Gap #13 in hipaa.md marked resolved. Same update in hipaa-caregiver-controls.md and m365.md. Confirmed 2026-05-14: no separate HIPAA BAA acceptance exists or is required for M365 Business plan tenants under the Microsoft Customer Agreement. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>