Why This Matters
You've signed a Business Associate Agreement with Microsoft and assume OneDrive is compliant. It's not. The BAA means Microsoft secures the infrastructure, but you manage access controls, sharing policies, device management, and audit trails.
This shared responsibility model often surprises security teams. Microsoft won't stop your staff from creating public "Anyone with the link" URLs or storing files like "Smith_John_HIV_Labs.pdf" on unencrypted personal devices. These misconfigurations are your responsibility, and the Office for Civil Rights (OCR) will hold you accountable.
The HIPAA Security Rule requirements apply fully, regardless of where your data resides. If you're using OneDrive for PHI storage, you need a process to secure the platform before a breach notification becomes inevitable.
What You Need Before Starting
Legal Prerequisite:
- An eligible Microsoft 365 subscription (Business Basic/Standard/Premium, Enterprise E3/E5/F3, or Office 365 Enterprise E1/E3/E5). Consumer and personal accounts don't qualify.
- Confirmation that Microsoft's Online Services Data Protection Addendum (DPA) and HIPAA/HITECH Business Associate Agreement are in effect for your tenant.
Access Requirements:
- Global Administrator credentials for the Microsoft 365 Admin Center
- Security Administrator or Compliance Administrator role for the Microsoft Purview compliance portal
- Azure Active Directory administrator access (if enforcing Conditional Access policies)
Documentation:
- Your organization's risk analysis findings (HIPAA Security Rule § 164.308(a)(1)(ii)(A))
- Role-based access matrix defining which users require PHI access
- Incident response and breach notification procedures
Tools:
- PowerShell (for scripting policy enforcement at scale)
- Microsoft Purview compliance portal (for audit log review)
- Intune or third-party MDM solution (if managing mobile devices)
Step-by-Step Implementation
1. Verify and Document Your BAA
Sign in to the Microsoft 365 Admin Center with Global Admin credentials. Navigate to Billing > Subscriptions and confirm your active plan is eligible.
Download the formal BAA from the Microsoft Service Trust Portal. Search for "HIPAA Business Associate Agreement" and save the PDF to your compliance documentation repository. This document proves Microsoft's commitment to safeguard controls; you'll need it during audits.
2. Enforce Multi-Factor Authentication
Go to Azure Active Directory > Security > Conditional Access. Create a new policy:
- Name: "Require MFA for all users"
- Assignments: All users
- Cloud apps: Office 365
- Grant controls: Require multi-factor authentication
Set the policy to On. This satisfies the HIPAA Security Rule's user authentication requirement (§ 164.312(d)).
3. Disable Public Sharing at the Organization Level
Navigate to SharePoint admin center > Policies > Sharing. Set the OneDrive sharing level to "Only people in your organization" or "Specific people".
Uncheck "Allow guests to share items they don't own" and "Allow site members to share files, folders, and the site" if tighter control is needed.
Under Advanced settings for external sharing, set link expiration to 30 days maximum.
To enforce this via PowerShell across all users:
Connect-SPOService -Url https://yourtenant-admin.sharepoint.com
Set-SPOTenant -SharingCapability ExternalUserSharingOnly
Set-SPOTenant -DefaultSharingLinkType Direct
Set-SPOTenant -RequireAnonymousLinksExpireInDays 30
4. Implement Role-Based Access and Unique User IDs
Audit your Active Directory groups. Create security groups that map to job functions and assign OneDrive folder permissions accordingly.
Disable shared accounts. Every user must have a unique identifier for audit trail integrity (§ 164.312(a)(2)(i)).
Use Azure AD's access reviews to periodically validate that users still require PHI access. Set a recurring review every 90 days for high-privilege groups.
5. Configure Audit Logging and Retention
Go to Microsoft Purview compliance portal > Audit. Turn on unified audit logging if it's not already enabled.
Create an alert policy for sensitive activities:
- Navigate to Policies > Alert policies > New alert policy
- Activity: File downloaded, File accessed, File shared externally
- Users: All users
- Threshold: Trigger when more than 10 events occur in 24 hours
- Recipients: Your security team's email distribution list
Set audit log retention to match your organization's record retention policy (typically 6-7 years for healthcare).
6. Enforce Device Compliance Policies
If staff access OneDrive from mobile devices, configure Intune compliance policies:
- Require device encryption: Yes
- Minimum OS version: iOS 15+ / Android 11+
- Require PIN or biometric: Yes
- Block jailbroken/rooted devices: Yes
Under Conditional Access, create a policy that blocks access to OneDrive unless the device is marked compliant in Intune.
7. Train Staff on File-Naming Conventions
Technical controls can't prevent a user from saving a file as "PatientName_SSN_Diagnosis.docx". Publish a file-naming standard that prohibits PHI in filenames and folder structures.
Example policy:
- Use case numbers or medical record numbers only: "MRN_12345_LabResults_2024.pdf"
- Never include patient names, Social Security numbers, or diagnoses in visible metadata
- Store PHI inside encrypted files, not in the filename itself
Distribute this policy during onboarding and annual refresher training. Document acknowledgment in your training records.
Validation - How to Verify It Works
Test MFA Enforcement: Attempt to sign in from an incognito browser window without completing the second factor. Access should be denied.
Test Sharing Restrictions: As a standard user, try to create an "Anyone with the link" URL for a test file. The option should be grayed out or absent.
Test External Sharing Expiration: Share a file with a colleague using an external link. Wait 30 days and attempt to access the link. It should return an "Access Denied" error.
Review Audit Logs: Go to Purview compliance portal > Audit > Search. Filter for "File shared" activities over the past 7 days. Verify that all sharing events show "Specific people" as the link type, not "Anonymous."
Simulate a Non-Compliant Device: Disable encryption on a test mobile device and attempt to access OneDrive. Conditional Access should block the connection if your Intune policies are correctly applied.
Run these tests quarterly and document the results in your risk management records.
Maintenance / Ongoing Tasks
Weekly:
- Review audit log alerts for anomalous sharing or download activity
- Investigate any external sharing events flagged by your alert policy
Monthly:
- Run a report of all active external sharing links and verify business justification
- Check for new users added to PHI-access security groups; confirm they've completed HIPAA training
Quarterly:
- Conduct Azure AD access reviews for all groups with OneDrive PHI access
- Re-test MFA enforcement, sharing restrictions, and device compliance policies
- Review file-naming convention adherence through spot-checks of recent uploads
Annually:
- Update your risk analysis to reflect changes in OneDrive usage patterns or new threat vectors
- Re-validate that your Microsoft subscription still includes the BAA
- Refresh workforce training on secure file sharing and mobile device policies
After Any Configuration Change:
- Document the change in your policies and procedures
- Re-run your validation tests to confirm controls remain effective
The shared responsibility model means Microsoft secures the platform, but you secure the use of it. These tasks keep your side of that agreement intact.
