Conditional Slack offers a BAA on Enterprise (Enterprise Grid / Enterprise+) only, and the main exclusion is communication with patients, plan members, or their families or employers. Last verified 2026-10-19. This card is one of the All vendor HIPAA checks and reports Slack's published terms without auditing them.
Short answer
Slack's BAA is available on the Enterprise plan for messages and files. Slack's own materials list DLP, SSO and backup/archival tooling as other tools a customer needs. Free, Pro and Business+ are excluded, and third-party apps are not covered.
Slack AI runs inside Slack's trust boundary, but no Slack page we reviewed states explicitly whether PHI is covered for AI features. Treat AI features as unconfirmed until Slack confirms in writing. See the HIPAA glossary: BAA and PHI for the terms used here.
This page says "BAA available on plan X for services Y." It does not say Slack is certified or compliant as a product property. Whether a deployment meets HIPAA depends on the signed BAA, configuration and policies.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Enterprise (Grid / Enterprise+) | Available | Contact Slack sales, commit to Slack's Requirements for HIPAA Entities guide, sign the BAA, and give Slack the list of orgs or workspaces where PHI will be used | Not published by the vendor |
| Free | Not available | Not applicable | Not applicable |
| Pro | Not available | Not applicable | Not applicable |
| Business+ | Not available | Not applicable | Not applicable |
Minimum seats for the Enterprise BAA are not published by the vendor. No Enterprise price appears on this page.
What the BAA covers and what it excludes
Covered, per Slack's HIPAA help article:
- Messages
- Files
- File names
- Private channel and DM names
Excluded or outside the BAA:
- Communication with patients, plan members, or their families or employers.
- PHI placed in other Slack features that are not on the covered list.
- Third-party and Marketplace apps. Slack signs no BAA for them.
- Use of Slack as a system of record, such as a designated record set.
Slack's Customer-Specific Supplement also states that Slack is not a Business Associate unless the customer's contract says otherwise. The signed BAA is what changes that.
A clinic example: a billing team can discuss a claim in a private Enterprise channel, and the message and attached file fall within the covered list. A front-desk message to a patient about an appointment falls under the patient-communication exclusion. A note pushed into a third-party app from the same channel is outside the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Support for the audit log row, from Slack's Enterprise Grid configuration page:.
"Not published by the vendor" means the sources we reviewed do not state the item. It does not mean Slack lacks it. Ask Slack directly for anything your risk assessment needs.
How to use Slack with PHI
Slack's published terms leave these steps to the customer:
- Confirm the organization is on Enterprise (Grid / Enterprise+). No other plan qualifies.
- Sign the BAA and give Slack the list of orgs or workspaces where PHI will be used.
- Follow Slack's Requirements for HIPAA Entities guide.
- Configure DLP, SSO and backup/archival tooling, which Slack lists as other tools needed.
- Keep PHI out of third-party apps and out of features not on the covered list.
- Do not use Slack to communicate with patients or as a system of record.
- Decide on AI features only after written confirmation from Slack.
Compliance depends on the signed BAA, configuration and policies, not on the product alone.
Alternatives with a BAA
These are other messaging and collaboration vendors. Check each vendor's own page for the current BAA terms before relying on it.
- Chanty: conditional. A signed BAA is included on the Business and Enterprise plans and covers messages, files, voice notes, tasks and Teambook. The Free plan has no BAA. AI agents are Enterprise only and need a separate written agreement. Third-party integrations are not covered by Chanty's BAA. Chanty is internal staff communication, not patient messaging. Chanty, Inc. publishes this directory, so this is a disclosed vendor entry among others, with no ranking claim. A deeper Slack-versus-Chanty comparison is on chanty.health.
- Google Chat and Microsoft Teams: see the category tables below for the current status of each.
- Google Workspace: Google Workspace HIPAA status
- Zoom: Zoom HIPAA status
For side-by-side tables, see HIPAA-compliant team chat tools and HIPAA-compliant collaboration tools.
Sources
- Slack and HIPAA — Help article, checked 2026-10-19. "You must be using a Slack Enterprise plan."
- Slack and HIPAA — Help article, checked 2026-10-19. "You must execute a Business Associate Agreement."
- Slack and HIPAA — Help article, checked 2026-10-19. "You may not use Slack to communicate with patients, plan members, or their families or employers."
- Slack and HIPAA — Help article, checked 2026-10-19. "Slack does not have a business associate agreement with any third-party application providers"
- Configure Enterprise Grid to be HIPAA-compliant — Vendor page, checked 2026-10-19. "Other tools you will need: DLP solution, SSO solution, backup/archival"
- Configure Enterprise Grid to be HIPAA-compliant — Vendor page, checked 2026-10-19. "Slack AI is built within Slack’s trust boundary and respects user visibility."
- Configure Enterprise Grid to be HIPAA-compliant — Vendor page, checked 2026-10-19. "Download logs of activity within your Slack workspaces"
- Customer-Specific Supplement — Terms, checked 2026-10-19. "Unless as otherwise set forth in Customer's Contract, Customer acknowledges that Slack is not a “Business Associate”"
- Slack pricing — Pricing page, checked 2026-10-19. "Slack can be configured to support protected health information (PHI) in files and message content."
- Security for AI features in Slack — Help article, checked 2026-10-19. "Customer data never leaves Slack-controlled infrastructure and is never used to train large language models (LLMs)."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status for updates across vendors.
FAQ
Does Slack sign a BAA on the Free, Pro or Business+ plan?
No. Slack's BAA is available on Enterprise (Grid / Enterprise+) only. Customers must contact Slack sales, commit to the Requirements for HIPAA Entities guide, and sign the BAA.
Can I use Slack to communicate with patients?
No. Communication with patients, plan members, or their families or employers is the main exclusion. The BAA also does not make Slack a system of record.
Are third-party and Marketplace apps covered by Slack's BAA?
No. Slack signs no BAA for third-party apps, so each app that would touch PHI needs its own agreement with that app's vendor. Otherwise keep PHI out of it.
Does Slack's BAA cover Slack AI features?
Not confirmed. Slack's security article places AI features inside Slack's trust boundary, but no reviewed page states PHI coverage for them. Get written confirmation from Slack before using AI features with PHI.