Discord has no published BAA, so it cannot be cleared for PHI on the evidence available. Its Terms of Service and Privacy Policy, checked 2026-10-20, say nothing about a BAA, HIPAA or PHI. Until a signed agreement exists, keep patient information out of it.
Unknown Verified 2026-10-20 against Discord's Terms of Service and Privacy Policy. No BAA is published for any plan, so no covered services are defined. The main exclusion is that PHI use is not addressed at all.
Short answer
Neither Discord's Terms of Service nor its Privacy Policy makes any public statement about a business associate agreement, HIPAA or protected health information. Without a published BAA, treat Discord as not approved for PHI until a signed agreement is in hand.
A verdict of "unknown" is not a verdict of "safe." If your front desk, billing team or care coordinators need a chat tool for anything that could include patient details, such as a screenshot of tomorrow's schedule or a voice note about a prior authorization, start from HIPAA-compliant team chat tools instead.
Which plans include a BAA
Definitions of BAA and PHI are in the HIPAA glossary (BAA, PHI).
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| No plan named in published terms | Not published by the vendor | Not published by the vendor | Not published by the vendor |
The pages checked name no plan that includes a BAA and no plan that is excluded from one. This page does not infer plan names or terms that Discord has not published.
What the BAA covers and what it excludes
Covered services: none published.
Excluded features: none published.
Discord publishes no BAA terms on the pages checked, so there is no list of covered services, no list of exclusions and no scope to compare against how your staff actually use the product. If a signed BAA is ever offered, its scope has to be read before any PHI goes in. That includes which content types it covers, such as messages, files, voice and video.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Not published is not the same as absent. A control may exist without being documented on the pages checked. For a PHI decision, though, a security officer needs the control documented and covered by an agreement, not assumed.
How to use Discord with PHI
Compliance depends on the signed BAA, how the tool is configured and the policies staff follow, not on the tool alone. Until a BAA exists, the practical position is that PHI stays out. If your organization uses Discord for non-PHI purposes, such as a community server or a recruiting channel, use this checklist:
- Obtain a signed BAA before any PHI is shared. None is published today, so the default answer is no.
- Keep PHI out of Discord until then. That covers patient names, appointment details, images of charts and voice notes.
- Set access rules and offboarding. Decide who may join, who removes departed staff and how quickly.
- Restrict who can join and share. Do not let open invites or outside members into any space where patient-adjacent work might be discussed.
- Train staff on what not to post. Use concrete examples: a patient's name with a diagnosis, a photo of a wound, a screenshot of the schedule.
- Document the decision in your vendor inventory. Record the verdict, the date and the source so an auditor can see the reasoning.
Alternatives with a BAA
These team chat options publish BAA availability on named plans. They are listed alphabetically; order does not reflect ranking, and placement never depends on payment. Disclosure: Chanty, Inc. owns and publishes this directory, and Chanty is listed here as one vendor among others. See the full HIPAA-compliant software by category hub for more.
- Chanty (conditional): BAA from the Business plan. It is internal team communication for staff, not patient messaging. The Free plan has no BAA. Is Chanty HIPAA compliant?
- Google Chat (conditional): managed through Google Workspace, with the BAA accepted in the Admin console.
- Google Workspace (conditional): BAA on paid editions, accepted via the Admin console. Is Google Workspace HIPAA compliant?
- Microsoft Teams (conditional): BAA from Teams Essentials.
- Slack (conditional): BAA on Enterprise Grid / Enterprise+. Is Slack HIPAA compliant?
"Conditional" means a BAA is available on specific plans, and the organization must still sign it and configure the tool correctly before PHI is used.
Sources
- Discord's Terms of Service — Terms, checked 2026-10-20. "Don’t use the services to do harm to yourself or others."
- Privacy Policy | Discord — Terms, checked 2026-10-20. "We may disclose information if we believe in good faith that it's necessary to prevent death or other serious harm to a person."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Discord sign a BAA?
No BAA is mentioned in the Terms of Service or Privacy Policy checked on 2026-10-20. No plan, price or process for obtaining one is published.
Can I put patient information in a private Discord server?
Private servers do not create a BAA. Without a signed BAA, keep PHI out, including in invite-only channels and direct messages.
Do the Terms of Service or Privacy Policy mention HIPAA or PHI?
Neither mentions them in the pages checked on 2026-10-20.
Is Discord safe for healthcare staff coordination?
Discord's published terms do not address healthcare use, and the security controls in the table above are not published. For coordination that never touches PHI, such as a social space or a volunteer group, that may be acceptable under your own policy. For shift handoffs or care coordination, use a tool with a BAA.
What should I use instead for HIPAA team chat?
Chanty, Google Chat, Google Workspace, Microsoft Teams and Slack publish BAA availability on named plans; see their pages above. Browse all vendor checks at Is it HIPAA compliant? All vendors.