Is your team chat HIPAA compliant? iMessage, WhatsApp, Slack, Teams, and Google Chat
No app is "HIPAA certified." HHS does not certify products. What matters is whether the vendor will sign a Business Associate Agreement (BAA) and whether your office uses the tool within it. As of October 2026, Microsoft (Teams) and Google (Chat in Workspace) offer BAAs, Slack offers one only on Enterprise plans, and we found no BAA for iMessage or WhatsApp.
If your office already runs on a group text or a chat app, this is the page for you. It is general information, not legal advice. Check the vendor's current terms and talk with your compliance advisor before sending patient information anywhere.
Why the BAA is the question that matters
Under HIPAA, when a vendor creates, receives, maintains, or transmits protected health information (PHI) for your practice, it is generally a business associate, and you need a written agreement with it first (HHS on business associates, 45 CFR 164.502(e) and 164.504(e)). HHS also says it does not endorse private "certifications" of HIPAA compliance (HHS FAQ). So "HIPAA compliant app" really means "a vendor that will sign a BAA, used the way the BAA allows."
App by app (checked October 12, 2026)
| App | BAA offered? | Notes |
|---|---|---|
| Apple iMessage | None found | We found no Apple BAA for Messages. Apple's iCloud terms say covered entities and business associates agree not to use iCloud to handle PHI (iCloud terms). |
| None found | WhatsApp's business terms don't mention HIPAA or business associates. Its Business Messaging Policy restricts sending health information where regulations prohibit it (policy). | |
| Slack | Enterprise plans only | Slack requires an Enterprise plan and a signed BAA, limits PHI to certain features, and excludes third-party apps (Slack help). |
| Microsoft Teams | Yes, for in-scope services | Microsoft offers its BAA through its online services data protection terms. Teams is listed in scope for Office 365 commercial (Microsoft). Confirm your plan. |
| Google Chat | Yes, in Google Workspace | Google Chat is on Google's list of services covered by its Workspace BAA. Customers must accept the BAA before using PHI, and add-ons aren't covered (Google). |
| Plain SMS | Not established | We found no carrier BAA or HHS guidance specific to texting. HHS guidance on email allows unencrypted messages with patients in some cases with reasonable safeguards, but says nothing about texts (HHS FAQ). |
Vendor terms change. If you rely on this table, check the linked pages yourself on the day you decide.
A simpler rule many offices use
Keep patient details in your practice management or EHR software, and use team signals only for the logistics: "exam ready, room 3," "need an assistant," "call holding for Dr. Lee." A signal like that tells the team what to do without saying anything about the patient. Write the rule into your office signal plan so everyone follows it.
Where DOC stands
We'd rather be plain about this. DOC is designed with office-scoped access controls, server-enforced authorization, data minimization, and encrypted cloud infrastructure. It is not certified or audited for HIPAA compliance, and during the beta it is not approved for PHI. Beta offices use synthetic data only, and no Business Associate Agreement is in effect during beta (Beta Terms).
Frequently asked questions
Is iMessage HIPAA compliant?
Apple does not offer a Business Associate Agreement for Messages that we could find, and Apple's iCloud terms ask covered entities not to use iCloud for PHI. Most compliance advisors treat iMessage as not suitable for patient information.
Is WhatsApp HIPAA compliant for a dental office?
We found no BAA from WhatsApp, and its business policy restricts health information where regulations prohibit it. Don't send patient information through WhatsApp.
Is Slack HIPAA compliant?
Only on Slack Enterprise plans with a signed BAA, and only within the features and conditions Slack lists. Other plans are not covered.
Is Microsoft Teams HIPAA compliant?
Microsoft offers a BAA covering in-scope services, and Teams is listed for Office 365 commercial. Confirm your subscription is covered and configure it as Microsoft requires.
Is Google Chat HIPAA compliant?
Google Chat is covered under the Google Workspace BAA once your organization accepts it. Third-party add-ons are not covered.
Is there such a thing as HIPAA certified software?
No. HHS does not certify software or endorse private certifications. Look for a signed Business Associate Agreement and use the tool within its terms.
Is DOC HIPAA compliant?
DOC is not certified or audited for HIPAA compliance and is not approved for PHI during beta. The beta uses synthetic data only.