive data (PHI) is a HIPAA “Business Associate.” These Business Associates must sign an agreement promising to protect your patient data.

Microsoft365 handles sensitive emails, calendars, and documents.  They are definitely considered a Business Associate by HIPAA.

Office 365 HIPAA Compliance two-factor authentication

Two-factor authentication is becoming much more common, considering the authenticity and security it provides to your data.  You've probably seen this on other sites like online banking.  You log in with your password, but then you need to enter a code from your phone or email to prove that it’s actually you.

We’re HUGE fans of the way that Microsoft does two-factor authentication while making Office 365 HIPAA compliance.  Their smartphone app is well designed.  You can approve your login right from your smartphone notification screen, like this:

Office 365 HIPAA Compliance two factor authentication

This is way easier than entering a code or waiting for a text message to come in.  You still have the choice to do both of these, but the app is fast and easy.  And we’ve always found that the best security is the kind that doesn't slow you down.

In fact, we often help our customers set up the two-factor authentication process as we make them go through the Office 365 HIPAA Compliance process.

Data Loss Prevention

Microsoft has invested a lot in this area, and it shows.  Data loss prevention stops your staff from accidentally emailing or sharing PHI.  Let’s take a look at how DLP works in a HIPAA-compliant Microsoft365 setup:

  • First, set up a policy.

Choose from existing premade templates covering your industry.

office 365 HIPAA compliance dlp policy

  • Look into all the Microsoft365 services the policy covers

Best to leave them all turned on unless you have a reason not to.

office 365 HIPAA compliance dlp services

  • Next, Customize the types of sensitive data you want to protect

office 365 HIPAA compliance dlp sensitive data

  • Finally, let’s tell it what to do

In this example, it’s going to warn the user.  If the user sends more than 5 pieces of information, they’ll get blocked.

office 365 HIPAA compliance blocks sensitive data

Pretty slick, huh?

Office 365 HIPAA Compliance is completely transparent

Like other cloud security providers, Microsoft has layers and layers of inside and outside auditors measuring their compliance and IT security measures. You can take a detailed look into their compliance norms by downloading this pdf.

Download Compliance Norms


Microsoft has done an amazing job giving customers visibility into the results of these audits to prove that Microsoft365 is HIPAA-compliant.

Here is a step-by-step guide on how you can set up your console.

In their admin console, you enter your location and industry:

office 365 HIPAA compliance trust and compliance

Microsoft automatically shows you compliance reports relevant to your location and industry.

We can’t show you the details because they’re covered under NDA, but these two will give you an idea.

  • Status of Audited Controls

See exactly which IT security controls were audited, and whether they passed or failed:

office 365 HIPAA compliance security audits

Compliance Reports

Similarly, you can see the actual compliance reports for each service and each audit:

office 365 HIPAA compliance reports

This is an excellent functionality for your auditors.

Configurable alerts

This is a new and impressive feature of the Office365 platform.  Microsoft built a rules engine that lets you trigger alerts on certain conditions.

Here’s an example -- let’s say that you have employees that aren’t supposed to delete any files.  You can set up an alert so that you’ll get notified any time someone deletes a file, and it’s as simple as this:

office 365 HIPAA compliance alerts

There are hundreds of “Activities” available on which to alert.

Prevent accidental breaches

Office 365 has two cloud services for file sharing:

  • Sharepoint (for team file sharing)
  • OneDrive (for personal file backup and sharing)

It can be TOO easy to accidentally share files with the public, and that would be a HIPAA breach.

Microsoft has made it simple to disable external sharing, preventing anyone from making this mistake.

office 365 HIPAA compliance disable sharing

Office 365 HIPAA Compliance can be a little complicated. However, that is something that you shouldn't worry about. Experts like Adeliarisk have been implementing Office 365 HIPAA Compliance for our clients for nearly a decade now. So if you feel you can use some helping hand, you can always reach out to us.

Office 365 HIPAA Compliance With ADELIARISK

Get some free help!  Check out our free guide for 17 Tips to Make Microsoft365 HIPAA Compliant. You can also reach out to our Twitter account for more details on Office 365 compliance.


Leave a Reply

Your email address will not be published. Required fields are marked *

Do you think we might be a
good match?

We help over 100 of the best financial services, healthcare, and manufacturing companies across the U.S. with their cybersecurity.
Copyright 2023 Adelia Associates, LLC | All Rights Reserved