Is Microsoft 365 HIPAA Compliant? BAA, Setup and Licensing

"Is Microsoft 365 HIPAA compliant?" is one of the first questions practice managers ask us, and the honest answer is: it can be, but not by default. Microsoft gives you a signed Business Associate Agreement and a set of very good security tools. Whether your practice is actually compliant depends on which plan you bought, which of those tools you've turned on, and whether you've written down what you did and why.

That gap between "HIPAA-capable" and "HIPAA-compliant" is where most small practices get caught. We regularly see offices that moved email to Microsoft 365 years ago, assume the move took care of HIPAA, and still have no multi-factor sign-in on half their accounts, no encryption for emails to patients, no device management, and audit logs nobody has ever opened.

This guide explains what Microsoft's BAA actually covers, which Microsoft 365 services are in scope, what the HIPAA Security Rule expects you to configure, which license you need, and a step-by-step hardening checklist you (or your IT provider) can work through. It's written for the people who run dental and medical offices, not for engineers, so every tool gets a plain-English explanation.

Is Microsoft 365 HIPAA compliant?

Microsoft 365 supports HIPAA compliance, but no software is "HIPAA compliant" on its own. HIPAA applies to your practice (a covered entity) and your vendors (business associates). It doesn't certify products. As Microsoft says on its own compliance page, there is no HHS-approved certification that proves a cloud service is HIPAA compliant, and "using Microsoft services doesn't on its own achieve HIPAA compliance."

What Microsoft does provide is:

• A Business Associate Agreement (BAA) that commits Microsoft to protect patient data the way HIPAA requires of a business associate.
• A list of in-scope services that the BAA covers, including the core of Microsoft 365.
• Independent audits. Microsoft states that services covered under its BAA are audited for ISO/IEC 27001 and HITRUST CSF certification.
• Security and compliance tools, such as Conditional Access, Intune, Defender, Purview Message Encryption, data loss prevention and audit logging, that you can use to meet the Security Rule's technical safeguards.

What Microsoft doesn't do is configure those tools for you, run your risk analysis, train your staff, or decide who gets access to what. Think of Microsoft 365 like a well-built office building with good locks, cameras and a fire system. HIPAA asks whether you locked the doors, pointed the cameras at the right places and practiced the fire drill.

The shared responsibility model in plain English

The shared responsibility model means the cloud provider secures the platform and you secure how you use it. For Microsoft 365, the split looks roughly like this:

If you only remember one thing from this article, make it this table. Almost every Microsoft 365 HIPAA problem we see sits in the right-hand column.

What does Microsoft's HIPAA BAA cover?

Microsoft's BAA covers the services on its published in-scope list, and it applies automatically through Microsoft's Data Protection Addendum. You don't need to request it, sign it or negotiate it.

A Business Associate Agreement (BAA) is the contract HIPAA requires between a covered entity (your practice) and any vendor that creates, receives, maintains or transmits protected health information (PHI) on your behalf. (Our BAA guide and glossary entry cover the details.)

Here's how it works with Microsoft, according to Microsoft Learn's HIPAA page as of October 2026:

1. It's included by default. Microsoft says its HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA."
2. Microsoft won't sign your BAA. Because Microsoft runs standardized services for millions of customers, it uses its own BAA, developed with healthcare organizations, and declines to sign customer-drafted versions.
3. You can download a copy. The BAA is on the Microsoft Service Trust Portal. Save a PDF in your HIPAA documentation folder with the date you downloaded it. Auditors and cyber insurers sometimes ask for it.
4. It covers only in-scope services. Anything not on Microsoft's list, or any third-party app you connect to Microsoft 365, isn't covered by Microsoft's BAA.

Which Microsoft 365 services are covered?

Microsoft's in-scope list for commercial Office 365 is long. These are the ones a typical practice actually uses, as listed on Microsoft Learn when we checked on October 5, 2026:

Microsoft updates this list, so check the Microsoft Learn HIPAA page before you adopt a new service for patient data.

What isn't covered?

