Microsoft AI for Charleston Practices
The AI your staff already use,
inside your own Microsoft tenant.
Microsoft names Microsoft 365 Copilot in the services its HIPAA Business Associate Agreement covers. Your prompts are not used to train Microsoft’s models, Copilot only reads what each person already has permission to open, and every question is recorded where an administrator can search it.
Someone in your office has already pasted a client document into a chatbot to fix the wording.
They were not being reckless. It was the quickest way through a dull job. But a personal chatbot account sits outside your agreements, nobody can say where that document went, and there is no record that it happened. Microsoft put a number on how common this is.
The compliance case was written by Microsoft. It is worth reading before anyone sells you one.
Three sentences do most of the work. They are quoted here in full, and each one is on a public Microsoft Learn page you can open yourself.
“The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.”
Microsoft Learn · HIPAA & HITECH Act compliance offering
“Prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation LLMs, including those used by Microsoft 365 Copilot.”
Microsoft Learn · Data, Privacy, and Security for Microsoft 365 Copilot
“Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions.”
Microsoft Learn · Data, Privacy, and Security for Microsoft 365 Copilot
Sixty-two pages. It tells you it’s on page 14.
Ask where assignment is dealt with. It points at clause 11.2 on page 14, shows you the paragraph, and lists renewal, indemnity and notice with their pages too. It locates and cites. The reading is still yours.
HIPAA does not forbid cloud AI.
It never did. The rules permit protected health information in the cloud when a business associate agreement is in place, which is exactly what Microsoft offers.
Anyone selling you fear about the cloud is selling you fear. The work is in configuring it properly, not in avoiding it.
baa · tenant · audit trail
It marks its own uncertainty.
Invoice number read at 99%. Supplier at 42%, flagged as an ambiguous match and held for review. The totals are arithmetic, not a guess.
It shows why it routed there.
Rules run first and are listed as they fail. Where no rule matches, the model classifies and the message is labeled for a person. Every step is on screen.
Microsoft Foundry is the next size up.
Formerly Azure AI Foundry. For AI over your own document store rather than your Office files. Different service, different defaults, and worth reading the limits below before assuming it behaves the same way.
Interface images are illustrations of the finished job, not screenshots of Microsoft software.
Six questions, and where Microsoft answers each one
These are the questions a practice manager or a compliance officer will ask. Every answer below is Microsoft’s published position on a page you can open, not a claim made on their behalf.
Microsoft is equally clear about the limit of all this. Asked whether a BAA makes an organization compliant, its own answer is no: using Microsoft services does not on its own achieve HIPAA compliance, and the practice remains responsible for its own controls and processes.
What it will not do
- Answers are not guaranteed to be correct. Microsoft says so in its own documentation, and anything going to a client still needs reading first.
- A signed BAA is not compliance. It is one control among the many a practice is responsible for.
- Microsoft Foundry, formerly Azure AI Foundry, is a different service with different defaults. Its abuse monitoring can include human review unless Microsoft approves a modified configuration, and its Global deployment type can process prompts in any geography where the model runs. Both are configuration choices, not givens.
- Copilot works on what already lives in Microsoft 365. Files on a local server or locked in a practice management system have to be connected first.
- It makes no clinical or legal judgment, and it will not read bad handwriting.
- Outside the EU, Microsoft may process queries in the US, EU or other regions. Data residency is a configuration question, not an assumption.
Start with the thing someone is already pasting into a chatbot.
That one job is usually enough to work out whether Microsoft 365 Copilot covers it, whether it needs Microsoft Foundry, or whether it needs neither.
Microsoft, Microsoft 365, Microsoft 365 Copilot, Microsoft Purview, Microsoft Graph and Azure are trademarks of the Microsoft group of companies. Quotations are reproduced from Microsoft Learn for identification and reference. CloudCentric is an independent IT provider in Charleston, South Carolina and is not affiliated with or endorsed by Microsoft. Nothing here is legal advice on your HIPAA obligations.