Is iMessage HIPAA compliant? What a dental or medical office should know
We found no Business Associate Agreement from Apple for Messages, and Apple's iCloud terms ask HIPAA covered entities and business associates not to use iCloud to handle protected health information. For a dental or medical office, treat iMessage as fine for logistics ("exam ready, room 3") and not for patient information. Checked October 12, 2026.
This is general information for dental and medical offices, not legal advice. Vendor terms change, so check the linked pages on the day you decide, and talk with your compliance advisor before patient information goes anywhere.
Why iMessage is the default in so many offices
Almost every iPhone in the building already has it, group threads take seconds to set up, and messages arrive fast. That convenience is exactly why "can we just use iMessage?" comes up in nearly every practice.
What Apple's own terms say
- No BAA found. We could not find an Apple page offering a Business Associate Agreement for Messages, iMessage, or iCloud.
- The iCloud terms address HIPAA directly. In their section on limits of use, Apple's iCloud terms say that if you are a covered entity or business associate, you agree not to use iCloud to create, receive, maintain, or transmit protected health information (Apple iCloud terms, last revised September 14, 2026).
- Backups can include messages. The same terms note that iCloud backups can include your messages. Whether the terms reach iMessage delivery itself, apart from iCloud, Apple doesn't say.
What that means for a practice
Without a BAA, an office has no written assurance from Apple covering patient information in Messages. Most compliance advisors read that as: don't put PHI in iMessage. That includes photos of radiographs, intraoral photos, lab slips, and screenshots of the schedule.
The rule that keeps most offices out of trouble
Whatever app your team uses for quick coordination, keep it to logistics. "Exam ready, room 3." "Need an assistant in 2." "Lab on line one for Dr. Lee." Signals like these tell the team what to do without saying anything about a patient. Names, dates of birth, diagnoses, and treatment details stay in your practice management or EHR software, which your office already covers with the right agreements.
Write the rule down where new hires will see it. The Signal Plan Builder puts it at the bottom of a printable one-page plan.
Where DOC fits
DOC is built for exactly that kind of logistics signal: an iPhone app with an Apple Watch companion where one tap sends "exam ready" or "need an assistant" to the right person. To be plain about it, DOC is not certified or audited for HIPAA compliance, and during the beta it is not approved for patient information. Beta offices use synthetic data only, and no Business Associate Agreement is in effect (Beta Terms).
Frequently asked questions
Does Apple sign a BAA for iMessage?
We found no Apple Business Associate Agreement for Messages, iMessage, or iCloud as of October 12, 2026.
Is iMessage encrypted? Doesn't that make it HIPAA compliant?
Encryption helps protect data, but HIPAA compliance for a vendor relationship turns on having a Business Associate Agreement and using the tool within it. Encryption alone doesn't replace the agreement.
Can my team text each other about the schedule on iMessage?
Logistics without patient details, like room numbers and tasks, carry far less risk. Patient names, dates of birth, and clinical details should stay in your practice software.
Can I send an intraoral photo to the dentist over iMessage?
Not if you want to stay within Apple's iCloud terms and your HIPAA obligations. Use your imaging or practice software, which your office covers with the right agreements.