These are the gaps we see most often:

• Consumer Microsoft accounts. A personal Outlook.com mailbox, a personal OneDrive, or a family Microsoft 365 subscription is not your business tenant and isn't covered by your BAA. Staff forwarding work email to a personal address is a common, serious problem.
• Third-party apps and add-ins. An e-signature add-in, a scheduling plug-in, or a backup product that connects to your tenant is a separate vendor. You need a BAA with each of them if they touch PHI.
• Services not on the list. If you can't find a service on Microsoft's in-scope list, assume it isn't covered until you confirm otherwise.
• Your own devices and network. The BAA covers Microsoft's cloud. The laptop at the front desk and the Wi-Fi in your office are yours to secure.

Why "compliant" depends on configuration

The HIPAA Security Rule asks for specific safeguards, and in Microsoft 365 most of them are features you have to switch on and set up. A brand-new tenant has reasonable defaults, but it doesn't enforce device encryption, block forwarding to personal email, encrypt messages to patients, or keep audit logs long enough for most investigations.

The HIPAA Security Rule (45 CFR Part 164, Subpart C) is the federal rule that sets the administrative, physical and technical safeguards for ePHI, meaning electronic protected health information. Its technical safeguards in 45 CFR 164.312 map neatly onto Microsoft 365 features:

On top of these, the administrative safeguards in 45 CFR 164.308 require a risk analysis, risk management, workforce training, security incident procedures, contingency planning and business associate agreements. And 45 CFR 164.316 requires you to keep written documentation of all of it for six years.

"Addressable" isn't "optional." Some specifications, like encryption, are "addressable" under the current rule. That means you must implement them if they're reasonable and appropriate, or write down why not and what you did instead. In a Microsoft 365 environment, encryption is cheap and built-in, so it's very hard to justify not using it. (A proposed update to the rule would remove the addressable category entirely. See our article on the HIPAA Security Rule proposed changes.)

Which Microsoft 365 license do you need for HIPAA?

HIPAA doesn't require a specific license, but for most practices of 5 to 50 people, Microsoft 365 Business Premium is the plan that includes the tools you need. Business Basic and Business Standard both come with the BAA, but they leave out device management, Conditional Access, endpoint protection, data loss prevention and message encryption.

Microsoft's business plans are capped at 300 users, which covers nearly every independent practice. Here's what matters for HIPAA, based on Microsoft's service descriptions as of October 2026:

A few notes on reading that table:

• Security defaults are Microsoft's free, one-switch protection that requires every user to register for MFA. They're available on every plan and are much better than nothing. But they're all-or-nothing; you can't make exceptions or require a managed device.
• Conditional Access is the "if this, then that" engine for sign-ins: if someone signs in from outside the US, block it; if they open email on a phone, require it to be managed. Microsoft's documentation states Conditional Access needs Microsoft Entra ID P1, which Business Premium includes. (See our Conditional Access glossary entry.)
• EDR (endpoint detection and response) is security software that watches a computer's behavior for signs of an attack and can isolate the machine automatically. Microsoft's Defender for Business includes EDR and is part of Business Premium.
• DLP (data loss prevention) scans emails and files for sensitive data, such as Social Security numbers or medical terms, and can warn the user, block the message or force encryption.

We don't quote Microsoft list prices here because they change and vary by billing term. Check Microsoft's site or ask your provider for current pricing. As a rule of thumb, the gap between Standard and Premium per user per month is usually smaller than the cost of buying the missing pieces separately, and far smaller than the cost of a single breach investigation. Our Microsoft 365 plan picker and plan comparison article go deeper.

Can you mix licenses?

Yes. You can mix Business plans within the 300-user cap. Some practices put front-desk and clinical staff on Business Premium and give a part-time bookkeeper who never touches patient data a cheaper plan. Just be careful: Conditional Access and Intune protections only apply to licensed users. Anyone who can reach PHI should be on a plan that lets you protect their account and device. In practice, "anyone who can reach PHI" is almost everyone in a small practice.

Step-by-step: hardening Microsoft 365 for HIPAA

This is the checklist we use when we set up or audit a Microsoft 365 tenant for a medical or dental practice. It assumes Business Premium. Work through it in order, because the early steps protect the admin accounts you'll use for the later ones.

Before you start, write down the date and what you change. That running log becomes part of your HIPAA documentation.

Step 1: Lock down admin accounts

Admin accounts can change every setting and read every mailbox, so they're the first target for attackers.

