All tools / Video and messaging
I
No BAAIs iMessage HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Apple’s iOS and iPadOS license and its iCloud terms both say HIPAA covered entities and business associates will not use those services to handle PHI, and no Apple BAA for iMessage was found. Based on that, don’t use it with patient data.
| Plan or product | BAA |
|---|---|
| iMessage on iPhone and iPad under Apple’s software license | Not covered |
| Messages stored or backed up through iCloud | Not covered |
What we couldn’t confirm
Apple’s license doesn’t name iMessage. Applying it here rests on Messages being part of Apple’s software. We didn’t verify the Mac license.
Proof from the vendor
- Apple iOS 27 and iPadOS 27 Software License AgreementSection 10(b) bars covered entities and business associates from using the software or services for PHI; Section 17 names Messages as a system service
- iCloud Terms and ConditionsSection I.C bars covered entities and business associates from using iCloud for PHI (revised Sept 14, 2026); backups may include messages
- Apple’s HIPAA Covered Services (Health app Share with Provider)Apple’s covered services list is limited to Share with Provider and does not mention iMessage
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.