Is Telegram HIPAA compliant? BAA by plan, covered services and exclusions

Telegram has not published a business associate agreement (BAA), so there is no basis to send PHI through it. The verdict is unknown, not a confirmed no, and Telegram should stay off the list of approved tools for patient information until the vendor states otherwise in writing.

Is Telegram HIPAA compliant? BAA by plan, covered services and exclusions

This page uses the wording "BAA available on plan X for services Y." For Telegram that reads: no BAA published, no plan named, no services named. Nothing here says Telegram is HIPAA compliant or certified. HIPAA has no product certification, and Telegram makes no such claim. For other tools, see all vendor HIPAA checks.

Short answer

Telegram's Terms of Service and Privacy Policy make no public statement about a BAA, HIPAA or health data. Only Secret Chats are end-to-end encrypted. Ordinary cloud chats are stored encrypted on Telegram's servers.

Without a published BAA, treat Telegram as not approved for PHI. A front-desk group chat that mentions patient names and appointment times, or a clinician sending a wound photo to a colleague, falls under that rule.

Which plans include a BAA

Plan	BAA	How it is obtained	Extra cost
No plan named	Not published by the vendor	Not published by the vendor	Not published by the vendor

No BAA terms appear on the pages reviewed, so no plan can be named, and no plan is listed as excluded either.

What the BAA covers and what it excludes

Covered services: none published.

Excluded features: none published.

The absence of a list is not a statement that any feature is covered. Group chats, channels, voice messages, file sharing and bots all have the same status: no BAA scope is documented.

Security controls the vendor publishes

Control	Published status
Encryption in transit	Not published by the vendor
Encryption at rest	Yes
Audit log	Not published by the vendor
Access controls	Not published by the vendor
SSO	Not published by the vendor
Data residency	Not published by the vendor
SOC 2	Not published by the vendor
HITRUST	Not published by the vendor
ISO 27001	Not published by the vendor

The Privacy Policy says Secret Chats use end-to-end encryption. That sentence does not extend to cloud chats, and it is not a BAA. An evaluator who needs an audit trail, role-based access or a security report has nothing to cite from the vendor.

How to use Telegram with PHI

The safe default is not to. If staff already use Telegram, this checklist covers what the organization is responsible for. See the HIPAA glossary for terms such as BAA and PHI.

1. Do not send PHI through Telegram without a signed BAA.
2. Ask Telegram in writing whether a BAA exists, and file the answer in your vendor inventory.
3. Keep PHI in a tool that has a BAA, covering messages, files and voice notes.
4. Set a written policy on messaging apps. It should say which apps are approved for patient-related content and which are limited to non-PHI logistics.
5. Train staff and manage offboarding. Personal Telegram accounts stay with the person after they leave, so clinic content in them cannot be recalled.
6. Secure devices with screen locks and device management. Messages and downloaded files on personal phones are outside the clinic's control.
7. Do not treat Secret Chats as a workaround. Encryption is not a BAA, and Secret Chats do not change the verdict.

Compliance depends on the signed BAA, configuration and policies, not on the app alone.

Alternatives with a BAA

These team chat tools publish a BAA path. Verdicts are conditional because each depends on the plan, the signed agreement and the configuration. See HIPAA-compliant team chat tools for the category comparison.

Vendor	Verdict	BAA starting plan
Chanty	Conditional	Business
Google Chat	Conditional	Google Workspace (admin-managed; accepted in the Admin console)
Google Workspace	Conditional	Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits)
Microsoft Teams	Conditional	Microsoft Teams Essentials
Slack	Conditional	Enterprise (Enterprise Grid / Enterprise+)

Chanty is published by Chanty, Inc., which also owns this directory. It is listed as one vendor among others. It is internal team communication for staff, not a patient messaging tool, and a BAA alone does not make an organization HIPAA compliant.

Sources

Changes

No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.

Changes and FAQ

No changes recorded since first verification on 2026-10-20. Updates to any vendor appear under recent changes in vendor HIPAA status.

Does Telegram sign a BAA?

No BAA is published for any plan, and the Terms of Service and Privacy Policy do not mention one. Until Telegram confirms otherwise in writing, treat it as unavailable.

Are Telegram messages encrypted?

Cloud chats are stored encrypted on Telegram's servers. Secret Chats use end-to-end encryption, according to the Privacy Policy. The vendor does not publish encryption-in-transit details on the pages reviewed.

What is the difference between Secret Chats and cloud chats for PHI?

Secret Chats are end-to-end encrypted, while cloud chats are stored encrypted on Telegram's servers. For PHI the difference does not settle the question. Neither mode comes with a BAA, an audit log or a documented access-control model, so neither is approved for patient information.

Can staff use Telegram to message about patients?

Not with PHI. Without a published BAA, patient names, diagnoses, appointment details, images and documents should stay in a tool with a signed BAA. Telegram may be acceptable for messages with no PHI, such as a note that a delivery has arrived, if your messaging policy allows it.