Of the 13 team chat apps compared, six have a BAA route on a business plan: Chanty, Google Chat, Google Workspace, Microsoft Teams, Slack and Zoom. Two (iMessage and WhatsApp) get a "no". Five (Discord, GroupMe, Signal, Telegram and Webex) are "unknown" because no vendor BAA source is listed. The table below shows which plan carries the BAA, how it is put in place, and what each vendor publishes about controls.
- Quick answer: which team chat apps can carry PHI under a BAA
- Comparison table: BAA by plan, how to get it, and key controls
- What counts as a HIPAA-compliant team chat tool
- How each vendor's BAA is obtained, and where it stops
- Tools that are ruled out or unconfirmed
- Archiving, audit trails and communications compliance: what a BAA does not give you
- How to evaluate a team chat vendor before PHI goes in
- Methodology, sources and update policy
- FAQ
Quick answer: which team chat apps can carry PHI under a BAA
- Conditional (BAA available on a specific plan or setup): Chanty, Google Chat, Google Workspace, Microsoft Teams, Slack, Zoom.
- Unknown (no vendor BAA source listed): Discord, GroupMe, Signal, Telegram, Webex.
- No: iMessage, WhatsApp.
The verdict scale has four values: yes, conditional, no, unknown. A verdict needs the vendor's own BAA or trust page and a verification date. With no source, the verdict is "unknown". No chat app here earns a plain "yes", because every BAA depends on the plan, the setup or the services in scope.
Chanty, Inc. publishes this directory. Chanty is listed as one vendor among 13 and ranked on the same criteria as the rest.
This page covers one category. For others, see HIPAA-compliant software by category.
Comparison table: BAA by plan, how to get it, and key controls
The table reports published vendor terms, not audits. Each vendor has its own sourced page in the Is it HIPAA compliant? All vendors hub. Rows are ordered by verdict, then alphabetically. Payment and Chanty's interest play no part in the order.
A dash (—) means the vendor does not publish the value.
| Vendor | Verdict | BAA from plan | How the BAA is put in place | Starting price | Encryption at rest | Audit log | SSO | SOC 2 | Data residency |
|---|---|---|---|---|---|---|---|---|---|
| Chanty | Conditional | Business | Ask the Chanty team (book a demo) to put a BAA in place before patient data goes into the workspace | €3 user/month (Business, billed annually; €4 billed monthly) | Yes | — | Yes | — | US, EU and APAC residency and an on-premise option on Enterprise |
| Google Chat | Conditional | Google Workspace (admin-managed; accepted in the Admin console) | Super administrator accepts the HIPAA BAA electronically in the Admin console (Account settings > Legal and compliance) | €6.80 user/month (Business Starter, annual commitment; €3.40 intro price for the first 3 months) | — | — | — | — | — |
| Google Workspace | Conditional | Paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits) | Electronic acceptance by a super administrator in the Admin console | €6.80/user/month (Business Starter, annual commitment) | — | — | — | — | — |
| Microsoft Teams | Conditional | Microsoft Teams Essentials | Included by default in the Microsoft Products and Services Data Protection Addendum (DPA); no separate signature | $4.00/user/month (Teams Essentials, paid yearly) | Yes | — | — | Yes | Data resides in the region associated with the Microsoft 365 or Office 365 organization |
| Slack | Conditional | Enterprise (Enterprise Grid / Enterprise+) | Contact Slack sales, commit to Slack's HIPAA guide for entities, sign the BAA, list the workspaces where PHI will be used | — | — | Yes | Yes | — | — |
| Zoom | Conditional | Pro | Pro: self-accept on the healthcare Plans & Pricing page; Business, Business Plus, Enterprise: contact Sales | $14.16/user/month (Pro, billed annually) | — | — | — | Yes | — |
| Discord | Unknown | — | — | — | — | — | — | — | — |
| GroupMe | Unknown | — | — | — | — | — | — | — | — |
| Signal | Unknown | — | — | — | — | — | — | — | — |
| Telegram | Unknown | — | — | — | Yes | — | — | — | — |
| Webex | Unknown | — | — | — | Yes | — | Yes | Yes | — |
| iMessage | No | — | — | — | — | — | — | — | — |
| No | — | — | — | — | — | — | — | — |
Price caveats:
- Prices mix EUR and USD, because vendors list prices in different currencies by region.
- Annual and monthly billing differ. Chanty's €3 is Business billed annually, and Teams, Zoom and Google quote annual terms.
- Google's €3.40 is a three-month intro price, not the ongoing rate.
- Slack's row shows a dash for price. Its BAA plan requires contacting sales.
- Chanty's SOC 2 cell is a dash. Chanty lists SOC 2 Type II, with the report available on request, but does not publish the report's scope or date.
What counts as a HIPAA-compliant team chat tool
Staff chat carries PHI whenever a patient is discussed. A front-desk message like "Mrs. Alvarez's referral for the cardiology consult didn't come through" is PHI, even with no EHR behind the chat. If the tool stores or transmits that message, the vendor is acting as a business associate.
