Is GitHub Copilot HIPAA Compliant? What Microsoft’s Own BAA Excludes (2026)

No. GitHub Copilot is not HIPAA compliant, and — more strikingly — it’s explicitly excluded from Microsoft’s own HIPAA Business Associate Agreement (BAA), even though Microsoft owns GitHub. Microsoft offers a BAA covering Azure, Office 365, Dynamics 365, Microsoft 365 Copilot, and roughly two dozen other in-scope services. GitHub and GitHub Copilot are not on that list. GitHub’s own Data Protection Agreement goes a step further than most tools in this series: it doesn’t just lack a BAA, it contractually prohibits customers from submitting protected health information (PHI) to GitHub at all, absent GitHub’s prior written consent. Copilot Business and Enterprise have genuinely strong security engineering — SOC 2 Type II, ISO 27001, zero retention of prompts and code by default in the IDE — but none of it substitutes for a signed BAA, which does not exist for this product.

---

Writing healthcare code with GitHub Copilot’s help and need a compliant place to run it? HIPAA Vault reviews the architecture behind your Copilot-assisted code, remediates the compliance gaps, and deploys it to a BAA-covered production environment.

Book a Free 15-Minute Consultation →

---

Key Takeaways

• GitHub Copilot is not among Microsoft’s HIPAA BAA in-scope services — a list that explicitly includes Azure, Office 365, Dynamics 365, Windows 365, and Microsoft 365 Copilot, but not GitHub or GitHub Copilot.
• GitHub’s Data Protection Agreement (version October 2025) contains an affirmative prohibition, not just a gap: absent GitHub’s prior written consent, customers “shall not provide GitHub any Personal Data… constituting protected health information governed by… the Health Insurance Portability and Accountability Act of 1996.”
• This exclusion holds even if you buy Copilot Business or Enterprise through Microsoft’s own enterprise agreement — GitHub’s FAQ states directly: “The Microsoft DPA does not apply to GitHub’s online services.” GitHub’s separate DPA governs instead, and it’s a data-protection agreement, not a HIPAA BAA.
• Copilot Business/Enterprise’s security posture is genuinely strong: SOC 2 Type II, ISO 27001:2013 (both now scoped to include Copilot Business/Enterprise), zero retention of inputs/outputs by default for IDE chat, completions, and CLI. None of these certifications are HIPAA or HITRUST.
• Individual Copilot (Free, Pro, Pro+, Max) is materially weaker on privacy than Business/Enterprise: GitHub may use your prompts, suggestions, and code snippets to train AI models unless you manually opt out — the opposite default of the paid team tiers.
• Unlike Cursor, Bolt.new, v0, or Windsurf, Copilot is usually used inside an existing codebase — often one already in production — which means the PHI-exposure question isn’t hypothetical prototype data, it’s whatever a developer’s cursor happens to be sitting next to when they trigger a suggestion.

---

Does Using Copilot Involve PHI?

Copilot is architecturally different from the other tools in this series. Cursor, Bolt.new, v0, and Windsurf are typically used to build a new application from scratch inside a sandbox, then exported. Copilot is most often used inside a codebase a developer already has open — frequently a live, already-in-production healthcare application. That changes where PHI risk actually shows up:

• Inline suggestions and Tab completions — every keystroke in an active file can trigger a request; the “input” GitHub Copilot transmits includes the content of the file you’re editing plus related files in the workspace.
• Chat and Copilot CLI prompts — anything a developer types directly, including pasted stack traces, sample records, or database rows used to debug a real production issue.
• Copilot’s coding agent — operates with access to a repository’s Git contents plus related metadata (issues, pull requests, Actions logs) within a GitHub Actions runner, unless a firewall or MCP configuration further restricts it.
• Local seed/test data referenced in a prompt — a common shortcut when a developer copies a snippet of real patient data into a comment or chat window “just to get Copilot to understand the shape of the problem.”

If none of the above ever contains real patient data, Copilot’s security architecture (encryption in transit and at rest, no training on Business/Enterprise data, default non-retention for IDE interactions) is a reasonable posture for general software development. The moment real PHI enters a prompt, a file Copilot can see, or the agent’s repository context, HIPAA applies — and GitHub’s own contract terms say that shouldn’t happen without GitHub’s prior written consent in the first place.