1. Separate admin accounts. The practice manager's everyday account should not be a Global Administrator. Create a dedicated admin account used only for administration.
2. Keep Global Admins to two to four people. Microsoft recommends using roles with the fewest permissions. Use narrower roles, such as User Administrator, Exchange Administrator or Helpdesk Administrator, for day-to-day tasks.
3. Create two emergency "break-glass" accounts. These are cloud-only admin accounts with long, random passwords stored securely, excluded from Conditional Access policies that could lock everyone out, and monitored for any sign-in. This also covers the Security Rule's emergency access procedure.
4. Require phishing-resistant MFA for admins where possible, such as a FIDO2 security key or passkey, rather than text messages.

Step 2: Turn on MFA for everyone with Conditional Access

Multi-factor authentication (MFA) means signing in with something you know (a password) plus something you have (a phone app or security key). It stops the large majority of password-based account takeovers, and it's the single highest-value control in this list. Our MFA guide explains the options.

With Business Premium, use Conditional Access rather than security defaults:

1. Require MFA for all users and all cloud apps. Exclude only the break-glass accounts.
2. Block legacy authentication. Old email protocols (POP, IMAP, older SMTP sign-in) can't do MFA and are a favorite way for attackers to bypass it.
3. Require MFA to register security info, so an attacker with a stolen password can't add their own phone.
4. Block sign-ins from countries you don't operate in, if your staff don't travel. For a Daytona Beach practice whose staff never work abroad, blocking non-US sign-ins removes a large share of attack traffic.
5. Require a compliant or managed device for access to email and files, once Intune is set up (Step 6). This means a stolen password on its own, used from an attacker's laptop, gets nowhere.
6. Turn on report-only mode first. Conditional Access has a "report-only" setting that shows what would have been blocked. Run new policies in report-only for a few days, check the results, then switch them on.

Use authenticator app push notifications with number matching rather than text messages where you can. Text messages are better than nothing but can be intercepted or redirected through SIM swapping.

Step 3: Set up Purview Message Encryption for email

Email is where patient data most often leaks. Exchange Online uses TLS (Transport Layer Security), which encrypts the connection between mail servers, but TLS is opportunistic: if the receiving server doesn't support it, mail can go through unencrypted, and once it arrives, it's stored however the recipient's provider stores it.

Microsoft Purview Message Encryption (formerly Office 365 Message Encryption, or OME) encrypts the message itself. Recipients on Microsoft 365 read it normally in Outlook; recipients on Gmail, Yahoo and other services open it in Microsoft's encrypted portal using their own account or a one-time passcode. Business Premium includes it.

1. Confirm encryption is active. In Exchange Online PowerShell, Get-IRMConfiguration should show AzureRMSLicensingEnabled as True, and Test-IRMConfiguration should pass. In most eligible tenants this is already on.
2. Create a mail flow rule for a keyword. For example, encrypt any message whose subject contains "[secure]". Staff learn one simple habit.
3. Create a mail flow rule for sensitive content. Use a DLP policy (Step 4) to automatically encrypt outbound messages containing things like Social Security numbers or diagnosis codes.
4. Show staff the Encrypt button in Outlook, and when to use "Encrypt-Only" (recipient can forward) versus "Do Not Forward."
5. Consider TLS-enforced connectors for partners you exchange a lot of PHI with, such as a lab or billing company, so mail to them is rejected if a secure connection isn't available.

There's much more on this, including patients' right to request unencrypted email, in our dedicated article: HIPAA compliant email encryption.

Step 4: Create data loss prevention (DLP) policies

DLP policies find sensitive information in email, SharePoint and OneDrive and act on it. Microsoft Purview includes built-in sensitive information types, such as U.S. Social Security numbers and other health and financial identifiers, and policy templates aimed at U.S. health and financial data.

A sensible starting set for a practice:

1. Outbound email with patient identifiers: If a message to an external recipient contains a Social Security number, or several health identifiers, encrypt it automatically and show the sender a policy tip explaining why.
2. Sharing files externally: If a file in OneDrive or SharePoint containing sensitive data is shared with someone outside the practice, warn the user and notify the compliance contact.
3. Bulk data: If a message or file contains many records (for example, 10 or more Social Security numbers), block it and alert an admin. That's almost never legitimate in a small practice.
4. Start in test mode. DLP has a simulation mode that shows what it would catch. Run it for two weeks, adjust for false positives (insurance billing paperwork trips some rules), then turn on enforcement.

Step 5: Tighten sharing, forwarding and guest access

Most Microsoft 365 data leaks aren't hacks. They're sharing settings left wide open.

