No (verified 2026-10-20) No BAA is offered on any WhatsApp plan, and the Business Messaging Policy prohibits telemedicine and sending or requesting health-related information. Staff should not send PHI over WhatsApp or WhatsApp Business.
Short answer
WhatsApp does not offer a business associate agreement (BAA) for WhatsApp, WhatsApp Business or the WhatsApp Business Platform. The Business Messaging Policy prohibits telemedicine and sending or requesting health-related information. The Business App terms make no representation that the product is suitable for healthcare entities.
A front-desk text with a lab result, or a group chat where nurses share a wound photo, puts PHI into a product with no BAA behind it. The full comparison is on chanty.health: WhatsApp and HIPAA. Chanty, Inc. publishes this directory and owns Chanty. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| WhatsApp (consumer) | Not available | Not published by the vendor | Not published by the vendor |
| WhatsApp Business App | Not available | Not published by the vendor | Not published by the vendor |
| WhatsApp Business Platform | Not available | Not published by the vendor | Not published by the vendor |
No WhatsApp plan has a BAA path. See the HIPAA glossary (BAA, PHI) for the terms.
What the BAA covers and what it excludes
Covered services: none, because no BAA is offered.
Excluded under the vendor's Business Messaging Policy:
- Telemedicine
- Sending or requesting health-related information
The Business App terms make no representation of suitability for healthcare entities. A developer building patient-facing appointment or results flows on the Business Platform should treat those flows as outside what the vendor permits.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Published controls do not substitute for a BAA. Without one, a control list would not change the verdict.
How to use WhatsApp with PHI
Compliance depends on a signed BAA, configuration and policies. WhatsApp offers none of these for PHI, so the practical steps are about keeping PHI out:
- Keep PHI out of WhatsApp and WhatsApp Business: no patient names with diagnoses, results, photos or appointment reasons.
- Do not use WhatsApp for telemedicine or for sending health information to patients.
- Set a written staff policy on personal messengers, and state which apps are approved for clinical coordination.
- Move clinical coordination (handoffs, on-call questions, referrals) to a tool with a signed BAA.
- Train staff on the policy, and manage devices and offboarding. Personal phones with WhatsApp installed are a common gap when someone leaves.
- Subject any non-PHI use, such as parking or supply logistics with no health details, to your own risk assessment.
Alternatives with a BAA
These tools offer a BAA under conditions. Confirm the current terms with each vendor before relying on them.
- Chanty (conditional): BAA from the Business plan, not on Free. The BAA covers messages, files, voice notes, tasks and Teambook in the team space. Chanty is internal staff communication only, not patient messaging or telehealth, and does not make an organization HIPAA compliant by itself. Chanty, Inc. publishes this directory. See Is Chanty HIPAA compliant?.
- Google Chat (conditional): the BAA is accepted by an admin in the Google Workspace Admin console. See Is Google Workspace HIPAA compliant? (conditional, paid editions).
- Microsoft Teams (conditional): from Teams Essentials.
- Slack (conditional): Enterprise Grid / Enterprise+.
Compare more options in HIPAA-compliant team chat tools and HIPAA-compliant texting apps.
Sources
- WhatsApp Business Messaging Policy — Terms, checked 2026-10-20. "Don’t use WhatsApp for telemedicine or to send or request any health related information"
- WhatsApp Terms for WhatsApp Business App — Terms, checked 2026-10-20. "We make no representations or warranties that our Business App Services meet the needs of entities regulated by laws and regulations with heightened confidentiality requirements for personal data, such as healthcare, financial, or legal services entities."
- WhatsApp Terms for WhatsApp Business Platform — Terms, checked 2026-10-20. "WhatsApp Terms for WhatsApp Business Platform"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. Later updates appear in Recent changes in vendor HIPAA status.
Does WhatsApp sign a BAA?
No. No BAA is offered on WhatsApp, WhatsApp Business or the WhatsApp Business Platform. No plan has a published path to one.
Is WhatsApp Business or the Business Platform HIPAA compliant?
Neither is a product that comes with a BAA. The Business Messaging Policy prohibits telemedicine and sending or requesting health-related information, and the Business App terms make no representation of suitability for healthcare entities. The Business Platform terms are listed as a source, but no policy claim is made from them here.
Can I use WhatsApp for telemedicine or to send health information to patients?
No. The Business Messaging Policy prohibits both telemedicine and sending or requesting health-related information.
Which team chat tools offer a BAA instead?
Chanty (Business plan and above, for internal staff communication), Google Chat through Google Workspace paid editions, Microsoft Teams from Teams Essentials, and Slack on Enterprise Grid / Enterprise+. Each is conditional on the plan and on signing the BAA before PHI is handled.