Three conditions apply:
- The vendor signs a BAA that covers your plan. What a business associate agreement covers is worth reading before you shop.
- The plan includes the controls you need: retention, export and admin roles.
- You stay inside the services the BAA names.
Consumer messengers do not sign a BAA. Several business tools reserve the BAA for enterprise tiers, as Slack does.
A BAA alone does not make an organization compliant. Configuration, access management, device policy and staff training stay with you. For the definition, see what "HIPAA compliant" means for a tool. This page states what each vendor publishes. It is not legal advice.
How each vendor's BAA is obtained, and where it stops
Microsoft Teams. The BAA is included by default in the Microsoft Products and Services Data Protection Addendum for covered entities and business associates. Teams is listed among the in-scope Office 365 commercial and GCC services, and there is no separate signature. The plan in the table is Microsoft Teams Essentials. Microsoft's compliance documentation describes the HIPAA BAA as available by default through the Microsoft Product Terms (formerly Online Services Terms), so no separate contract needs signing.
Google Chat and Google Workspace. A super administrator accepts the HIPAA BAA electronically in the Admin console (Account > Account settings > Legal and compliance > Security and Privacy Additional Terms > Google Workspace/Cloud Identity HIPAA Business Associate Amendment > Review and Accept). The administrator answers three questions confirming covered-entity status, then clicks OK. The BAA covers paid Workspace editions administered in that console: Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education and Nonprofits. Nobody in your office needs to email Google. The catch is that an accidental setting change can leave a department outside the terms, so keep the acceptance record. Google's HIPAA Included Functionality page lists Google Chat as covered, and the current legal document is titled the Google Workspace HIPAA Business Associate Addendum.
Zoom. On Pro, you click Buy Now on the healthcare Plans & Pricing page, select the United States Agreement (BAA) in the country dropdown, click Read Agreement, then accept. Business, Business Plus and Enterprise go through Sales. An existing healthcare plan enables the BAA in the web portal under Plans and Billing > Plan Management > view more products, on the Business Associate Agreement (US only) tile. Canadian billing addresses may see a PHIA instead. Zoom's chat is separate from meetings, and Zoom's article lists Pro, Business, Business Plus and Enterprise for healthcare customers without stating whether chat is covered. Meeting tools, including Webex, are compared on the HIPAA-compliant video conferencing page.
Slack. The BAA is available only on Enterprise (Enterprise Grid / Enterprise+), through Slack sales. You commit to Slack's HIPAA guide for entities, sign the BAA and give Slack the list of organizations or workspaces where PHI will be used. A practice on a lower tier has no BAA route.
Chanty. The BAA is available from the Business plan, and Enterprise includes it with a negotiated MSA. Ask the Chanty team (book a demo) to put it in place before patient data enters the workspace. The Free plan has no BAA, so do not store PHI there. Chanty is internal staff communication. It is not patient messaging, telehealth or an EHR.
Tools that are ruled out or unconfirmed
No: iMessage and WhatsApp. Both carry a "no" verdict, with the vendor source on each vendor page. Texting a colleague about a patient through either is the status quo in many small practices, and neither route has a BAA.
Unknown: Discord, GroupMe, Signal, Telegram, Webex. No vendor BAA source is listed for these. Unknown is not a pass, and it is not a fail. It means there is no vendor document to point to yet. Webex shows encryption at rest, SSO and SOC 2 in the table, but those controls do not establish a BAA. Cisco publishes a HIPAA whitepaper for Webex services, but the whitepaper does not state that Cisco signs a customer BAA or on which plans, so Webex stays unknown.
Typical exclusions: consumer messengers, free plans and standalone AI assistants.
Even where a BAA exists, third-party integrations and AI features are often outside its scope. Check each one separately, in writing, before PHI flows through it.
Archiving, audit trails and communications compliance: what a BAA does not give you
People searching for compliant chat archiving or communications audit trail software are often asking a different question from "can this tool sign a BAA?" A BAA is a contract about how a vendor handles PHI. It is not an archiving product. It does not promise retention periods, legal-hold search or export formats.
Retention, export and audit log features vary by plan. The audit log column shows a dash for most rows, because those vendors have no published audit-log detail listed yet. Only Slack shows one. Chanty publishes an audit trail of agent actions on Enterprise only.
Sector rules are a separate matter. Broker-dealer recordkeeping under FINRA/SEC Rule 17a-4 and pharma communications requirements are not HIPAA, and a BAA does not satisfy them. SEC Rule 17a-4 (17 CFR 240.17a-4) requires broker-dealers to preserve business communications, and FINRA has its own recordkeeping rules. For pharma, the relevant FDA rule is 21 CFR Part 11, which under section 11.1(b) covers electronic records created, modified, maintained, archived, retrieved, or transmitted under FDA record-keeping requirements. This page does not cover these rules in depth.
