Is Telegram HIPAA compliant?

Checked 6 Nov 2026 from 2 vendor sources

Not stated

No Telegram statement about offering or refusing a BAA was found on the pages read. That isn’t proof either way. Treat it as unsafe for patient data until the vendor confirms in writing.

What we couldn’t confirm

A missing statement isn’t a refusal. Telegram’s FAQ also warns that it may contain outdated information.

Proof from the vendor

Telegram FAQNo mention of HIPAA or BAAs; default cloud chats use server-client encryption, secret chats are opt-in end-to-end
Telegram Terms of ServiceNo mention of HIPAA, BAAs or health data

This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.