FREE Report: New NY Financial Services Department Regulation

Microsoft Outlook is not HIPAA compliant by default, but it can support HIPAA compliance when properly configured. To use Outlook safely for transmitting ePHI, your organization must use a paid Microsoft 365 business or enterprise plan, sign a BAA with Microsoft, enable end-to-end encryption, enforce MFA, and establish strict administrative policies. Free consumer accounts (@outlook.com or @hotmail.com) cannot support HIPAA compliance.

Not every organization that handles health information is required to follow HIPAA. HIPAA applies specifically to two major groups: Covered Entities (like healthcare providers and health plans) and Business Associates (vendors that handle health data on their behalf). However, many individuals are surprised to learn that standard employers, fitness apps, and life insurance companies are usually exempt. Read on to find out exactly who must comply with HIPAA and who is off the hook.