1. Block automatic forwarding to outside addresses. In Defender's outbound spam policy, set automatic forwarding to Off. Attackers who take over a mailbox often set up a hidden forwarding rule to copy all mail out. Staff who forward work mail to personal accounts create the same exposure.
2. Restrict "Anyone" links in SharePoint and OneDrive. Set external sharing to "New and existing guests" or "Only people in your organization," and set default links to "People in your organization."
3. Set expiration on guest access and external links.
4. Control Teams external access. Decide whether staff can chat with any outside Teams user or only with approved domains, like your billing company.
5. Review who has access to shared mailboxes, such as front@ or billing@. People change roles; access should follow.

Step 6: Manage and encrypt every device with Intune

Intune is Microsoft's device management service. It lets you push security settings to Windows PCs, Macs, iPhones and Android phones, check whether they comply, and wipe company data from a lost device. Our Intune guide covers setup in depth.

For HIPAA, the essentials are:

1. Enroll every practice-owned PC and laptop. For new devices, Windows Autopilot can set them up automatically on first sign-in, the approach used in our software startup case study.
2. Enforce BitLocker disk encryption on Windows and FileVault on Macs, with recovery keys escrowed in Intune. A stolen encrypted laptop is generally not a reportable breach under HHS breach guidance; an unencrypted one usually is.
3. Set compliance policies: encryption on, firewall on, Defender running, OS up to date, screen lock after a few minutes of inactivity.
4. Push Windows and app updates with update rings so patches install within days, not months.
5. Use app protection policies for personal phones. If staff check email on their own phones, Intune can protect just the Outlook and Teams apps: require a PIN, block copy-paste into personal apps, and wipe practice data if they leave, without touching their personal photos.
6. Tie it to Conditional Access so only compliant devices can open email and files.

Step 7: Deploy Defender for Business and Defender for Office 365

1. Onboard every Windows and Mac device to Defender for Business. If you're using Intune, onboarding can be pushed automatically.
2. Turn on attack surface reduction rules, which block common ransomware tricks like Office macros launching programs.
3. Turn on tamper protection so malware (or a curious user) can't switch Defender off.
4. Apply Microsoft's preset security policies for Exchange Online Protection and Defender for Office 365 ("Standard" or "Strict"). These turn on Safe Links, Safe Attachments, impersonation protection and anti-phishing in one step.
5. Decide who gets alerts. Defender is only useful if someone acts on its alerts. That's a big part of what a managed IT provider does. We run 24/7 monitoring with alerts routed to our team.

Step 8: Turn on and extend audit logging

Audit logs are your evidence. If a mailbox is compromised, the first questions a breach investigation asks are: what did the attacker access, and when? Without logs, you often have to assume everything was accessed, which can turn a small incident into a large reportable breach.

1. Confirm auditing is on. Microsoft states Audit (Standard) is enabled by default and keeps records for 180 days. Check it in the Microsoft Purview portal under Audit.
2. Confirm mailbox auditing is on for all mailboxes (it is by default in current tenants, but check older ones).
3. Decide on longer retention. HIPAA requires you to keep documentation for six years, but doesn't set a log retention period. Many practices want more than 180 days of logs. Options include Audit (Premium) through Microsoft's Purview add-on for Business Premium (one-year retention for Entra, Exchange and SharePoint activity) or exporting logs to a separate store through Microsoft's Office 365 Management Activity API.
4. Review sign-in logs regularly. Look for sign-ins from unexpected countries, impossible travel, and repeated MFA denials. Even a monthly look catches problems.
5. Write down who reviews logs and how often. "Information system activity review" is a required administrative safeguard under 164.308.

Step 9: Set retention policies

Retention policies keep email and files for a set time, even if a user deletes them, and can delete them automatically when that time is up.

1. Set a retention policy for mailboxes, SharePoint, OneDrive and Teams that matches your records policy.
2. Coordinate with your records rules. HIPAA documentation must be kept six years. Medical and dental record retention periods come from state law and your licensing board, and sometimes from payer contracts. Your EHR or practice management system is normally the official record, but email and files often contain PHI too.
3. Don't treat retention as backup. Retention protects against deletion inside Microsoft 365. It doesn't give you an independent copy if your tenant is compromised or an admin account is used maliciously. A separate Microsoft 365 backup, from a vendor that signs a BAA, is still worth having. See our backup and disaster recovery guide.

