Office 365 HIPAA compliance is dependent on how it is used. Microsoft implements end-to-end encryption for data stored or uploaded to servers, as well as data transferred beyond its’ servers. However, the names of files, subject line of emails, and message headers are not encrypted. Therefore, to use Office 365 in a HIPAA compliant manner, organizations must ensure that PHI is not contained in these areas.

In addition, HIPAA requires that healthcare organizations implement access management. Access management allows administrators to limit data access by designating employees access levels based on their job role. By implementing access controls, you can track which employees access what data, and how frequently they access it, referred to as audit logs. Office 365 is capable of creating audit logs that are available upon request.