No: Signal is not HIPAA compliant for a practice, because Signal offers no Business Associate Agreement (BAA), the contract HIPAA requires before a vendor handles patient information, and nothing on signal.org mentions HIPAA or business associates. Signal's encryption is the best in consumer messaging, and that is beside the point: HIPAA asks a covered entity for a signed BAA, access controls, an audit trail and retention rules, and Signal has none of those for a team.
The short answer and why
Signal's own pages make the case. As of November 2026, signal.org says Signal is "Free for Everyone," run by "an independent nonprofit," and that it uses "state-of-the-art end-to-end encryption (powered by the open source Signal Protocol)." It says "Signal cannot decrypt or otherwise access the content of your messages or calls." Neither the home page nor the legal pages mention HIPAA, business associates or health information, and no BAA program is offered. Terms change; verify on Signal's site.
Here is why that ends the discussion. A practice is a covered entity under HIPAA. Any vendor that handles patient information for it is a business associate, and before that vendor touches protected health information (PHI), anything that identifies a patient and relates to their health, care or payment, the practice must have a Business Associate Agreement (BAA) with it (45 CFR 164.502(e)). Signal is not offering to be anyone's business associate. A practice using Signal is not Signal's customer; it is a user of a free app.
That is not a criticism of Signal. It is built for individuals who want privacy from everyone, including the organization that runs it. A practice needs a vendor that is accountable to it.
What HIPAA actually asks of a chat app
| What the rule needs | What Signal offers per its own site | |
|---|---|---|
| Signed BAA | A contract with the vendor before any PHI is shared | None offered; no HIPAA or business associate mention on signal.org |
| Access controls | Only current staff, with roles that limit who sees what | No admin console; each user registers with a phone number and groups are managed by members on their own phones |
| Audit log | A record of who sent, read and exported what | None |
| Encryption in transit and at rest | An addressable safeguard for data moving and stored | End-to-end for messages, calls, media and files; Signal cannot decrypt or access the content |
| Retention and deletion | Keep and delete on a schedule you control | No retention controls; message history is stored on users' own devices; undelivered messages wait on the server only until delivered |
| Minimum necessary | Share only what the other person needs | A policy you write; nothing in Signal supports it |
Signal wins the encryption row outright and loses the other five, on purpose. The design that keeps Signal out of your messages also keeps your practice out of them.
What Signal says
Signal keeps almost nothing: minimal server-side data, no ads and no trackers, undelivered messages held only until they arrive, and message history that lives on the user's device rather than in any workspace. The apps run on Android, iPhone, iPad, Windows, Mac and Linux, and every account is tied to a phone number.
Read that list as an office manager and the problem is obvious. There is no place where the practice exists: no account for the clinic, no admin, no member list, no export, and no way to answer "who saw this and when" if a patient complains or the HHS Office for Civil Rights, which enforces HIPAA, asks. Signal was never meant to be a workplace tool.
What a practice would have to do
There is no business plan, no add-on and no BAA to request, so the only compliant move is to stop using Signal for anything involving patients.
- Announce the change with a date and a one-line reason: the practice needs a vendor that signs a BAA.
- Stand up a replacement that signs one, and invite everyone before the Signal group closes.
- Ask every member to delete the work group and its history from each device they use, since history lives on devices, and note the date and who confirmed.
- Write a policy naming the approved tool and prohibiting consumer apps for patient information, and put it in onboarding.
The real risk in a small practice
A home care agency with eleven caregivers moves its coordination to Signal because the owner read that it is the most secure messaging app. Caregivers post client names, addresses, medication times and photos of care notes. Then a family files a complaint about a missed visit. The owner cannot see who was in the group when the visit was scheduled, cannot export the thread, cannot confirm a message was read, and cannot remove the six months of client details that a caregiver who left last month still carries.
That is the specific way Signal fails a practice: not by leaking, but by leaving the practice with nothing. A breach investigation starts with documentation, and Signal, by design, produces none. It is the strongest lock in the world on a door the practice does not own.
Alternatives with a BAA
Teams that chose Signal care about privacy, so it is worth being plain about how BAA-covered tools work. Prices are as of November 2026; check each vendor's site.
Yodl is not end-to-end encrypted, by design: it is encrypted in transit (TLS) and at rest on HIPAA-eligible infrastructure with subprocessor BAAs, the same model as Slack and Microsoft Teams, because that is what lets search, retention, audit and admin controls work. In exchange the practice gets what Signal cannot give it: a signed BAA on every plan, invite-only workspaces, roles, an audit viewer with CSV export, retention controls and legal hold, passkeys and a 15-minute inactivity lock. Yodl also runs no ads, sells no data and does not train AI on customer messages. It is $10 a month per location for 5 users and 20 GB, extra users $2 each.
Celo has a free plan for up to 10 users with "HIPAA compliant messaging," and lists a Business Associate Agreement from its Growth plan at $49 a month billed annually for up to 20 users. Hypercare shows a Starter plan at "$8 USD / month" with a second price set of $10 that the page does not label as annual or monthly; a signed BAA comes with Starter and up, not with the 90-day trial. Both are built for healthcare teams and are fair choices.
If you want a staff chat tool that is accountable to your practice, Yodl is $10 a month for 5 people with a signed BAA at yodl.cc/pricing.
Signal has the strongest encryption of any consumer messenger and no BAA, no admin console, no audit log and no retention controls, so a practice cannot use it for patient information. Privacy from the vendor and accountability from the vendor are different things, and HIPAA requires the second.
Frequently asked questions
Does encryption make Signal HIPAA compliant?
No. Encryption is one addressable safeguard under the Security Rule. HIPAA also requires a signed BAA, access controls, an audit trail and retention rules, and Signal offers none of them to a practice. Signal itself makes no HIPAA claim.
Can I use Signal for non-PHI scheduling messages?
A message with no patient information is not PHI, so "can anyone cover the 2 to 6 shift Saturday" is not a violation. The trouble is that the same group will carry a client's name by Tuesday, which is why most practices ban consumer apps for work.
Isn't Signal more secure than a HIPAA chat app?
For keeping message content away from the vendor, yes. For HIPAA, security is only part of the test: a covered tool is accountable to the practice through a BAA, lets an admin control membership, and keeps an audit trail.
Does Signal sign a BAA?
No BAA program appears anywhere on Signal's site, and Signal makes no HIPAA claims. We cannot say what any request would produce; there is nothing published to point to.
What if everyone on staff is careful and nothing ever leaks?
The BAA requirement does not depend on whether a breach happens. A practice that shares PHI with a vendor without a BAA is out of step with the rule on day one, and if anything is questioned, Signal gives you no records.