Unknown Signal publishes no BAA for any plan, so there is no covered scope to state. Verdict date: 2026-10-20. See All vendor HIPAA checks for other tools.
Signal's legal page says calls and messages are always encrypted. It says nothing about a BAA, HIPAA or health data. Encryption and a BAA are separate questions, and only a BAA answers whether a vendor accepts responsibility for PHI.
Short answer
The Terms of Service and Privacy Policy checked make no public statement about a BAA or HIPAA. Signal states that calls and messages are always end-to-end encrypted, but the statement does not mention health data. Without a published BAA, the HIPAA status cannot be confirmed. Do not infer it from the encryption claim.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor |
Signal publishes no plan structure or BAA terms in the sources checked. For the definitions of BAA and PHI used on this site, see the HIPAA glossary: BAA and PHI.
What the BAA covers and what it excludes
- Covered services: none published. No BAA terms appear on the pages checked.
- Excluded features: none published.
The main exclusion is the absence of a published BAA itself. A clinic cannot point to a covered service, a covered plan or a list of exclusions, because none exist in the vendor's published material.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The legal page quote concerns encrypted calls and messages. It is not a BAA statement and does not describe how the vendor handles regulated health data.
How to use Signal with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the app alone. Until a BAA exists, use this checklist:
- Ask the vendor in writing whether a BAA is offered, and keep the reply on file before any PHI is sent.
- Keep PHI out of Signal until then. That includes appointment details a front-desk employee might text, and photos a nurse might share from a personal phone.
- Set an internal policy on what may be sent in any messaging app, and what must stay in the EHR or another system under a BAA.
- Manage devices and staff access. Decide which phones may run the app, and who is responsible for lost or replaced devices.
- Handle offboarding. Define how a departing employee's access to clinic conversations ends.
- Train staff on what counts as PHI in a chat message, a voice note or an attachment.
- Document the decision in your vendor inventory, with the verdict and the source.
Alternatives with a BAA
These tools publish BAA terms for specific plans or editions. The list is not a ranking. See HIPAA-compliant team chat tools for the category view.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Chanty | Conditional | Business |
| Google Chat | Conditional | Google Workspace (admin-managed; accepted in the Admin console) |
| Google Workspace | Conditional | Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits) |
| Microsoft Teams | Conditional | Microsoft Teams Essentials |
| Slack | Conditional | Enterprise (Enterprise Grid / Enterprise+) |
Chanty is internal team communication for staff, not patient messaging. Its BAA covers data in the team space on Business and Enterprise, and is not available on Free. See the Chanty messaging apps comparison for the full side-by-side. Check each vendor's own BAA page before relying on a plan. Pages for Slack and Microsoft Teams give the plan wording and exclusions.
Sources
- Signal >> Terms of Service & Privacy Policy — Terms, checked 2026-10-20. "Your calls and messages are always encrypted, so they can never be shared or viewed by anyone but yourself"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. See Recent changes in vendor HIPAA status for updates across vendors.
Does Signal offer a BAA?
No BAA is published on the Terms of Service and Privacy Policy page checked, so the verdict is unknown. The page does not say that Signal offers a BAA or that it refuses one.
Is end-to-end encryption enough to use a messaging app with PHI?
No. Encryption protects content in transit, and Signal's legal page states that calls and messages are always encrypted. A BAA is a separate agreement that sets the vendor's obligations for PHI. Encryption does not substitute for it.
Can a clinic send PHI over Signal today?
Not on the basis of what Signal publishes. Without a BAA, the status cannot be confirmed. Keep PHI out of the app until the vendor confirms in writing whether a BAA is available.
Which team chat tools publish a BAA?
Chanty (from the Business plan), Google Chat and Google Workspace (paid editions, admin-managed), Microsoft Teams (from Teams Essentials) and Slack (Enterprise Grid / Enterprise+) each publish BAA terms for specific plans. Confirm the current wording on each vendor's page before use.