Dedicated communications-compliance platforms, with supervision, surveillance and archiving across channels, are a different category. Start with HIPAA compliance software compared, and see HIPAA-compliant audit logging for logging tools. Chanty is not a communications-compliance platform.
How to evaluate a team chat vendor before PHI goes in
Check these in order:
- BAA on your exact plan. Teams Essentials, Zoom Pro and Chanty Business are not the same as the tier your staff may already be using.
- Services in scope. Chat, files, calls and voice notes may each be treated differently.
- Exclusions. AI features, integrations and free tiers.
- Retention and export. Can an admin export messages if a patient requests records or a dispute arises?
- Admin roles. Who can see which channels, and who can invite guests?
- SSO and 2FA. Does the plan include them?
- Device policy. Lost phones and shared workstations are where PHI leaks.
Shared responsibility sits with the customer. You sign the BAA before PHI goes in, configure roles and permissions, offboard users, manage access, secure devices and train staff.
Chanty as an example: roles and permissions (120+ settings) and 2FA are on Business and Enterprise. SAML SSO and SCIM are on Enterprise. AI agents are Enterprise only, and BAA coverage of agent processing and external models is not documented. Integrations sit outside Chanty's BAA scope. Chanty encrypts data in transit with TLS 1.2+ and encrypts file storage, and it is not end-to-end encrypted. It is for internal staff communication only.
Methodology, sources and update policy
Each verdict rests on the vendor's own BAA or trust page. Rows without a source stay "unknown". The directory reports vendors' published terms and does not audit them or certify anything.
Rankings never depend on payment or on Chanty's interest. Changes are logged on the page for recent changes in vendor HIPAA status. Vendors and readers can send corrections, and each correction is checked against a vendor document before the row changes.
Last verified: 2026-10-20
Sources:
- Microsoft: Microsoft Products and Services Data Protection Addendum and Microsoft Product Terms; HIPAA offering page on learn.microsoft.com
- Google: HIPAA Included Functionality page on workspace.google.com and the Google Workspace HIPAA Business Associate Addendum
- Zoom: healthcare BAA support article on support.zoom.com
- Slack: Slack and HIPAA help article on slack.com
- Cisco: Webex HIPAA compliance whitepaper on trustportal.cisco.com
- Apple: iCloud terms at apple.com/legal/internet-services/icloud/
- WhatsApp: WhatsApp Business Messaging Policy at whatsappbusiness.com/policy/
- Chanty: pricing, security and trust pages
- Regulations: SEC Rule 17a-4 (17 CFR 240.17a-4) and 21 CFR 11.1 on ecfr.gov
- Discord, GroupMe, Signal, Telegram: no vendor BAA source listed
FAQ
Is Slack HIPAA compliant?
Slack makes a BAA available on Enterprise (Enterprise Grid / Enterprise+) only, through Slack sales. You commit to Slack's HIPAA guide for entities and name the workspaces where PHI will be used. Lower plans have no BAA route.
Does Microsoft Teams sign a BAA, and on which plans?
Teams is covered by the Microsoft Products and Services Data Protection Addendum, which includes the HIPAA terms by default. There is no separate signature. The plan in the table is Microsoft Teams Essentials, from $4.00/user/month paid yearly. Microsoft's documentation also describes the BAA as available through the Microsoft Product Terms.
Is Google Chat covered by the Google Workspace BAA?
The BAA is accepted by a super administrator in the Admin console and applies to Workspace paid editions administered there. Google's HIPAA Included Functionality page lists Google Chat as covered.
Can I use WhatsApp or iMessage to message colleagues about patients?
Both carry a "no" verdict: neither has a BAA route. Use a tool with a BAA on your plan.
Does the Zoom BAA cover team chat or only meetings?
The table shows the BAA route: Pro self-accept, and Business, Business Plus and Enterprise through Sales. Zoom's article does not state whether chat is covered.
Do free plans of chat apps come with a BAA?
Chanty's Free plan has no BAA, and free plans are a typical exclusion across this category. Confirm the plan name on each vendor's BAA page.
What is the difference between a BAA and HIPAA compliant chat archiving?
A BAA is a contract covering how a vendor handles PHI. Archiving is a retention and records capability, and a BAA does not provide it. Sector rules such as FINRA/SEC 17a-4 are separate.
Are AI features in chat apps covered by the BAA?
Do not assume so. AI features and integrations are often outside BAA scope. For Chanty, AI agents are Enterprise only, and BAA coverage of agent processing and external models is not documented.
Does Chanty sign a BAA, and from which plan?
Yes, from the Business plan, and Enterprise includes it with a negotiated MSA. Ask the Chanty team (book a demo) before patient data enters the workspace. The Free plan has no BAA.
How often are the verdicts on this page re-verified?
Changes are logged on the recent changes page. Re-checks happen sooner when a vendor changes plans or a reader reports a change.