Is Slack HIPAA compliant? What a dental or medical office should know
Only on a Slack Enterprise plan with a signed Business Associate Agreement, and only within Slack's conditions: protected health information is limited to messages, files, file names, and private channel or DM names, monitoring with data loss prevention is required, and third-party apps aren't covered. Free and other plans don't qualify. Checked October 12, 2026.
This is general information for dental and medical offices, not legal advice. Vendor terms change, so check the linked pages on the day you decide, and talk with your compliance advisor before patient information goes anywhere.
What Slack's own help page says
Slack publishes its HIPAA conditions in a help article (Slack help). In short:
- Enterprise plan required. You must be on a Slack Enterprise plan and sign a BAA with Slack.
- PHI only in certain places. Messages, uploaded files, file names, and the names of private channels and direct messages. Not in other features.
- Not for patients. Slack may not be used to communicate with patients or their families.
- Monitoring required. You must monitor use with Slack's data loss prevention or an outside DLP provider.
- Not your system of record. Slack says it is not a system of record for PHI.
- Apps excluded. Third-party and Marketplace apps are not covered by Slack's BAA.
What that means for a dental or medical office
Most single-location practices aren't on Slack Enterprise, and DLP monitoring is a real ongoing job. For a typical office on a free or standard plan, Slack is a logistics tool, not a place for patient information. Slack also wasn't built for the operatory: typing a message with gloves on rarely happens, which is why many offices pair chat with a faster signal for "come now" moments.
The rule that keeps most offices out of trouble
Whatever app your team uses for quick coordination, keep it to logistics. "Exam ready, room 3." "Need an assistant in 2." "Lab on line one for Dr. Lee." Signals like these tell the team what to do without saying anything about a patient. Names, dates of birth, diagnoses, and treatment details stay in your practice management or EHR software, which your office already covers with the right agreements.
Write the rule down where new hires will see it. The Signal Plan Builder puts it at the bottom of a printable one-page plan.
Where DOC fits
DOC is built for exactly that kind of logistics signal: an iPhone app with an Apple Watch companion where one tap sends "exam ready" or "need an assistant" to the right person. To be plain about it, DOC is not certified or audited for HIPAA compliance, and during the beta it is not approved for patient information. Beta offices use synthetic data only, and no Business Associate Agreement is in effect (Beta Terms).
Frequently asked questions
Is Slack HIPAA compliant on the free plan?
No. Slack's HIPAA support requires an Enterprise plan and a signed Business Associate Agreement.
Can we put patient names in Slack channel names?
Slack's conditions allow PHI in private channel and DM names under an Enterprise BAA. Public channel names and other features are not covered.
Are Slack integrations covered by the BAA?
No. Slack says third-party and Marketplace apps are not covered by its BAA.
Can we talk to patients over Slack?
No. Slack's HIPAA conditions say it may not be used to communicate with patients or their families.