Unknown Checked 2026-10-20. No BAA plan is published for GroupMe. It is a consumer service that does not appear among the Microsoft in-scope cloud services covered by the Microsoft HIPAA BAA. See all vendor HIPAA checks for how verdicts are assigned.
Short answer
GroupMe is governed by the Microsoft Services Agreement, the consumer terms. It is not listed among the services in scope for Microsoft's HIPAA BAA. Microsoft publishes no explicit statement that GroupMe is excluded, and none that PHI is prohibited in it. Without a published BAA, the status is unknown rather than "no".
The practical consequence is simple: without a signed BAA, do not put PHI in GroupMe. A clinic whose front desk uses a GroupMe group for shift swaps should keep patient names, appointment details and callback numbers out of it.
Which plans include a BAA
GroupMe has no named plans in the sources reviewed.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| No named plans | No BAA plan published | Not published by the vendor | Not published by the vendor |
Microsoft states that its BAA is available through the Online Services Data Protection Addendum to covered-entity customers, for services on its in-scope list.
What the BAA covers and what it excludes
Covered services for GroupMe: none published.
Excluded features for GroupMe: none published.
Microsoft publishes no BAA terms for GroupMe on the pages checked. The Microsoft Services Agreement names GroupMe among its communication services, and that is the governing document for the service. A BAA for Microsoft Teams, Outlook or another Microsoft service is a separate matter. Nothing published extends it to GroupMe.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" does not mean a control is absent. It means the pages reviewed do not state it, and controls of Microsoft's other products are not carried over to GroupMe.
How to use GroupMe with PHI
Use this as a checklist, not legal advice. Compliance depends on the signed BAA, your configuration and your policies. The HIPAA glossary entries for BAA and PHI define the terms.
- Confirm that a signed BAA covering GroupMe exists before any PHI enters it. None is published today.
- Keep PHI out of GroupMe until that BAA is in place. That includes screenshots of schedules, lab results or patient lists.
- Write a policy naming the approved messengers for staff, and state that GroupMe is not on the list for PHI.
- Move PHI conversations, such as handoffs between a front desk and a billing team, to a tool with a signed BAA.
- Manage user access and offboarding. In a consumer group chat, a departing employee stays in the group until someone removes them.
- Train staff on the risks of personal accounts and personal devices, including who else can see a phone's notifications.
Alternatives with a BAA
Each entry below reports a published BAA path, not a guarantee of compliance. The BAA must be signed and the tool configured before PHI is handled. Order is alphabetical and is not influenced by payment or by Chanty's interest.
Disclosure: Chanty, Inc. publishes this directory. Chanty is listed as one vendor among others.
- Chanty: conditional. HIPAA compliance with a signed BAA is available from the Business plan, covering messages, files, voice notes, tasks and Teambook in the team space. The Free plan has no BAA. AI agents are Enterprise only and need a separate written agreement. Chanty is internal team communication for staff, not a patient-messaging tool. See Is Chanty HIPAA compliant? or compare messaging apps for HIPAA.
- Google Chat: conditional. The BAA is admin-managed and accepted in the Admin console.
- Google Workspace: conditional. It applies to paid editions administered in the Admin console. See Is Google Workspace HIPAA compliant?.
- Microsoft Teams: conditional. Available from Teams Essentials. See Is Microsoft Teams HIPAA compliant?.
- Slack: conditional. Available on Enterprise Grid / Enterprise+. See Is Slack HIPAA compliant?.
The full comparison is in HIPAA-compliant team chat software.
Sources
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act – Microsoft Compliance — Trust center, checked 2026-10-20. "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA. See 'Microsoft in-scope cloud services' on this webpage for the list of cloud services covered by this BAA."
- Microsoft Services Agreement — Terms, checked 2026-10-20. "Services that enable communication between individuals, including but not limited to Skype, Teams, Outlook, and GroupMe"
- GroupMe | Group chat app — Terms, checked 2026-10-20. "Terms"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification. Status updates are listed under recent changes in vendor HIPAA status.
Is GroupMe covered by the Microsoft HIPAA BAA?
GroupMe is not listed among the in-scope services on Microsoft's HIPAA & HITECH page, and no BAA terms are published for it. Microsoft's BAA is offered for services on its in-scope list.
Does Microsoft say GroupMe is excluded or that PHI is prohibited?
No. Microsoft publishes neither statement on the pages reviewed. The status is unknown because GroupMe is governed by the Microsoft Services Agreement and is absent from the in-scope list, with no explicit exclusion.
Can a medical practice use GroupMe for messages containing PHI?
Without a signed BAA, no. None is published for GroupMe, so keep PHI out of it. Use it, if at all, only for messages that contain no patient information.
Which team chat tools offer a BAA instead of GroupMe?
Chanty (from the Business plan), Google Chat and Google Workspace (paid editions), Microsoft Teams (from Teams Essentials) and Slack (Enterprise Grid / Enterprise+) publish BAA paths. Each is conditional on signing the BAA and configuring the tool.