Conditional A BAA is available on Chanty's Business and Enterprise plans but not on Free, so PHI must not go into a Free workspace. Verdict date: 2026-10-20.
Disclosure: Chanty, Inc. owns and publishes this directory and lists Chanty as one vendor among others, held to the same evidence standard as every other entry.
Short answer
A BAA is available on the Business and Enterprise plans for the Chanty workspace. Enterprise adds a negotiated MSA. The Free plan has no BAA. The BAA is put in place on request to the Chanty team (book a demo) before patient data enters the workspace.
Chanty is internal team communication for staff, not patient messaging. HIPAA status here is a property of the plan and the signed agreement, not of the product. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not available | Not applicable |
| Business | Available | On request through the Chanty team | Not published by the vendor |
| Enterprise | Available, with a negotiated MSA | On request through the Chanty team | Not published by the vendor |
Minimum seats for a BAA: Not published by the vendor.
Pricing reference, from the pricing page: Business starts at €3 per user per month billed annually (€4 billed monthly). That is the plan price. The vendor does not publish a separate charge for the BAA.
What the BAA covers and what it excludes
Covered services, service by service: Not published by the vendor. The plan-level statement is that a BAA is available on Business and Enterprise for the Chanty workspace. This page does not extend that statement to individual features.
Excluded features: Not published by the vendor. The recorded statements establish one exclusion: the Free plan has no BAA. Nothing else is recorded as excluded, and nothing else is recorded as included beyond the plan-level statement. A privacy officer who needs a particular feature in scope should get that in writing from the Chanty team before PHI touches it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Yes |
| SSO | Yes |
| Data residency | US, EU and APAC data residency and an on-premise option on the Enterprise plan |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Chanty does not describe its messaging as end-to-end encrypted, and this page does not either.
Data residency: Chanty is hosted on Amazon Web Services. Enterprise offers data residency in the US, EU or APAC and an on-premise option. Other plans have no regional commitment, and the default AWS region is not published by the vendor.
How to use Chanty with PHI
The HIPAA glossary defines BAA, PHI and related terms. A front-desk lead, practice manager or IT contractor can work through this list:
- Sign the BAA before any PHI enters the workspace. A pilot on Free does not count.
- Use only Business or Enterprise workspaces for PHI. Keep Free workspaces for non-PHI work.
- Configure roles and permissions so each person sees only the channels and files their job needs.
- Manage user access and offboarding. Remove departing staff and contractors the same day.
- Secure the devices that run the app, including personal phones used for work.
- Set staff policies and training on what may be posted, such as no patient identifiers in channel names.
- Check every third-party tool connected to the workspace for its own BAA. The Chanty BAA does not extend to other vendors' tools.
Compliance depends on the signed BAA, configuration and policies, not on the tool alone.
Alternatives with a BAA
Alphabetical order. Verdicts and plans are as recorded in this directory.
- Google Chat: conditional. Managed through Google Workspace admin settings.
- Google Workspace: conditional. Paid editions. See Is Google Workspace HIPAA compliant?
- Microsoft Teams: conditional. From Teams Essentials.
- Slack: conditional. Enterprise Grid / Enterprise+.
- Zoom: conditional. From Pro. See Is Zoom HIPAA compliant?
Category comparisons: HIPAA-compliant team chat and HIPAA-compliant collaboration tools.
Sources
- Chanty for Healthcare: One Secure Workspace for Team Communication — Vendor page, checked 2026-10-20. "HIPAA compliance and a BAA are included from the Business plan upwards. They are not part of the Free plan, and the Enterprise plan adds a negotiated MSA alongside the BAA."
- Chanty for Healthcare: One Secure Workspace for Team Communication — Vendor page, checked 2026-10-20. "US, EU and APAC data residency, and an on-premise option, on the Enterprise plan."
- Pricing | Chanty — Pricing page, checked 2026-10-20. "HIPAA compliance and BAA"
- Security | Chanty — Trust center, checked 2026-10-20. "Web connections to all Chanty services are via TLS 1.2 and above."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is there a BAA on the Chanty Free plan?
No. The Free plan has no BAA, so PHI should not be stored or discussed in a Free workspace. A BAA is available on Business and Enterprise.
How do I get a signed BAA from Chanty?
Request it through the Chanty team (book a demo) and have it signed before any patient data enters the workspace. Any extra cost or minimum seat count for the BAA is not published by the vendor.
What does the Enterprise plan add to the BAA?
Enterprise includes a negotiated MSA alongside the BAA. Enterprise also offers SAML SSO, SCIM, data residency in the US, EU or APAC, and an on-premise option. These are plan features, not BAA scope statements.
Does Chanty offer US data residency?
Yes, on the Enterprise plan, which offers data residency in the US, EU or APAC. Other plans have no regional commitment. Chanty is hosted on Amazon Web Services, and the default region is not published by the vendor.