Is WhatsApp HIPAA compliant? What a dental or medical office should know
We found no Business Associate Agreement from WhatsApp, its business terms don't mention HIPAA or business associates, and its Business Messaging Policy restricts sending health information where regulations prohibit it. A dental or medical office should not send patient information over WhatsApp. Checked October 12, 2026.
This is general information for dental and medical offices, not legal advice. Vendor terms change, so check the linked pages on the day you decide, and talk with your compliance advisor before patient information goes anywhere.
Why offices end up on WhatsApp
It is free, it works on any phone, and many staff already use it with family. Bilingual teams in particular often run their group chat there.
What WhatsApp's own terms say
- No BAA found. We could not find a WhatsApp or Meta Business Associate Agreement. Neither the WhatsApp Business Solution Terms (last modified January 15, 2026) nor the service-provider terms mention HIPAA, PHI, or business associates.
- Health information is restricted. WhatsApp's Business Messaging Policy says not to use WhatsApp for telemedicine or to send or request health-related information where applicable rules prohibit it (Business Messaging Policy, last updated September 23, 2026).
What that means for a practice
For a HIPAA-covered office, WhatsApp is a tool for logistics at most. Patient names, photos, and clinical details don't belong in it, whether the chat is with staff or with patients.
The rule that keeps most offices out of trouble
Whatever app your team uses for quick coordination, keep it to logistics. "Exam ready, room 3." "Need an assistant in 2." "Lab on line one for Dr. Lee." Signals like these tell the team what to do without saying anything about a patient. Names, dates of birth, diagnoses, and treatment details stay in your practice management or EHR software, which your office already covers with the right agreements.
Write the rule down where new hires will see it. The Signal Plan Builder puts it at the bottom of a printable one-page plan.
Where DOC fits
DOC is built for exactly that kind of logistics signal: an iPhone app with an Apple Watch companion where one tap sends "exam ready" or "need an assistant" to the right person. To be plain about it, DOC is not certified or audited for HIPAA compliance, and during the beta it is not approved for patient information. Beta offices use synthetic data only, and no Business Associate Agreement is in effect (Beta Terms).
Frequently asked questions
Does WhatsApp sign a BAA?
We found no WhatsApp or Meta Business Associate Agreement as of October 12, 2026, and WhatsApp's business terms don't mention HIPAA.
Is WhatsApp Business different?
WhatsApp Business has its own terms, but we found nothing in them offering a BAA, and its Business Messaging Policy restricts health information where regulations prohibit it.
WhatsApp is end-to-end encrypted. Isn't that enough?
Encryption doesn't replace a Business Associate Agreement. Without one, an office has no written assurance from the vendor covering patient information.
Can we message patients on WhatsApp?
Not with health information. WhatsApp's own policy restricts health-related messages where regulations prohibit them. Use a patient communication tool your office covers with a BAA.