Is Power Automate HIPAA Compliant? Where Microsoft's BAA Stops

By Edward Pinela · Founder, Lightray AI · 25 October 2026

Asking “is Power Automate HIPAA compliant” usually gets a plan-by-plan answer, but the plan is not where the risk is. Microsoft already covers the Power Automate cloud service under its standard agreement, by default. The exposure sits in the connectors: the moment a flow hands patient data to a non-Microsoft app, that app's vendor needs its own agreement, and data policies are how you stop it happening.

This is general information to help you ask better questions, not legal advice. Microsoft's terms and service lists change, so confirm the current position before relying on it, and have your compliance officer or healthcare counsel sign off on anything that turns on your specific facts.

What does Microsoft say about Power Automate and HIPAA?

That it is covered. Microsoft's HIPAA and HITECH page lists the “Power Automate cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite” as in scope, and says its agreement is available through the Data Protection Addendum “by default” to covered entities and business associates.

You can read the list yourself on Microsoft Learn's HIPAA and HITECH Act page (opens in new window). Two terms carry the rest of this guide. Protected health information (PHI) is health information that identifies a patient — a name next to an appointment reason is enough. A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits PHI on its behalf; the HHS guidance on business associates (opens in new window) sets out what it has to contain.

Does the Power Automate licence change the answer?

Not for the agreement. Microsoft's wording covers the cloud service whether you bought Power Automate on its own or got it inside an Office 365 or Dynamics 365 plan, so there is no higher tier to upgrade to for coverage. What a licence does change is which connectors are available, and that is where the real question lies.

One boundary is worth naming. The list covers the cloud service. Desktop flows — Power Automate's robotic process automation, which drives applications on a Windows machine — run on a computer you supply, so the security of that machine, its disk and whoever can sign in to it is yours to manage.

Where does Microsoft's BAA stop in a flow?

At Microsoft's own services. A connector is the building block a flow uses to read from or write to another app. Connectors to in-scope Microsoft services keep data under the Microsoft agreement; connectors to anyone else hand the data to that vendor, and Microsoft's agreement does not travel with it. The table sorts the common cases.

The third-party row is the one that catches practices out. A flow that copies a new intake form from Microsoft Forms into an outside CRM looks like one Microsoft automation, but the patient's details finish on the CRM vendor's side of the line, and the Microsoft agreement does not reach them there.

How do Power Platform data policies keep PHI in covered services?

By controlling which connectors a flow may combine. A data policy sorts connectors into Business, Non-Business and Blocked groups, and Microsoft states that connectors in different groups cannot share data in one flow. Put covered services in Business, block what has no agreement, and an uncovered destination cannot be wired in.

Three details from Microsoft's connector classification documentation (opens in new window) matter for a practice. New connectors land in Non-Business by default, so anything Microsoft adds later stays away from your Business group until someone reviews it. The HTTP, HTTP Webhook and When an HTTP request is received connectors can be classified like any other. And core Microsoft 365 connectors such as SharePoint, Outlook and Teams cannot be blocked, only grouped — which is fine, because they are the covered ones.

How do you audit the flows you already run?

Follow the data, not the flow's name. For each flow, note the trigger, every connector it uses and every field passed between steps. Anything sourced from an intake form, a shared patient mailbox, a scheduling system or a billing tool is a candidate for PHI until you have read the fields and shown otherwise.

Check run history too. It records the inputs and outputs of each step, so a flow that has handled patient information has left a copy where anyone with access to the flow can see it. The Secure inputs and Secure outputs settings on an action hide that data from run history. If a flow has been sending PHI to an uncovered app, do not quietly delete it: whether past runs need assessing as a potential breach is your compliance officer's call, and the flow and its history are the evidence they will need.

Is Microsoft's BAA enough to make Power Automate HIPAA compliant?

No, and Microsoft says so: “using Microsoft services doesn't on its own achieve HIPAA compliance.” The agreement covers Microsoft's side. The practice still owns its risk analysis, access controls, staff training, data policies and the minimum-necessary principle — sending only the patient information each flow actually needs.

The HHS Security Rule guidance (opens in new window) describes the safeguards expected of the practice itself. For every non-Microsoft app a flow touches, our list of security questions to ask any AI vendor is a practical way to check what that vendor will commit to in writing.

What we build, and what we do not claim

Lightray AI is independent of Microsoft: we are not a partner, reseller or affiliate, and there is no government HIPAA certification for software or consultants, so we hold none. What we do is map where patient information flows in each existing flow, set data policies so PHI stays inside covered services, rebuild the flows that cross the line, and document the result for your compliance officer to review. They decide what is acceptable; we build to that decision.

Where to go next

For flow design, licensing and tenant governance outside the HIPAA question, see our Microsoft Power Automate consultant page. If a flow hands off to Zapier, the guide to Zapier and HIPAA explains why that step cannot carry PHI at all. If you are weighing a move off the Microsoft stack, the comparison of n8n vs Power Automate for small business sets out the trade-offs. And for the clinical side of automation — referrals, prior authorisation and claims admin under a BAA — see AI automation for healthcare practices.

Common questions about Power Automate and patient data