Slack can support HIPAA compliance only on its Enterprise plans, and only after your practice signs a Business Associate Agreement (BAA) with Slack, the contract HIPAA requires before a vendor handles patient information. Slack's Free, Pro and Business+ plans are not covered, so Slack as most small teams buy it is not a place for patient details, even though it is a very good chat app.
The short answer and why
Slack's own help center answers this. As of November 2026, Slack says that "On Enterprise plans, Slack can be configured to support HIPAA-compliant message and file collaboration," with two conditions: "You must be using a Slack Enterprise plan" and "You must execute a Business Associate Agreement." Its pricing page lists "Support for HIPAA compliance" in the top tier, Enterprise+, priced at "Contact sales for pricing." Terms change, so verify this on Slack's site before you decide.
Why the plan matters: HIPAA applies to covered entities, the practices and providers that handle patient information, and to their business associates, the vendors that handle it for them. A BAA is the contract where the vendor agrees to protect that information the way HIPAA requires, and the rules want it in place before the vendor touches protected health information (PHI), anything that identifies a patient and relates to their health, care or payment (45 CFR 164.502(e)). Slack offers that contract on one tier, the one without a published price.
What HIPAA actually asks of a chat app
The Security Rule is closer to a checklist than a badge.
| What the rule needs | What Slack offers per its own site | |
|---|---|---|
| Signed BAA | A contract with the vendor before any PHI is shared | Enterprise plans only; Free, Pro and Business+ are not covered |
| Access controls | Only current staff, with roles that limit who sees what | SSO, compliance and admin controls sit on the higher tiers |
| Audit log | A record of who sent, read and exported what | Discovery API on Enterprise+; the HIPAA guide requires monitoring through DLP or the Discovery APIs |
| Encryption in transit and at rest | An addressable safeguard for data moving and stored | Not addressed in Slack's HIPAA help article; check Slack's security pages |
| Retention and deletion | Keep and delete on a schedule you control | Free plan hides messages after 90 days and deletes data after one year; paid plans keep unlimited history |
| Minimum necessary | Share only what the other person needs | A policy you write; Slack limits PHI to messages, files and file names, not other features |
What Slack says
Slack's HIPAA help article is restrictive even on Enterprise. Closely paraphrased:
- Slack cannot be used to communicate with patients.
- PHI may appear only in messages, files and file names, not in other features.
- The practice must monitor PHI through Slack's DLP tools or the Discovery APIs, plus an outside DLP product.
- Slack "should not be the system of record." Your EHR stays the record.
- The BAA does not extend to third-party apps.
- The customer must agree to the Slack Guide for HIPAA Entities.
On price, Slack shows Free at $0 per workspace, Pro at $8.75 per user per month ($7.25 paid annually), Business+ at $18 ($15 annually), and Enterprise+ at "Contact sales for pricing." The Free plan hides messages older than 90 days, allows 10 apps, and Slack says "Free Slack deletes data after 1 year." None of the three published plans includes HIPAA support.
What a practice would have to do
To keep Slack and use it for PHI:
- Move to an Enterprise plan through Slack sales, and budget before you commit, since the price is not published.
- Execute the BAA and agree to the Slack Guide for HIPAA Entities.
- Set up DLP or Discovery API monitoring, and plan on an external DLP tool.
- Train every user that PHI goes only in messages, files and file names, never to a patient, and that the chart stays in the EHR.
- Remove third-party apps that could see PHI, and write retention, device and offboarding policies.
If that is more than a 5-person office wants, the simpler path is to keep PHI out of Slack: use it for supply orders and schedules without patient names, and move patient conversations to a tool that signs a BAA. For reference, Pro for 5 people is $43.75 a month billed monthly ($36.25 annually) and Business+ is $90 ($75 annually), with no BAA on either.
The real risk in a small practice
Slack is not the problem; the habit is. A 5-person dental office picks Slack Pro because the dentist used it at a previous job. Within a month the front desk is DMing the hygienist "Mrs. K in room 2 says the crown feels loose, can you take a look," with a photo of the chart attached. Each of those messages is PHI, shared with a vendor that has not agreed to protect it, in a plan never set up for it.
The small-office details make it worse. Staff run Slack on personal phones, so a lost phone is a lost chat history. A receptionist who left in the spring may still have access because nobody owns offboarding. And on the Free plan, Slack deletes data after a year, so the record may be gone when a question comes up.
Alternatives with a BAA
You do not need an enterprise contract to get a BAA. Prices below are as of November 2026; check each vendor's site.
Yodl is Slack-style chat for small healthcare teams: $10 a month per location, including 5 users, 20 GB of file storage and a signed BAA on every plan, with extra users at $2 each. You get channels, DMs, threads, file sharing and search, plus the controls HIPAA cares about: invite-only workspaces, channel roles (Manager, Member, Viewer), an audit viewer with CSV export, retention controls and legal hold, passkeys and a 15-minute inactivity lock. Like Slack, it is encrypted in transit and at rest but not end-to-end, by design, so search and audit work. No free trial. See how Yodl compares with Slack.
Chanty lists "HIPAA compliance and BAA" on its Business plan at $3 per user per month billed annually, or $4 monthly per its FAQ, so 5 people are about $15 a month. Microsoft Teams Essentials is $4.00 per user per month paid yearly, and Microsoft says its HIPAA BAA applies by default to commercial plans through its Online Services Data Protection Addendum. Slack remains the right pick for a larger organization with an Enterprise agreement and an IT team to run DLP.
If you want the Slack layout with a BAA at a small-office price, Yodl is $10 a month for 5 people with a signed BAA at yodl.cc/pricing.
Slack supports HIPAA only on Enterprise plans, with a signed BAA and a list of restrictions, and that price is not published. A small practice on Free, Pro or Business+ has no BAA, so keep PHI out of Slack or move to a tool that signs one at a price you can see.
Frequently asked questions
Does encryption make Slack HIPAA compliant?
No. Encryption is one addressable safeguard; a BAA is a separate requirement that only Slack's Enterprise plans offer. Slack's HIPAA article does not even address encryption.
Can I use Slack for non-PHI scheduling messages?
Yes. "Who is covering Friday?" has no patient information, so it is not PHI. The risk is drift: write a short rule that patient names, chart numbers, photos and schedule screenshots never go in Slack.
Is Slack Pro or Business+ HIPAA compliant?
No. Slack states you must be on an Enterprise plan and must execute a BAA. Pro and Business+ add unlimited history and apps, not HIPAA support.
How much does Slack cost with a BAA?
Slack does not publish it; Enterprise+ is "Contact sales for pricing." For scale, Pro is $8.75 per user per month and Business+ $18, as of November 2026, with no BAA on either.
Can we message patients through Slack if we have the BAA?
No. Slack's HIPAA guide says Slack cannot be used to communicate with patients, even on Enterprise. Staff chat tools, Yodl included, are for staff; patient messaging is a separate product category.