All tools / Video and messaging
S
On some plansIs Slack HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Slack offers a BAA only on its top enterprise tier, and the customer must also adopt Slack’s HIPAA requirements guide and set up monitoring. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Free | Not covered |
| Pro | Not covered |
| Business+ | Not covered |
| Enterprise+ (pricing page); called Enterprise Grid or Enterprise plan in other Slack pages | Covered |
What the BAA leaves out
- Communicating with patients, plan members, or their families or employers
- PHI in any feature other than messages, files, file names, and names of private channels or DMs
- Email to Slack is unavailable in HIPAA organizations
- Third-party and Marketplace apps are not covered by Slack’s BAA
How to get the BAA
Slack’s help article gives no signing procedure and points customers to its contact page.
What the vendor says to do
- Be on an Enterprise plan
- Get the Slack Requirements for HIPAA Entities guide and commit to implementing it
- Sign Slack’s BAA
- Give Slack a list of orgs or workspaces where PHI will be used
- Monitor member use with Slack DLP or an external DLP provider through Discovery APIs
- Use SSO and backup or archival tools
- Keep channels holding PHI private and put controls on shared channels
- Check whether each third-party app needs its own BAA before enabling it
Proof from the vendor
- Slack and HIPAAEnterprise plan required, BAA and guide requirements, DLP monitoring, restrictions, third-party apps not covered
- Slack pricingHIPAA support is marked only for Enterprise+, blank for Free, Pro, Business+
- Configure Enterprise Grid to be HIPAA-compliantSetup steps, list of workspaces, private channels, DLP, SSO, backup
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.