Step 10: Prepare for Copilot before you turn it on

Microsoft lists Copilot and Copilot Chat as in-scope for its BAA. The risk with AI assistants isn't Microsoft reading your data; it's your own staff seeing data they technically had access to but never knew about. Copilot can surface the "everyone in the company" spreadsheet from 2019 with patient balances in it.

Before enabling it:

1. Find and fix oversharing. Look for SharePoint sites and folders shared with "Everyone" or "Everyone except external users."
2. Apply sensitivity labels to folders containing PHI if you use them.
3. Note the decision in your risk analysis, with a date, who approved it and what you checked.

Step 11: Document everything

Configuration without documentation won't satisfy an auditor. The Security Rule requires written policies and procedures, and records of actions and assessments, kept for six years.

Your Microsoft 365 HIPAA folder should contain:

• The downloaded Microsoft BAA, with the date
• Your current risk analysis, including Microsoft 365 as a system that stores ePHI
• A configuration summary: MFA method, Conditional Access policies, Intune compliance rules, DLP policies, retention settings, audit settings
• Your change log
• Policies: acceptable use, email and encryption, device use, access control, incident response
• Staff training records
• BAAs for any third-party apps connected to Microsoft 365

Microsoft Purview Compliance Manager is included with Business Premium and has an assessment template for HIPAA. It's a useful checklist and progress tracker, but its score isn't a compliance certificate.

How long does it take to harden Microsoft 365?

For a practice of 5 to 25 users on Business Premium, a careful hardening project usually takes two to four weeks of calendar time. Most of the work is testing and staff communication, not clicking buttons.

The slowest part is nearly always devices: tracking down the reception PC nobody logs into, the doctor's home laptop, the imaging workstation with vendor software that needs special handling.

Mistakes we see in practice Microsoft 365 tenants

Most problems come from things left at their defaults or set up once and never revisited. These are the ones we find most often when we review a practice's Microsoft 365:

1. MFA on "most" users. The one account without MFA, often a shared front-desk login or the owner who "found it annoying," is the one that gets phished.
2. Shared logins. A single "frontdesk@" account used by three people violates the unique user ID requirement and makes audit logs useless. Use a shared mailbox that individuals access with their own accounts.
3. Ex-employees still active. Accounts of people who left months ago, sometimes with email forwarding to their personal address.
4. Personal email for work. Staff using Gmail to send referral letters "because it's easier."
5. No device management. Laptops without disk encryption, home PCs syncing the entire SharePoint library, phones with no PIN.
6. Global Admin for everyone. We've seen practices where every staff member was a Global Administrator, usually because someone set it up that way to "make things work."
7. Business Standard with no add-ons, plus an assumption that it covers HIPAA because the BAA applies.
8. Audit logs never checked. The logs exist, but nobody knows how to search them until there's an incident.
9. "Anyone with the link" sharing for folders containing patient documents.
10. No written record. Settings may be fine, but nothing on paper shows a risk analysis, a decision or a review date.

Scenario walk-throughs

A six-person dental office

The office has two dentists, two hygienists, a front desk coordinator and an office manager. The practice management and imaging software run on a local server; Microsoft 365 handles email, scheduling notes, insurance correspondence and scanned forms.

What we'd set up: Business Premium for all six users; Conditional Access requiring MFA and compliant devices; Intune on the four PCs and two practice tablets, with BitLocker; Defender for Business; a "[secure]" encryption rule plus a DLP rule for Social Security numbers in outbound email; forwarding blocked; SharePoint sharing limited to internal; a 180-day audit check monthly by the office manager. The local server is a separate project. It isn't covered by Microsoft's BAA and needs its own backups and security. Our dental office IT guide covers that side, and our dental practice case study shows how one office moved patient data to encrypted cloud storage with access controls and device management.

A 20-person medical practice

Two locations, a cloud EHR, a billing service and a lab interface. Clinicians use phones for Teams messages and email.

What changes: Intune app protection on personal phones rather than full enrollment, so clinicians keep their privacy; Teams external access limited to the billing company's domain; a TLS-enforced connector to the lab; DLP tuned to catch bulk patient lists; and the EHR vendor's BAA filed alongside Microsoft's. Copilot is on hold until a SharePoint permissions cleanup is done. See our medical office IT guide for the broader picture.

