Group chat is allowed under HIPAA when the app has signed a Business Associate Agreement (BAA) with your practice, membership is controlled, and staff share only what the group needs. Ten rules cover almost everything: the right tool, invite-only membership, a channel map, minimum necessary, no screenshots, direct messages for one-person questions, a retention period, same-day offboarding, lost-phone reporting and a signed policy.
First, the difference between a group text and a group channel
A group text lives on every member's phone forever, has no owner, and runs on a vendor that has no agreement with your practice. A group channel lives in a workspace your practice controls, has a manager who decides who is in it, and runs on a vendor that has signed a Business Associate Agreement (BAA), the contract that makes the vendor responsible for protecting protected health information (PHI), meaning any information that identifies a patient and relates to their health or care.
HIPAA applies to covered entities (your practice) and to business associates (your vendors). Every rule below follows from that one difference: in a channel, the practice is in charge. In a group text, nobody is.
Rules 1 to 3: the tool, the members, the map
Rule 1: one approved tool, with a BAA. Patient information goes in that tool and nowhere else. SMS, WhatsApp, iMessage and personal apps are banned for anything about a patient, because those vendors will not sign a BAA.
Rule 2: invite-only membership. Nobody joins by link. Each person is invited to their exact work email, and a manager controls every channel's member list. Yodl workspaces are invite-only by design, and each channel has a manager who decides who is in it.
Rule 3: a channel map. Write down which channels exist and who belongs in each. Four is enough for most small practices: general, front desk, clinical (private) and shift handoff. Owners get a private channel of their own. If a person does not need a channel, they are not in it.
Rules 4 to 6: what goes in a message
Rule 4: minimum necessary. The chart holds the detail; the message points to it. Use chart numbers and room numbers instead of names and diagnoses. Say what the other person needs to act, nothing more.
Rule 5: no screenshots, photos or forwards. A screenshot of a channel is PHI in a camera roll that syncs to a personal cloud. Clinical photos belong in the record, not in chat. Nothing from the channel gets forwarded to email or another app.
Rule 6: direct messages for one-person questions. If only the doctor needs to know, message the doctor. The all-staff channel is not the place to discuss a patient's history, even in a compliant tool.
Rules 7 and 8: retention and leaving staff
Rule 7: a written retention period. Decide how long messages live, write it in the policy and set the tool to match. Keep a legal hold option for complaints or lawsuits. Chat is not the medical record, so anything that needs to be kept clinically goes in the chart first.
Rule 8: same-day offboarding. When someone leaves, remove them from the workspace before the end of their last day. Most PHI exposures in small offices come from former staff who still have access. Put it on the exit checklist next to returning the key.
Rules 9 and 10: lost phones and the signed policy
Rule 9: lost phone, one hour. Staff report a lost or stolen phone within the hour, any day, any time. The admin removes the user from the workspace, then everyone looks for the phone. An app that locks itself after inactivity and supports passkeys makes this far less stressful; Yodl locks after 15 minutes and supports Face ID and Touch ID sign-in.
Rule 10: everyone signs. The rules only count if they are written down, signed and dated. One page is enough. Review it once a year and with every new hire, and keep the signed copies with your HIPAA records.
The ten rules on one page
| # | Rule | Who makes it happen |
|---|---|---|
| 1 | One approved tool with a signed BAA | Owner |
| 2 | Invite-only membership, managers control channels | Office manager |
| 3 | Written channel map | Office manager |
| 4 | Minimum necessary: chart numbers, not names | Everyone |
| 5 | No screenshots, photos or forwards | Everyone |
| 6 | Direct messages for one-person questions | Everyone |
| 7 | Written retention period and legal hold | Owner |
| 8 | Same-day offboarding | Office manager |
| 9 | Lost phone reported within one hour | Everyone |
| 10 | Signed policy, reviewed yearly | Owner |
How to roll the rules out without a revolt
Introduce the rules with the tool, not before it. Staff accept rules when the new app is already faster than the group text it replaces. Do it in one twenty-minute meeting: show the channels, read the ten rules out loud, answer questions, collect signatures. Then enforce exactly one thing hard for the first month: patient information in the approved tool only. The other nine rules follow once that habit holds.
If you need the approved tool, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Group chat about patients is fine in a BAA-covered tool with controlled membership and minimum-necessary messages. Write the ten rules on one page, have everyone sign it, and enforce the first rule hardest.
Frequently asked questions
Is a private channel enough to discuss sensitive patient details?
Private membership controls who can see the message, but minimum necessary still applies. Use the chart for detail and the channel to point to it.
Can part-time or per-diem staff be in the channels?
Yes, if they work shifts and need the information. Invite them to their own email, give them the channels they need, and remove them when they stop working.
Should the owner be in every channel?
Owners usually belong in general and a private owners channel and can be viewers elsewhere. Being in everything creates noise and does not improve compliance.
What about group chats with outside people, like a lab or a referral office?
Keep outside parties out of your staff workspace. If you need to share PHI with them, use a channel that an agreement covers, such as the EHR, fax or a secure portal.
Do these rules apply to a two-person office?
Yes. Size does not change HIPAA. A two-person office needs a BAA-covered tool just as much; it simply needs fewer channels.