The “Chat and Copilot CLI prompts” scenario above is exactly the failure mode Joshua Vidals, HIPAA Vault’s cloud engineer, walked through in a HIPAA Vault livestream Q&A on vibe coding — describing the same mechanism with a debugging example that maps directly onto how a developer might use Copilot Chat:

“If you’re working on your application and experiencing a problem — say, ‘Whenever I put Jane Doe’s name in with her phone number and social security number, my application crashes’ — you might feel tempted to copy and paste all that real information, throw it into something like Claude or ChatGPT, and ask why it’s crashing. As soon as you’ve taken that PHI and brought it over, they have that information logged, and they may train their next-generation model on it. Unless you have a plan where they’ve signed a BAA and have zero-retention policies, you need to be really careful about what you’re putting into that prompt box.”

The same logic applies one-for-one to Copilot Chat and Copilot CLI: pasting a real patient record into either to debug a crash is functionally identical to pasting it into a standalone chatbot, and Individual-tier Copilot’s default training behavior means that information can end up shaping a future model unless the user has opted out.

---

GitHub Copilot’s Security Posture vs. What HIPAA Requires

Verified against Microsoft’s HIPAA/HITECH compliance offering page (updated July 29, 2025; page metadata updated June 2, 2026), the GitHub Copilot Trust Center and its full FAQ, the GitHub Enterprise Cloud Trust Center, and GitHub’s Data Protection Agreement (version October 2025), all confirmed July 22, 2026. Vendor terms change — confirm current BAA availability directly with GitHub or Microsoft sales before relying on this for a live HIPAA program.

---

The Part That Actually Surprises People: Microsoft’s Own BAA Excludes Its Own Product

Microsoft has offered HIPAA Business Associate Agreements to enterprise customers for years, and its published list of in-scope cloud services is long: Azure and Azure Government, Azure DevOps Services, Dynamics 365, Microsoft Intune, Microsoft Copilot for Security, Microsoft Defender for Cloud Apps, Office 365 (including Microsoft 365 Copilot and Microsoft 365 Copilot Chat), Power Platform, Windows 365, and several others. GitHub — a Microsoft subsidiary since 2018 — and GitHub Copilot specifically are not on that list.

This isn’t a case of “the vendor hasn’t gotten around to HIPAA yet.” GitHub’s own Trust Center FAQ addresses this directly for customers who buy Copilot Business or Enterprise through Microsoft’s enterprise agreements rather than directly from GitHub:

“Microsoft Privacy & Security Terms incorporate the GitHub DPA and GitHub Privacy Statement. (Note: The Microsoft DPA does not apply to GitHub’s online services.)”

In plain terms: even inside a Microsoft enterprise contract that includes a HIPAA BAA for other Microsoft products, that BAA does not extend to GitHub or GitHub Copilot. A separate agreement — GitHub’s Data Protection Agreement — governs instead, and it is a GDPR/CCPA-oriented data protection agreement, not a HIPAA Business Associate Agreement. The two are not interchangeable, regardless of how similar they sound.

---

GitHub’s DPA Doesn’t Just Skip HIPAA — It Prohibits PHI by Default

Most tools in this series simply don’t mention HIPAA anywhere in their terms, leaving a gap. GitHub’s Data Protection Agreement is more direct. Section 12, titled “CJIS Customer Agreement, HIPAA Business Associate, Biometric Data,” states:

“Except with GitHub’s prior, written, and specific consent, You shall not provide GitHub any Personal Data: … constituting protected health information governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) or by state health or medical privacy laws.”

This sits alongside similar carve-outs for criminal justice data (CJIS) and biometric information — categories GitHub treats as requiring special, separately negotiated handling rather than something covered by its standard terms. For a healthcare development team, the practical read is straightforward: GitHub’s default contract assumes PHI isn’t part of what you send it, and using Copilot (or any GitHub product) with real patient data without GitHub’s specific consent is a contract violation, not just a compliance gray area.

---

What Gil Vidals Says About Vibe Coding Platforms and HIPAA

GitHub Copilot wasn’t one of the four platforms Gil Vidals named directly on the HIPAA Insider Show — that list was Cursor, Replit, Bolt.new, and v0. Copilot is also a different category of tool: an AI pair-programmer embedded in an existing codebase rather than a from-scratch app builder. But the underlying reasoning Gil gives for why coding tools aren’t compliance destinations applies here just as directly:

“I don’t believe these building platforms offer HIPAA compliance. I don’t think that’s their forte.”

On why the AI layer itself can’t close that gap:

“At this juncture, AI is trapped in the virtual world. It does everything inside the computer — it’s digital. To be HIPAA compliant, you have to touch the physical world. The AI doesn’t do that yet. That means you have to have infrastructure that’s HIPAA compliant… and even if that infrastructure is configured, the code itself is probably going to live on a virtual machine, and that virtual machine has to be configured to be HIPAA compliant too. You have to monitor it, scan it, run vulnerability reports, patch it on a weekly or monthly basis.”

