No. Staff should not send PHI in iMessage, because Apple offers no BAA for it and its iCloud terms prohibit covered entities and business associates from using the service for PHI.
No No BAA available on any plan; the main exclusion is that Apple's iCloud terms prohibit PHI. Last verified 2026-10-20.
Short answer
Apple offers no BAA for iMessage. The iCloud terms, which cover Messages in iCloud, prohibit covered entities and business associates from using the service to create, receive, maintain or transmit PHI, or in any manner that would make Apple a business associate. Encryption does not change this verdict. A BAA is a contract, and Apple does not offer one for this service.
The same question for other tools is answered on All vendor HIPAA checks.
Which plans include a BAA
Apple publishes no plans or tiers for iMessage with different HIPAA terms, so one row covers all use.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All iMessage / iCloud use | No | Not available | Not published by the vendor |
What the BAA covers and what it excludes
Covered services: none. No services are covered because no BAA is offered.
Excluded:
- Protected health information (iCloud terms, Limitations on Use)
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Apple's Messages & Privacy page states that iMessage is end-to-end encrypted. That is a security property. A BAA is a separate legal requirement, and Apple does not offer one here.
How to use iMessage with PHI
You should not use it with PHI. Because compliance depends on the signed BAA, configuration and policies, and no BAA exists for iMessage, the checklist below is about keeping PHI out of it.
- Do not send PHI in iMessage. That includes patient names with appointment details, lab results, and photos of wounds or insurance cards.
- Set a written staff policy naming which channels are approved for patient-related messages and which are not.
- Train staff and address personal devices. Front-desk and clinical staff often text from personal iPhones out of habit, so the policy should say what to do when a message arrives there.
- Move PHI conversations to a messaging tool with a signed BAA, and sign the BAA before anyone sends PHI.
- Manage access and offboarding in that tool. Remove departing staff the same day, which is hard to do with personal phone numbers.
- Document the decision in your vendor inventory, with the source and the date you checked it.
For definitions of BAA and PHI, see the HIPAA glossary. For policy and rollout help, see the HIPAA guides.
Alternatives with a BAA
These tools offer a BAA under stated conditions. All are "conditional" because a BAA must be signed and the tool configured correctly. The order does not reflect payment or Chanty's interest. Browse more in HIPAA-compliant team chat tools and HIPAA-compliant texting apps.
- Chanty (conditional): BAA from the Business plan, covering data in the team space (messages, files, voice notes, tasks and Teambook). It is internal team communication for staff, not patient messaging. AI agents are Enterprise only and need a separate written agreement. Chanty is published by Chanty, Inc., which also owns this directory.
- Google Chat (conditional): covered through Google Workspace and managed by the admin.
- Google Workspace (conditional): BAA on paid editions, accepted through the Admin console. See Is Google Workspace HIPAA compliant?
- Microsoft Teams (conditional): BAA through Teams Essentials.
- Slack (conditional): Enterprise Grid / Enterprise+.
Sources
- Legal – iCloud – Apple — Terms, checked 2026-10-20. "If you are a covered entity, business associate or representative of a covered entity or business associate (as those terms are defined at 45 C.F.R § 160.103), You agree that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information” (as such term is defined at 45 C.F.R § 160.103) or use the Service in…"
- Messages & Privacy – Apple — Vendor page, checked 2026-10-20. "iMessage is end-to-end encrypted."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is iMessage HIPAA compliant if it is end-to-end encrypted?
No. Apple states that iMessage is end-to-end encrypted, but encryption does not substitute for a BAA. Apple offers no BAA for iMessage, and the iCloud terms prohibit covered entities and business associates from using the service for PHI.
Does Apple sign a BAA for iMessage or iCloud?
No BAA is available for iMessage or iCloud on any plan. The iCloud terms, which cover Messages in iCloud, exclude PHI under Limitations on Use.
Can a clinic use iMessage to share PHI with colleagues?
No. The same terms apply to messages between staff. A clinic should move PHI conversations to a tool with a signed BAA and set a written policy so staff do not default to texting from personal iPhones.
Which team messaging tools offer a BAA instead?
Chanty (Business plan and above, for staff communication), Google Chat and Google Workspace (paid editions), Microsoft Teams (Teams Essentials) and Slack (Enterprise Grid / Enterprise+) each offer a BAA under conditions. Verify the current terms and sign the BAA before use.