No. Discord does not offer a Business Associate Agreement (BAA), the contract HIPAA requires before a vendor can handle patient information, and as of November 2026 its Terms of Service contain no HIPAA language at all. It is a free consumer app built for gamers and online communities, not a place for staff to discuss patients.
The short answer and why
Discord is a free consumer app built for gamers, friends and online communities. As of November 2026, its site lists the free app plus two optional paid tiers, Nitro Basic at $2.99 a month and Nitro at $9.99 a month, and its Terms of Service contain no HIPAA, health information or BAA language. Terms change, so verify on Discord's site.
Why that settles it: HIPAA requires a signed contract before a vendor stores or transmits patient information. The contract is a Business Associate Agreement (BAA), and it makes the vendor legally responsible for protecting that data (45 CFR 164.502(e) and 164.308(b)). Without it, the practice carries the whole risk alone.
PHI is protected health information: anything that identifies a patient and relates to their care, such as a name next to an appointment time or a photo of a chart page. A covered entity is the practice, clinic, pharmacy or agency HIPAA applies to directly, and a vendor that handles PHI for it is a business associate.
What HIPAA actually asks of a chat app
The Security Rule never names an app. It lists safeguards, and a vendor either helps with them or does not. Here is Discord, using only what its own site says.
| Requirement | What the rule needs | What Discord offers per its own site |
|---|---|---|
| Signed BAA | A written contract before any vendor touches PHI | None. The Terms of Service have no HIPAA or BAA language. |
| Access controls | Only the right people see each conversation | Servers with text and voice channels, built for communities; no practice-level controls described. |
| Audit log | A record of who read, sent and deleted what | Not described on the pages read. |
| Encryption in transit and at rest | Protect data while moving and while stored | Not stated on the pages read. |
| Retention and deletion | Keep records as long as policy says, then delete | Not described on the pages read. |
| Minimum necessary | Share only the PHI a task needs | No tooling described; it depends on staff habits. |
The first row decides the question. Without a BAA, the other rows do not count for HIPAA purposes.
What Discord says
Discord describes itself as a home for communities: servers with text and voice channels, drop-in voice chats, video and screen streaming, custom emoji, stickers and a soundboard, on PC, phone, console and browser. The minimum age is 13. It is good at what it was built for and is not pretending to be a clinical tool.
On health information it says nothing. Our research read the homepage, the Nitro page and the Terms of Service and found no mention of HIPAA, health data or business associates. A support article, quoted through a search result because the page blocked the fetch, puts the free upload limit at 20 MB as of August 2026, with 50 MB on Nitro Basic and 1 GB on Nitro.
What a practice would have to do
There is no add-on to buy, no plan to upgrade to and no setting to flip. The list is short, and none of it is optional.
- Stop putting PHI in Discord today: patient names next to appointment times, photos of charts, screenshots of the schedule and voice huddles about the day's patients.
- Tell staff in writing. One line is enough: Discord may be used for chat that never mentions patients, or not for work at all.
- Choose a replacement that signs a BAA and move the staff conversations there before you delete anything.
- Export the old history you are allowed to keep, record the decision and delete the rest from the server.
- If patient details were shared there in the past, ask whoever handles your compliance whether it needs to be reviewed as an incident.
The real risk in a small practice
The risk is rarely a dramatic hack. It is the slow drift that happens when a free tool is convenient. A front desk coordinator asks the staff channel whether Mr. Alvarez's referral came through. A hygienist posts a photo of a chart page so the dentist can read it from home. The morning huddle moves into a voice channel and names every patient on the schedule.
Each of those is PHI sitting with a vendor that has no contract to protect it, on personal phones that may be shared with family. If a phone is lost or an account is taken over, the practice has no audit record of what was exposed and no vendor obligation to help.
HIPAA is enforced by the HHS Office for Civil Rights (OCR), and the first question in any review is simple: did you have a BAA with this vendor? For Discord the answer is no, and careful use does not change it.
Alternatives with a BAA
Any of these is a reasonable landing spot. Prices are as of November 2026 and change, so check each vendor's site.
- Yodl: $10 a month for 5 users and one location, 20 GB of file storage and a signed BAA on every plan, including this one. Public and private channels, direct messages, threads, channel roles (Manager, Member, Viewer), an audit viewer with CSV export, retention controls and a 15-minute inactivity lock. No voice or video calls, by design. Extra users are $2 each. See features.
- Microsoft Teams Essentials: $4.00 per user a month, paid yearly. Microsoft says its HIPAA BAA is available by default through the Online Services Data Protection Addendum, and Teams is listed as in scope; the free consumer Teams is not.
- Celo: a Free plan for up to 10 users that lists HIPAA compliant messaging but no BAA line, and a Growth plan at $49 a month, billed annually, for up to 20 users that lists a Business Associate Agreement (BAA). Built for care teams, with read receipts and a secure photo library.
Whichever you pick, get the BAA signed before the first patient name is typed. Yodl's pricing page is $10 a month for 5 people, with the BAA signed at checkout.
Discord offers no BAA and its terms never mention HIPAA, so it cannot hold patient information no matter how carefully staff use it. Keep it for non-clinical chat if you like it, and move anything about patients to a tool that signs a BAA.
Frequently asked questions
Does encryption make Discord HIPAA compliant?
No. Encryption is one safeguard in the HIPAA Security Rule, and the rule calls it addressable, meaning you use it or document why not. It does not replace the BAA, and the Discord pages our research read do not describe its encryption at all.
How much does Discord cost with a BAA?
There is no price, because Discord does not offer a BAA on any tier. As of November 2026 the app is free, with Nitro Basic at $2.99 a month and Nitro at $9.99 a month, and none of them changes the HIPAA answer.
Can we use Discord if we never mention patient names?
You can, but it is hard to police. A first name plus an appointment time, a photo of a chart or a voice huddle about the schedule all count as PHI. Most practices find it easier to move all staff chat to one tool with a BAA.
Is Yodl end-to-end encrypted?
No, and that is on purpose. Yodl encrypts data in transit and at rest, but not end to end, so that search, retention, audit logs and admin controls can work. Slack and Microsoft Teams use the same model, and a signed BAA covers it.