Copilot’s case is arguably more consequential than the from-scratch builders in this series: because it’s used daily inside codebases that may already be live, in-production healthcare systems, the “is this a sandbox or is this production” question that other tools force you to ask explicitly is often already answered — badly — before anyone thinks to ask it.

---

What to Do If PHI May Have Touched a Copilot Prompt

Because Copilot is typically used inside an existing project rather than a disposable sandbox, the “migration” framing from earlier articles in this series doesn’t quite fit. The more relevant question is what to do if real PHI ever entered a prompt, a visible file, or the coding agent’s repository context:

1. Determine what was actually exposed. Was it a pasted record, a database row, a stack trace containing patient identifiers, or a comment referencing a real patient? Precision here matters for any required breach analysis.
2. Check your plan and retention settings. Business/Enterprise IDE interactions aren’t retained by default, which limits (but doesn’t eliminate) exposure; Individual plans may retain and even train on that data unless the user opted out.
3. Review your organization’s Copilot policies. Enterprise admins can restrict which models, features, and data-sharing settings are available — confirm these were configured correctly before the incident, not just after.
4. Involve your compliance and legal teams before assuming “no BAA” automatically equals “reportable breach.” Whether an exposure rises to a HIPAA breach depends on the specific data involved and your organization’s risk analysis, not on Copilot’s terms of service alone.
5. Fix the workflow, not just the incident. If developers are routinely testing against real patient data instead of synthetic test data, that’s the underlying process gap — a data governance problem no coding tool setting will solve on its own.
6. Confirm production infrastructure has its own signed BAA. Copilot assisting with code is a separate question from where that code and its data actually run — that’s the layer that requires an executed Business Associate Agreement.

This isn’t a reason to stop using Copilot for everyday development. Asked directly in the same HIPAA Vault livestream Q&A whether developers can still use AI chat tools to help with coding, Joshua Vidals’s answer was straightforward:

“Yes, absolutely. If you’re getting a syntax error or something in your code, or even brainstorming, yes, you can use chat GPT or Claude on their free or basic plans — you just want to avoid putting any kind of protected health information in that prompt box.”

The same applies to Copilot: debugging syntax, brainstorming an approach, or writing boilerplate is fine on any plan. What changes the calculus is exclusively whether real PHI ever enters the prompt, the visible file, or the agent’s repository context — not whether the tool is used at all.

---

Your AI Coding Assistant Is Only One Layer

GitHub Copilot’s engineering is genuinely solid — SOC 2 Type II, ISO 27001, sensible default non-retention for Business/Enterprise, and a public, unusually detailed Trust Center FAQ that most competitors don’t match. None of that changes what has to be true before real patient data touches a production application: the hosting environment underneath needs its own signed BAA, encrypted storage and transmission under that agreement, access controls, audit logging, and a documented risk analysis. As Gil Vidals puts it, HIPAA compliance “is not a one and done” — it’s an ongoing commitment at the infrastructure level, and Microsoft’s decision to exclude its own GitHub subsidiary from its enterprise HIPAA BAA is a reminder that “made by a HIPAA-compliant company” and “covered by that company’s BAA” are not the same claim.

HIPAA Vault has provided that infrastructure layer since 1997, with certifications including NIST 800-53, SOC 2 (AICPA), HITECH Omnibus, and GSA. Whatever tool helped write the code, it still needs a compliant home to run in.

Ready to move a Copilot-assisted healthcare app to a compliant environment? HIPAA Vault runs the review, does the remediation, and deploys you to a BAA-covered environment.

Book a Free 15-Minute Consultation →  |  Talk to a specialist →

---

Questions to Ask Before Using Copilot on Healthcare Code

1. Is any real PHI ever visible to Copilot — in the active file, a related file, a prompt, or the coding agent’s repository context? If yes, stop and route that workflow through a properly governed, BAA-covered environment instead.
2. Are your developers on Individual plans or a Business/Enterprise license? The training-data defaults are opposite between the two, and Individual users must manually opt out.
3. Has your organization confirmed, in writing, that no BAA exists for GitHub Copilot — including if you purchased it through a Microsoft enterprise agreement that includes a BAA for other Microsoft products?
4. Are developers using synthetic or de-identified test data, or copying real production records to debug faster? This is usually the actual point of failure, not the tool itself.
5. Where does the application Copilot is helping you build actually run in production? Confirm that environment — not Copilot — is the one covered by a signed BAA.

---

Frequently Asked Questions

---

Educational content, not legal advice — consult a qualified HIPAA compliance attorney for your organization. Vendor terms reflect Microsoft and GitHub’s published policies as of August 2026; verify current BAA availability before relying on this for a live program.