Data governance and protection controls implemented under Microsoft 365 Business Premium licensing — Microsoft Purview as the enforcement layer, HIPAA/HITECH as the compliance framework. All controls designed within documented licensing boundaries with compensating controls where Purview P2 is unavailable.

Compliance Posture

Microsoft Purview — DLP

• DLP policies deployed across Exchange, SharePoint, OneDrive, and Teams
• ePHI pattern detection using built-in HIPAA sensitive information types
• Policy tips enabled for end-user awareness at point of violation
• Audit mode → enforce mode progression documented per policy
• Endpoint DLP scoped to Intune-managed Windows 11 devices

Sensitivity Labeling

• Label taxonomy aligned to HIPAA data classification requirements
• Labels: Internal, PHI, Confidential — applied to documents and email
• Auto-labeling configured for known ePHI patterns across M365 surfaces
• Label inheritance enforced on containers (SharePoint sites, Teams)

Retention Governance