Best HIPAA compliant messaging apps
7 tools compared. Checked 6 Nov 2026.
Staff chat fills up with patient names quickly. Most popular messaging apps don’t offer a BAA, or only offer one on their top plans.
Where to start
If your clinic has Office 365 Commercial, start with Microsoft Teams, because Microsoft includes its BAA by default for covered entities. Slack needs Enterprise+. Treat the consumer chat apps here as unsafe for patient data until the vendor confirms otherwise in writing.
| Tool | Result | Where the BAA applies |
|---|---|---|
| MMicrosoft Teams | On some plans | Office 365 Commercial and GCC |
| SSlack | On some plans | Enterprise+ only |
| DDiscord | Not stated | No statement about a BAA found |
| SSignal | Not stated | No statement about a BAA found |
| TTelegram | Not stated | No statement about a BAA found |
| WWhatsApp | Not stated | No statement about a BAA found |
| IiMessage | No BAA | Apple’s license bars PHI on iPhone and iPad |
Microsoft Teams
On some plansMicrosoft includes its HIPAA BAA by default through its Data Protection Addendum for covered entity and business associate customers, and lists Teams as in scope for Office 365 Commercial and GCC.
Covered: Microsoft Teams under Office 365 Commercial; Microsoft Teams under Office 365 GCC.
Left out: Copilot web search queries are outside the DPA and BAA.
See the full Microsoft Teams result and proofSlack
On some plansSlack offers a BAA only on its top enterprise tier, and the customer must also adopt Slack’s HIPAA requirements guide and set up monitoring.
Covered: Enterprise+ (pricing page); called Enterprise Grid or Enterprise plan in other Slack pages.
Left out: Communicating with patients, plan members, or their families or employers, and more.
See the full Slack result and proofDiscord
Not statedNo Discord statement about offering or refusing a BAA was found on the pages read.
See the full Discord result and proofSignal
Not statedNo Signal statement about offering or refusing a BAA was found on the pages read.
See the full Signal result and proofTelegram
Not statedNo Telegram statement about offering or refusing a BAA was found on the pages read.
See the full Telegram result and proofNo Meta or WhatsApp statement about signing a BAA was found; WhatsApp’s business policy separately restricts health information where regulations require heightened safeguards.
See the full WhatsApp result and proofiMessage
No BAAApple’s iOS and iPadOS license and its iCloud terms both say HIPAA covered entities and business associates will not use those services to handle PHI, and no Apple BAA for iMessage was found.
See the full iMessage result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.