HIPAA-compliant team messaging means a chat tool that signs a Business Associate Agreement (BAA) with your practice and gives you the safeguards the Security Rule expects: access controls, an audit log, encryption, and a fast way to remove people and devices. No app is HIPAA certified. Compliance is your practice's work, supported by a vendor that signs the BAA.
Three terms you need before anything else
Protected health information (PHI) is any information that identifies a patient and relates to their health, their care, or payment for that care. A name next to an appointment time is PHI. So is a photo of a chart or a note saying a patient called about a refill.
A covered entity is an organization that must follow HIPAA directly: medical and dental practices, clinics, pharmacies and health plans. If you treat patients or bill insurance, this is you.
A Business Associate Agreement (BAA) is a contract between a covered entity and a vendor that handles PHI on its behalf. The vendor promises to protect that information the way HIPAA requires, and HIPAA requires the agreement before the vendor touches PHI (45 CFR 164.502(e) and 164.308(b)). A chat app that stores staff messages about patients is handling PHI, so it needs one.
What HIPAA actually asks of a chat tool
Two HIPAA rules matter here. The Privacy Rule says who may see and share PHI. The Security Rule says how electronic PHI must be protected. Neither names an app; the Security Rule lists safeguards, and a tool either helps you meet them or it does not.
| Safeguard | Plain English | What to look for in a chat app |
|---|---|---|
| Business associate contract | A signed BAA before PHI is handled | A BAA on the plan you actually buy |
| Access control | Only the right people see the right messages | Invite-only workspace, private channels, roles |
| Audit controls | A record of who did what, and when | An audit log you can view and export |
| Transmission security | PHI cannot be read while it travels | Encryption in transit (TLS) and at rest |
| Device security | Lost or shared phones do not expose PHI | Inactivity lock, passkeys, fast user removal |
| Workforce training | Staff know the rules | A short written policy and a yearly refresher |
Encryption is an "addressable" safeguard under the Security Rule. That does not mean optional: you must assess it and either use it or document why an equivalent measure is reasonable. For chat there is no good reason to skip it, so treat it as required.
The BAA comes first, before a single message
If a vendor will not sign a BAA, the conversation is over, however good the app looks. That rules out standard SMS, WhatsApp, iMessage and most consumer apps. Some are encrypted and still inappropriate for PHI, because encryption alone does not make the vendor accountable to you.
When you read a BAA, check four things: it covers the exact product and plan you are buying, it requires the vendor to report security incidents to you, it says what happens to your data when you cancel, and it binds the vendor's subprocessors (the hosting and email providers behind the app) to the same standard.
Access controls: who can see what
HIPAA's minimum necessary idea applies inside your team too. A billing clerk does not need the clinical channel. A per-diem hygienist does not need the owners' channel. Three features make this easy:
- Invite-only workspaces, so nobody joins by guessing a link. People get in only through an invitation sent to their exact email address.
- Private channels for sensitive topics, with a manager who controls membership.
- Roles: a viewer can read but not post, a member can post, a manager runs the channel, and admins run the workspace.
Write down who belongs in each channel, and remove people the same day they leave. Former staff who still have access are a bigger risk than hackers.
Audit logs and retention: proof you can show
The Security Rule expects you to review activity in your systems. For chat, that means an audit log: who signed in, who joined or left a channel, who exported a file. If the HHS Office for Civil Rights (OCR), the agency that enforces HIPAA, asks questions after a complaint, the log lets you answer with facts instead of memory.
Retention is the other half. Decide how long messages live, write it into your policy, and set the tool to match. Keep a way to pause deletion, called a legal hold, for when a complaint or lawsuit arrives. Look for an audit viewer you can export, retention settings you control and a legal hold switch.
Encryption in transit and at rest, and the end-to-end question
Two kinds of encryption matter. In transit means the message is scrambled while it travels between the phone and the server (TLS, the same protection as online banking). At rest means it is scrambled on the server's disks. Any serious tool does both.
End-to-end encryption is a third thing: only the sender's and receiver's devices can read the message, and the vendor cannot. For personal messaging that is a plus. For a practice it is a problem, because the admin cannot search, retain, audit or export anything. That is why Slack, Microsoft Teams and Yodl are encrypted in transit and at rest but not end-to-end. HIPAA asks for accountable controls, not a blind vendor.
Device rules for personal phones
Most small practices run on personal phones. HIPAA does not forbid that, but it expects reasonable safeguards. This short list covers most of the risk:
- Every phone that opens work chat has a passcode or Face ID.
- The chat app locks on its own. Yodl locks after 15 minutes of inactivity and supports passkeys (Face ID or Touch ID) for sign-in.
- Notifications never show message content on the lock screen, only that there is a new message.
- Staff report a lost phone within the hour, and an admin removes the user that same hour.
- No screenshots of PHI into the camera roll, and no forwarding work messages to personal apps.
Training and a written policy close the loop
The tool is half the job. The other half is a one-page policy and a 20-minute training: which app is approved, which apps are banned, what counts as PHI, what to do about a lost phone, and who to call when something goes wrong. Everyone signs it, you keep the copies, and you repeat it yearly and for every new hire, with the date written down. OCR looks for evidence that you tried, not for perfection.
If you want the tool side handled in one place, Yodl is $10 a month for 5 people with a signed BAA. The numbers are on the pricing page.
HIPAA-compliant team messaging is a vendor that signs the BAA plus seven practical safeguards: invite-only access, roles, an audit log, retention with legal hold, encryption, device rules and a signed policy. Put those in place and the rest is habit.
Frequently asked questions
Is any chat app officially HIPAA certified?
No. HHS does not certify software. A vendor can build its product to support HIPAA compliance and sign a BAA, but compliance itself is always the practice's responsibility.
Does end-to-end encryption make an app HIPAA compliant?
No. End-to-end encryption protects messages in transit, but HIPAA also needs a BAA, access controls, an audit log and retention. Many end-to-end apps will not sign a BAA at all.
Can we keep a group text if we never mention patients?
You can, but it rarely stays that way. One message asking whether a named patient called back turns the thread into PHI on an unprotected channel. It is simpler to move all work chat into the covered tool.
Do we need a BAA with every vendor, or only the chat app?
Every vendor that creates, receives, stores or sends PHI for you needs one: the chat app, your EHR, cloud storage, email, billing service and any IT company with access to your systems.