End-to-end encryption protects a message while it travels between two phones. HIPAA asks for more than that: a signed Business Associate Agreement (BAA) with the vendor, access controls, an audit trail and retention rules. Signal has excellent encryption and none of those, so it is not a compliant staff chat tool for a practice, however strong the math is.
What end-to-end encryption actually does
End-to-end encryption (often shortened to E2E) means a message is scrambled on the sender's phone and can only be unscrambled on the recipient's phone. The company running the service never holds the key. Signal, WhatsApp and iMessage all work this way, and for personal messages it is a very good design.
Notice what that sentence covers: the trip between two devices. It says nothing about who is in the group, whether a former employee still has the whole history on her phone, whether anyone can prove who read what, or whether the practice can produce the conversation when a lawyer or an auditor asks for it. Encryption is one safeguard. HIPAA is a list of safeguards.
What HIPAA actually asks of a chat tool
A medical or dental practice is a covered entity, the HIPAA term for an organization that must follow the Privacy Rule and the Security Rule. The information those rules protect is protected health information (PHI): anything that identifies a patient and relates to their health, care or payment. A vendor that handles PHI for the practice is a business associate, and the practice must have a signed Business Associate Agreement (BAA), a contract in which the vendor accepts HIPAA obligations, before the vendor touches PHI (45 CFR 164.502(e) and 164.308(b)).
The Security Rule treats encryption as an "addressable" safeguard. That does not mean optional. It means the practice must assess it and either use it or document why something else is reasonable. Every modern chat tool encrypts, so encryption is rarely what separates a compliant tool from a non-compliant one. The separating line is usually the BAA and the controls behind it. The HHS Office for Civil Rights (OCR) is the agency that enforces all of this.
| What HIPAA needs | What end-to-end encryption gives you |
|---|---|
| A signed BAA with the vendor | Nothing. Encryption is technology; a BAA is a contract. |
| Control over who can see PHI | Nothing. Anyone added to a group sees everything. |
| A way to remove a departing employee | Nothing. The history stays on their phone. |
| An audit trail of access | Nothing. By design, no one can see inside. |
| Retention and legal hold | Nothing. Messages live on each device, or disappear. |
| Protection in transit and at rest | Yes, and it does this very well. |
Why Signal is not automatically compliant
Signal is a free app run by a nonprofit, with encryption that security experts admire. It also has no BAA program, no admin console, no audit log and no retention controls, and every user signs up with a personal phone number. Message history lives on each person's device, not in a workspace the practice controls. Signal makes no HIPAA claims at all, which is to its credit.
So the question "is Signal HIPAA compliant?" has a clear answer: Signal will not sign a BAA, and a tool that will not sign a BAA is not an appropriate place for PHI. The same logic applies to WhatsApp, where Meta's own terms state that it is not a business associate, and to iMessage, where Apple publishes no BAA. Strong encryption and a BAA are two different things, and a practice needs both.
Why most compliant tools are not end-to-end encrypted
This surprises people. The chat tools that healthcare teams can actually use under a BAA are usually not end-to-end encrypted, and that is by design. Search across channels, retention rules, legal hold, an audit viewer and the ability for an admin to remove a user all require the service to be able to process messages on its servers. Slack and Microsoft Teams use this model. So does Yodl.
What those tools do instead is encrypt in transit (TLS, the same protection your bank's website uses) and at rest (on the servers), host on HIPAA-eligible infrastructure with their own subprocessor BAAs, and then sign a BAA with you. The vendor takes on legal obligations for the PHI it can technically reach. That combination, not an unbreakable lock, is what HIPAA is built around.
Yodl says this plainly on its HIPAA page: not end-to-end encrypted, so that search, retention, audit and admin controls work, with a signed BAA on every plan.
A simple way to evaluate any chat app
Before your staff moves a conversation into any app, run through these questions. If the answer to the first one is no, you can stop there.
- Will the vendor sign a BAA with a practice your size, on the plan you can afford?
- Can an admin remove a person and cut off their access everywhere, the same day?
- Is the workspace invite-only, so nobody joins by guessing a link?
- Is there an audit log you can export, and retention you can set?
- Does the app lock after a few minutes idle, and support passkeys or another strong sign-in?
- Are messages encrypted in transit and at rest, and hosted on HIPAA-eligible infrastructure?
- Do notifications keep message content off the lock screen?
Signal fails the first question. Many popular business tools pass it only on their most expensive tiers. The right answer for a small practice is a tool that passes all seven at a price a five-person office can justify.
What this means for your practice
Let staff keep Signal for their personal lives. For work, pick a tool that signs a BAA, write a short policy that says which app is approved, and move the group chat there. Explain to the team why the approved tool is not end-to-end encrypted; most people find the reasoning sensible once they hear it, because they would also want the practice to be able to remove a former coworker or recover what was on a lost phone.
If you want the Slack layout with a BAA included, Yodl is $10 a month for 5 people with a signed BAA; the details are on the pricing page.
End-to-end encryption protects a message in transit. HIPAA needs a BAA, access control, audit and retention on top of encryption, which is why Signal is not compliant and why most compliant tools are not end-to-end encrypted.
Frequently asked questions
Is end-to-end encryption required by HIPAA?
No. HIPAA treats encryption as an addressable safeguard, meaning you must use it or document a reasonable alternative, but it does not require end-to-end encryption specifically. Encryption in transit and at rest under a signed BAA is the standard model.
Is Signal HIPAA compliant?
No. Signal offers no BAA, no admin controls, no audit log and no retention settings, and it makes no HIPAA claims. It is a fine personal messenger and not a place for PHI.
If a tool is not end-to-end encrypted, can the vendor read my messages?
The service processes messages on its servers so that search, audit and retention work. The BAA is the contract that limits what the vendor may do with that access, and a vendor like Yodl also commits to no ads, no selling data and no training AI on customer messages.
Does a BAA make my practice HIPAA compliant on its own?
No. A BAA covers the vendor's side. Your practice still needs policies, training, access rules and good habits. The tool makes those easier to follow; it does not replace them.
What about WhatsApp and iMessage, which are also end-to-end encrypted?
Same answer as Signal. Meta's terms say it is not a business associate, and Apple publishes no BAA for iMessage. Good encryption, no contract, no admin controls.