Not as far as its own site says. As of November 2026, our research found no HIPAA or BAA statement on Pumble's pricing page or its security help pages, so a practice should treat a Business Associate Agreement (BAA) as not available. Pumble does say it encrypts all data at rest and in transit, but encryption alone does not satisfy HIPAA. Until Pumble publishes a BAA, keep patient information out of it.
The short answer and why
Pumble is a free Slack alternative from CAKE.com, the company behind Clockify and Plaky. Its free plan allows an unlimited number of users with unlimited message history, which is rare, and that is exactly why it shows up in small practices that outgrew a group text.
The problem is a missing document. HIPAA requires a BAA, a Business Associate Agreement, before a vendor can store or transmit PHI, protected health information, meaning anything that identifies a patient and relates to their care. The practice is the covered entity, the organization the law applies to directly. Pumble's pricing and security pages make no mention of HIPAA or a BAA, and its own content treats HIPAA as the customer's responsibility.
"Not found" is not the same as "refuses". Our research did not find a statement either way. But a practice cannot sign a contract that is not offered, so until Pumble publishes one, the practical answer is no. Terms change; check pumble.com before you decide.
What HIPAA actually asks of a chat app
The Security Rule is a list of safeguards, and a vendor either helps with each one or does not. Here is Pumble against that list, from its own pricing and help pages.
| Requirement | What the rule needs | What Pumble offers per its own site |
|---|---|---|
| Signed BAA | A written contract before any vendor touches PHI | No statement found on the pricing or security help pages. Treat as not available. |
| Access controls | Only the right people see each conversation | Channels, direct messages and threads; data regions and admin controls are listed on higher tiers. |
| Audit log | A record of who read, sent and deleted what | Not described on the pages read. |
| Encryption in transit and at rest | Protect data while moving and while stored | Yes per the pricing page: Pumble "encrypts all data at rest and in transit". The help page cites SOC 2 and ISO/IEC 27001:2013. |
| Retention and deletion | Keep records as long as policy says, then delete | Unlimited message history on Free; retention settings are not described. |
| Minimum necessary | Share only the PHI a task needs | Channels help, but no tooling is described; this is your policy. |
The strongest row is encryption, and the missing row is the one that counts. Encryption is an addressable safeguard, which means a practice must use it or document why not. The BAA is not addressable; it is required before PHI reaches the vendor at all.
What Pumble says
As of November 2026, Pumble's pricing page lists Free at $0 for an "unlimited number of users", with 10 GB per workspace, unlimited message history and up to 3 apps. Pro is $2.49 per seat a month billed annually or $2.99 monthly, with 10 GB per seat. Business is $3.99 annual or $4.99 monthly, with 20 GB per seat and unlimited apps. Enterprise is $6.99 annual or $7.99 monthly, with 100 GB per seat. Paid features can be tried for 7 days without a credit card.
On security, the pricing page says Pumble "encrypts all data at rest and in transit", and the "Is Pumble secure?" help page cites SOC 2 and ISO/IEC 27001:2013. Neither page mentions HIPAA, business associates or a BAA. That is the whole record our research found.
For a non-clinical business, Pumble is a lot of product for free: unlimited users and history, voice and video calls, and native Clockify and Plaky integrations. A practice is a different case only because of the one missing contract.
What a practice would have to do
- Ask Pumble support directly whether it will sign a BAA, and keep the written answer. If the answer is no, or there is no answer, that is your answer.
- Until a signed BAA exists, put one line in your staff policy: Pumble is for non-patient chat only, or not for work at all.
- If staff already use it, note which channels hold patient details and export what your retention policy says you must keep.
- Choose a chat tool that signs a BAA, invite the staff, and only then delete the old workspace content.
- If patient details were in Pumble, have whoever handles your compliance review whether it should be documented as an incident.
The real risk in a small practice
Consider a physical therapy clinic with three therapists and one office manager. The manager found Pumble because Slack's free plan hides older messages, and "unlimited history" seemed perfect for tracking which patient's insurance authorization was still pending. A year later the general channel is a searchable record of hundreds of patients, with evaluation notes, dates of birth and photos of intake forms.
The feature that attracted them is the liability. A single compromised login exposes everything, because nothing was ever deleted. There is no retention setting to shorten the window, no audit log to show who opened what, and no BAA that obligates the vendor to help. HIPAA is enforced by the HHS Office for Civil Rights (OCR), and the practice would be answering its questions alone.
Alternatives with a BAA
If you like Pumble's shape, flat channels and a low price, these tools keep the shape and add the contract. Prices as of November 2026; verify on each site.
- Yodl: $10 a month for 5 users and one location, with a signed BAA on every plan, including this one. Channels, direct messages, threads, file sharing, 20 GB per location, retention controls with legal hold and invite-only workspaces. Extra users are $2 each. Five users on Pumble Business at the annual rate is about $20 a month without a BAA; Yodl is $10 with one. See Yodl vs Pumble.
- Chanty: Business is "$3 user/month" on the plan card, explained in the FAQ as $3 per user billed annually or $4 monthly, with 20 GB per user and "HIPAA compliance and BAA" listed. The Free plan for up to 5 members does not list it.
- Microsoft Teams Essentials: $4.00 per user a month, paid yearly. Microsoft's HIPAA BAA is available by default through its Online Services Data Protection Addendum for commercial plans, and Teams is listed as in scope; the free consumer Teams is not.
Keep Pumble if your team has nothing to do with patients. If it does, Yodl's pricing is $10 a month for 5 people with the BAA included.
Pumble's site makes no HIPAA or BAA claim, so it cannot be a home for patient information even though it encrypts data. For non-clinical teams it is a strong free tool; for a practice, pick a chat app that signs a BAA.
Frequently asked questions
Does encryption make Pumble HIPAA compliant?
No. Pumble says it encrypts all data at rest and in transit, which is good practice and an addressable HIPAA safeguard, but HIPAA requires a signed BAA before a vendor handles PHI, and Pumble's site offers none.
How much does Pumble cost with a BAA?
There is no published price, because no Pumble plan lists a BAA as of November 2026. Paid plans run from $2.49 to $7.99 per seat a month, and none of them changes the HIPAA answer on its own.
Pumble has SOC 2 and ISO 27001. Is that enough for HIPAA?
No. Those audits describe a vendor's security practices; they are not a HIPAA contract. A vendor can hold both and still offer no BAA.
Can staff use Pumble for schedules if we avoid patient names?
Shift swaps and supply orders are fine. The moment a message describes a patient, even without a name, it can be PHI. Most practices find one covered tool simpler than a list of exceptions.
Does Yodl have a free plan like Pumble?
No. Yodl has no free plan; the $10 plan is month to month. The BAA is included from the first day.