Fitting AI to Purpose: Why No Platform Makes You HIPAA-Compliant by Itself

3 days ago

5 min read

A business owner in a regulated industry recently asked me a question I expect many leaders are asking. His firm had purchased an enterprise license for Claude, encouraged by others, myself included, who have pointed to the strength of its enterprise data protections. He also hoped that the vendor's HIPAA protections would extend to his firm. Then a peer-group session on cybersecurity left him uneasy about connecting AI to his email and to files containing protected health information. Several colleagues offered what sounded like a sensible fallback: stay with Microsoft Copilot, because it must be safer.

That answer deserves examination, because it rests on an assumption that does not survive contact with the documentation. HIPAA compliance cannot be bought with a license. It is the product of fitting a tool to the work it will do, configuring it for that work, and governing how people use it. This holds for Anthropic's Claude, for Microsoft Copilot, and for any platform that follows them.

What a Business Associate Agreement actually does

When a firm that handles protected health information (PHI) uses an AI vendor, that vendor becomes a subcontractor under HIPAA and needs a Business Associate Agreement (BAA). The BAA assigns legal responsibility for safeguarding the data. It does not configure the firm's account, train its staff, perform its risk analysis, or decide which tasks belong in which tool. Those obligations stay with the firm.

Both major vendors offer a BAA, and both draw a boundary around what it covers.

For Claude Enterprise, coverage begins only after the organization's Primary Owner enables the HIPAA-ready configuration and accepts Anthropic's BAA. Once that is done, chat, Projects, file work, research, and web search are covered. Cowork, the Claude in Chrome extension, and any data sent to outside services through connectors, including the Microsoft 365 connector, are not.

For Microsoft 365 Copilot, Microsoft's BAA comes by default through its Data Protection Addendum, but only for services on its covered list. Microsoft states plainly that web search queries generated by Copilot fall outside the BAA. Since January 2026, Microsoft has also enabled Anthropic's Claude models inside Copilot by default for most US commercial tenants, without publishing a statement that its HIPAA agreement covers that processing. A separate option, "Anthropic models with Data Retention," sits outside Microsoft's terms entirely. As of June 2026, Microsoft's own Purview documentation listed data loss prevention as not yet supported for Copilot Cowork.

Neither vendor's agreement covers everything its product can do, and the uncovered features are often the most capable ones.

The risk most people are not watching

The concern most leaders voice is a breach of the vendor's servers. The risk the research record shows more often is subtler: an AI agent connected to an inbox or shared drive reads everything that arrives, and a crafted email or document can carry hidden instructions telling it to find and send out sensitive data. This is called prompt injection, and it has been demonstrated against both platforms. Examples include EchoLeak (2025) and SearchLeak (2026) in Microsoft 365 Copilot, file-exfiltration research against Copilot Cowork (May 2026), and similar research against Claude's Cowork (January 2026). The vendors have fixed specific flaws. The category of risk remains wherever an agent acts on content it did not author, with the permissions of the person who launched it.

A second, quieter risk follows from the same design. On both platforms, the AI can reach whatever the signed-in user can reach. A shared drive with loose permissions becomes, through AI, a very efficient way to surface information people were never meant to see.

Sorting the work by data

The practical way through is to classify the work by what data it touches before deciding where it runs. I recently did this for an employee benefits consultancy. I took 48 routine tasks across sales, renewals, enrollment, claims advocacy, compliance, HR and payroll, Medicare, and agency operations, and sorted them into four lanes:

Full suite. No individual health or sensitive personal data. Marketing, proposals, plan-level comparisons, and template documents fall here. About half the tasks did.
Full suite after de-identification. Aggregate or de-identified data that meets HIPAA's Safe Harbor standard. Carrier claims summaries need checking, because "summary health information" may retain five-digit ZIP codes and so still count as PHI.
HIPAA-covered features only. Identified PHI, such as large-claim reports, enrollment reconciliation, and claim appeals. Sensitive personal data outside HIPAA belongs here too. FMLA files held by an employer, for instance, are employment records rather than PHI, yet remain protected under ADA confidentiality rules and, in Florida, the Florida Information Protection Act.
Decide first. Mixed or unknown sources, such as a whole mailbox, along with systems of record and breach response, call for counsel or a deliberate design decision before any AI touches them.

The line between lanes followed the data, not the department. Sales and marketing sat entirely in the first lane, claims advocacy mostly in the third, and renewal work moved between them depending on whether a given file named individuals.

Testing the claim that Copilot is safer

When I applied the same classification to Microsoft 365 Copilot, 47 of the 48 tasks landed in the same lane. One task favored Copilot: triaging a shared mailbox, because the mail never leaves the firm's Microsoft environment and needs no third-party connector. One favored Claude: comparing a client's prescriptions against available plans, because that work depends on web lookups, and Claude's web search is covered while Copilot's is not.

The claim that Copilot is safer, then, is true for some tasks and unsupported as a general rule. The useful question is not which platform is safer, but which platform is safer for which task. Asked that way, the two platforms come out nearly level, and what separates a defensible deployment from a risky one is the discipline the firm brings to it.

Six safeguards that apply on any platform

Whatever the platform, the same safeguards do most of the work:

Confirm the agreement and its scope. Know which services and features your BAA covers, and record the confirmation.
Block consumer and personal versions. Free and individual plans, consumer Copilot, and personal accounts sit outside business agreements.
Restrict uncovered features for staff who handle PHI. On Claude, that means agent and connector features; on Copilot, web grounding, third-party plugins, and retention-based model options. Check how your platform's role controls apply to administrators, who may not be restricted by them.
Review permissions before connecting AI to mail and files. The AI will see what each user can see.
Update the risk analysis, training, and incident response plan to cover the platform and the prompt-injection risk.
Review vendor terms each quarter. Coverage lists on both platforms changed several times this year.

The decision belongs to the firm

The leaders I work with do not need a verdict on which vendor is good. They need a way to reason about fit. An AI platform is closer to a set of instruments than a single tool, and each instrument has a proper use, a proper setting, and a proper operator. A firm that classifies its work, matches each task to the right instrument, and governs its use can operate defensibly on either platform. A firm that relies on the brand name, whichever brand it chooses, has not yet done the work that compliance requires.

Disclosure: This article was prepared by Severin Sorensen, ePraxis LLC, with research and drafting by AI (Anthropic's Claude, cross-checked with ChatGPT, Gemini, Grok, Perplexity, and Microsoft Copilot) and verified against the vendor and government sources below. AI-assisted research may contain mistakes. This article is informational and is not legal, compliance, or cybersecurity advice; organizations should confirm their obligations with legal counsel.