No: iMessage is not HIPAA compliant for staff texting, because Apple offers no Business Associate Agreement (BAA) for it, the contract HIPAA requires before a vendor handles patient information, and Apple's iMessage security overview describes strong encryption without mentioning HIPAA or business associates. Without a BAA, a practice cannot put patient details in iMessage, and any message to a non-Apple phone falls back to plain SMS anyway.
The short answer and why
Start with Apple's own document. As of November 2026, Apple's iMessage security overview says messages and attachments are protected so that "no one but the sender and receiver can access them," and that Apple "can't decrypt the data." It does not mention HIPAA, health information or business associates, and Apple publishes no BAA for iMessage. Documents change, so verify on Apple's site.
HIPAA works like this. A practice is a covered entity. A vendor that handles patient information for it is a business associate. Before that vendor touches protected health information (PHI), anything that identifies a patient and relates to their health, care or payment, the practice must have a Business Associate Agreement (BAA) with it (45 CFR 164.502(e)). Apple offers no such agreement for iMessage, so the arrangement HIPAA requires cannot exist, however strong the encryption.
iMessage comes with Apple devices at no separate fee, which is why it became the default staff texting tool in so many offices. Nobody chose it. It was just there.
What HIPAA actually asks of a chat app
HIPAA's Security Rule is a list of safeguards, not a feeling of privacy.
| What the rule needs | What iMessage offers per its own site | |
|---|---|---|
| Signed BAA | A contract with the vendor before any PHI is shared | None. Apple publishes no BAA for iMessage |
| Access controls | Only current staff, with roles that limit who sees what | No business admin and no roles; each phone controls its own threads |
| Audit log | A record of who sent, read and exported what | None |
| Encryption in transit and at rest | An addressable safeguard for data moving and stored | End-to-end between Apple devices; messages to non-Apple recipients fall back to SMS, MMS or RCS |
| Retention and deletion | Keep and delete on a schedule you control | No business retention controls; Apple's overview does not discuss iCloud backup |
| Minimum necessary | Share only what the other person needs | A policy you write; iMessage offers nothing to support it |
Only the encryption row looks good, and it comes with an asterisk the size of a green bubble.
What Apple says
Apple's overview is a technical description, and a good one: content is encrypted so only sender and receiver can read it, keys live on each device, and Apple cannot decrypt it. Apple's pages add that iMessage works over Wi-Fi or cellular, syncs across iPhone, iPad, Mac and Apple Watch, supports group messages, media and Tapbacks, and falls back to SMS, MMS or RCS for recipients who are not on Apple devices.
That last line is the one practices miss. When a thread includes an Android phone, the message leaves Apple's encrypted system and travels as a standard text through the carrier. Standard SMS is not appropriate for PHI: it is not end-to-end encrypted and no carrier has signed a BAA with your practice. One green bubble in a group thread puts the whole conversation on the wrong road.
What a practice would have to do
Apple sells no business tier of iMessage, so there is no upgrade, setting or add-on to buy. The only move is to take patient information out of text threads.
- Write a policy: patient names, initials, chart numbers, photos and schedule screenshots never go in iMessage or SMS.
- Give staff a BAA-covered app on their phones, so the policy has somewhere to point.
- Ask staff to delete existing work threads with patient details, and note the date you asked.
- Keep personal numbers out of patient coordination; a provider reaching the front desk about a patient uses the covered app.
- Decide in writing whether iMessage stays allowed for non-patient chatter, with examples, and add the rule to onboarding and offboarding.
The hard part is not the app. It is the first week of reminding people.
The real risk in a small practice
A physical therapy clinic with two therapists, two aides and a front desk runs on an iMessage group. The owner texts, "Can you move Mr. Daniels to Thursday, his knee is worse after the fall," and because one aide carries an Android phone the whole thread goes out as MMS. That evening the front desk's lock screen shows the message in full at a kid's soccer game. In the spring an aide leaves, and two years of patient names stay on her phone, synced to her iPad, with no one at the clinic able to see or delete any of it.
None of that is unusual. It is the ordinary way iMessage gets used in a small office, and every step of it is PHI outside any contract, log or control the practice has. Nobody in that story did anything malicious. The tool simply has no place for a practice to stand.
Alternatives with a BAA
Staff want something that feels like texting on the phone they already carry. Prices are as of November 2026; verify on each vendor's site.
Yodl is $10 a month per location for 5 users, 20 GB of file storage and a signed BAA on every plan, with extra users at $2 each. It runs in any phone browser, with an iPhone app in beta and a Mac app, and covers the texting habits: DMs, group DMs, photos and voice notes with previews, reactions and @mentions. Push notifications never include message content, staff sign in with a passkey (Face ID or Touch ID), a 15-minute inactivity lock covers the phone left on the counter, and an owner can remove a user the day they leave and review the audit viewer.
Hypercare publishes a Starter plan at "$8 USD / month" with a second price set of $10 on the same page, and the page does not label which is annual and which is monthly; a signed BAA comes with Starter and up, not with the 90-day trial. Spruce Health starts at $24 per user per month on its Basic plan, with a HIPAA BAA on all trials and paid plans, and includes patient phone, text, fax and team chat, which fits if you also want to text patients.
If you want to get patient details out of text threads this week, Yodl is $10 a month for 5 people with a signed BAA at yodl.cc/pricing.
iMessage encrypts well, but Apple offers no BAA for it, so it cannot carry patient information for a practice, and any thread with an Android phone in it drops to unencrypted SMS. Give staff a BAA-covered app that feels like texting and keep the rule simple: no patient details in texts.
Frequently asked questions
Does encryption make iMessage HIPAA compliant?
No. Encryption is one addressable safeguard. HIPAA also needs a signed BAA, access controls, an audit trail and retention rules, and iMessage provides none of those to a practice. Apple's security overview makes no HIPAA claim.
Can I use iMessage for non-PHI scheduling messages?
Yes. "Running late, open at 8:10" has no patient information in it and is not PHI. Write the rule down with examples, because "the 9:00 cancelled, her MRI came back" crosses the line in the same thread.
What happens when a message turns green?
It was sent as SMS, MMS or RCS because a recipient is not on an Apple device. Standard SMS is not end-to-end encrypted and no carrier has a BAA with you, so a group thread with one Android phone in it is a standard text thread.
Does Apple sign a BAA for iMessage?
Apple publishes no BAA for iMessage, and its iMessage security overview does not mention HIPAA. We cannot say what any conversation with Apple would produce; there is nothing on Apple's site to point to.
Our phones all have passcodes and Face ID. Is that enough?
Device security helps, and you should require it. It does not create a BAA, an audit log, an admin who can remove a former employee, or retention you control. Those come from the tool, not the phone.