A practice that "already has HIPAA email"

Many practices pay for a separate secure email service on top of Microsoft 365. That can be fine, but check whether it duplicates what Business Premium already includes. If you're on Premium, Purview Message Encryption may let you drop the extra service, with one less vendor and one less BAA to manage. If you're on Standard, the separate service may be filling a real gap.

What happens if Microsoft itself has a security incident?

Under the BAA, Microsoft is obligated to notify you of a breach of unsecured PHI it discovers in its services, and you then decide what your own notification duties are. That's the point of a business associate agreement: it spells out who does what when something goes wrong on the vendor's side.

In practice, two things matter for a small practice:

1. Make sure Microsoft can reach you. Microsoft sends service, security and privacy notices to the administrators and contacts listed for your tenant. In the Microsoft 365 admin center, check that your admin accounts and the organization profile point to a real, monitored mailbox, not the email address of an employee who left in 2021.
2. Know that most incidents start on your side. The overwhelming majority of Microsoft 365 incidents we deal with are compromised user accounts (usually through phishing), misdirected emails, or oversharing. Microsoft's platform being breached is a far less likely scenario than one of your staff entering their password on a fake login page. That's why MFA, Conditional Access and staff training sit at the top of the checklist above.

Your own breach response plan should cover both situations: a vendor incident you're told about, and an incident inside your own tenant you discover yourself. For each, write down who investigates, who decides whether it's a reportable breach, and who contacts patients, HHS and (in Florida) the state Attorney General's office if required.

Does your IT provider need a BAA too?

Yes, if they can access your Microsoft 365 tenant or any system that holds patient data. An IT provider with admin rights can read mailboxes and files, which makes them a business associate under HIPAA. That's true whether they're a large MSP or one person who "helps out." HHS's guidance on cloud computing makes the same point for cloud providers that store ePHI even if they can't view it. Ask for the BAA before you hand over admin credentials, not after.

Questions to ask your IT provider

If someone else manages your Microsoft 365, these questions quickly show whether it's set up for HIPAA:

1. Which Microsoft 365 plan are we on, and does every user who touches patient data have it?
2. Is MFA enforced for every account, including admins and shared-mailbox users? How? Security defaults or Conditional Access?
3. Is legacy authentication blocked?
4. Are all our computers enrolled in Intune and encrypted? Can you show me the compliance report?
5. How do staff send encrypted email to patients and outside providers?
6. Is automatic forwarding to external addresses blocked?
7. How long are our audit logs kept, and who reviews them?
8. Who are our Global Administrators, and do they use phishing-resistant MFA?
9. Do we have a backup of Microsoft 365 separate from Microsoft's retention?
10. Will you sign a BAA with us? (Any IT provider with admin access to your tenant is a business associate.)
11. Where is our configuration documented, and when was it last reviewed?

If the answers are vague, that's your answer. Our free HIPAA security checklist tool is a quick way to see where you stand.

What this looks like when it's done right

A properly configured Microsoft 365 tenant gives a small practice security that would have needed an enterprise IT team ten years ago. Staff sign in once with MFA. Their devices are encrypted and patched automatically. Patient emails go out encrypted without anyone needing to remember a separate system. A stolen laptop is an inconvenience, not a breach notification. And when your cyber insurer or an auditor asks how you protect patient data, you hand them a folder instead of a shrug.

HHS OCR (the Office for Civil Rights, which enforces HIPAA) has continued to announce settlements in 2025 and 2026 where the underlying failure was the absence of a thorough risk analysis, often discovered after ransomware or phishing. You can browse them on the HHS resolution agreements page. The pattern is consistent: the technology was available; the configuration and documentation weren't there.

The bottom line

Microsoft 365 is a solid foundation for a HIPAA-compliant practice. Microsoft signs the BAA automatically, covers the services you actually use, and gives you strong tools. But "Microsoft signed a BAA" is the start of compliance, not the end. Choose a plan that includes the tools you need (usually Business Premium), work through the hardening steps above, and write down what you did.

If you'd like a second set of eyes, we review Microsoft 365 tenants for medical and dental practices across Volusia and Flagler counties and remotely anywhere in the US, and we sign a BAA with every healthcare client. Learn more about our healthcare IT services and Microsoft 365 management, or book a free 20-minute call and we'll tell you where your tenant stands.