Yes, in the only sense that applies to software. Spruce Health is built for patient communication and includes a Business Associate Agreement (BAA) on every trial and paid plan. As of November 2026, Spruce says you electronically agree to the Spruce BAA when you create an organization, and its Basic plan at $24 per user a month lists "HIPAA BAA" on the plan card.
The short answer and why
Spruce Health is a healthcare communication platform: HIPAA phone lines with two-way texting and voicemail transcription, secure patient messaging, video visits, e-fax, and team messaging with task assignment and a shared inbox. It says it is "Built for solo practitioners and teams alike" and claims more than 25,000 providers.
HIPAA protects PHI, protected health information, meaning any detail that identifies a patient and relates to their care. The practice is the covered entity, the organization the law applies to directly. A vendor that handles PHI for it is a business associate, and the BAA, or Business Associate Agreement, is the contract that makes the vendor responsible for protecting that data. No official HIPAA certification exists; a vendor can only sign the BAA and provide the safeguards.
Spruce does both on paper. The BAA is agreed electronically when you create an organization, and the homepage shows HIPAA, HITRUST and SOC 2 badges. Terms change, so verify on sprucehealth.com before you sign up.
What HIPAA actually asks of a chat app
The Security Rule lists safeguards, not brands. Here is how Spruce lines up, using only its pricing page and homepage.
| Requirement | What the rule needs | What Spruce offers per its own site |
|---|---|---|
| Signed BAA | A written contract before any vendor touches PHI | Yes. "You electronically agree to the Spruce BAA when you create an organization"; the FAQ says it applies to all trials and paid plans. |
| Access controls | Only the right people see each conversation | Team messaging with task assignment and a shared team inbox; role details are not described on the pages read. |
| Audit log | A record of who read, sent and deleted what | Not described on the pages read; ask Spruce. |
| Encryption in transit and at rest | Protect data while moving and while stored | Not described on the pages read; HIPAA, HITRUST and SOC 2 badges are shown on the homepage. |
| Retention and deletion | Keep records as long as policy says, then delete | Not described on the pages read. |
| Minimum necessary | Share only the PHI a task needs | A shared inbox keeps patient threads in one place; who sees what is a settings and policy question. |
A note on the blanks: Spruce's help-center article about its BAA returned an error when our research tried to read it, so the blanks mean "not described on the pricing page or homepage", not "missing". Ask Spruce for its security documentation.
What Spruce Health says
As of November 2026, Spruce lists two plans, both per user and month to month by default. Basic is "$24/month *" and includes HIPAA BAA, phone, text, video, fax, team chat, shared inbox, auto-replies and AI voicemail transcription. Communicator is "$49/month *", labeled "BEST VALUE", and adds IVR call flows, urgent escalation and after-hours triage, "Integrations & API Access", VoIP phone service, and AI transcription and summaries. The asterisk reads "Does not include taxes or fees".
Enabling outbound SMS is a one-time $19.50 fee, taxes and telecom fees are passed through as of November 1, 2025, larger practices may be asked for onboarding fees or an annual commitment, and SSO is an add-on without a shown price. All users in an organization must be on the same plan. There is a free 14-day trial with no credit card, with SMS texting excluded.
On HIPAA the wording is direct: "you electronically agree to the Spruce BAA when you create an organization on Spruce", and the BAA applies to "all Spruce trials and paid plans".
What a practice would have to do
- Create your organization on Spruce. That is the moment the BAA is agreed, so save a copy for your compliance file.
- Put every user on the same plan, because Spruce requires it. For 5 staff on Basic that is $120 a month before taxes and fees; on Communicator it is $245.
- Pay the $19.50 one-time fee if you will text patients, and plan for pass-through telecom fees on the bill.
- Decide which staff see which patient threads in the shared inbox, and write that decision down as your minimum necessary rule.
- Ask Spruce in writing for its audit, retention and encryption details, since the pricing page does not describe them, and keep the answer with the BAA.
The real risk in a small practice
With Spruce the risk is not the vendor. It is the two-app problem. Because Spruce costs $24 per user, a practice often buys it for the clinicians and the front desk and leaves the biller, the part-time receptionist and the weekend staff off it. Those people still need to talk to the team, so a WhatsApp or iMessage group keeps running beside Spruce.
That is where PHI leaks. "Did Mrs. Okafor's fax come through?" "Can someone move the 3:15 to Thursday, her son called." Each message is patient information in an app with no BAA, and the practice believes it is covered because it pays for Spruce. The fix is to put everyone on Spruce or to pair Spruce with a low-cost staff chat that signs a BAA.
Alternatives with a BAA
If what you want is a patient communication suite, buy Spruce. If you want internal chat beside it, these are covered options. Prices as of November 2026; verify on each site.
- Yodl: $10 a month for 5 users and one location, with a signed BAA on every plan, including the $10 one. Channels, threads, file sharing with previews for images, PDFs, spreadsheets and voice notes, 20 GB per location, and full-text search scoped to the rooms you belong to. Yodl is staff-to-staff only: no SMS, no calls, no patient messaging, so it pairs with Spruce rather than replacing it. See Yodl vs Spruce Health.
- OhMD: a patient messaging alternative whose Core plan is listed as "Starting at $300" per month, with a BAA listed.
- Google Workspace Business Starter: $7 per user a month on an annual plan or $8.40 flexible. The BAA is accepted in the Admin console, and Google's HIPAA page lists Google Chat, Gmail, Drive and Meet among covered services; third-party add-ons are not.
For most small practices the pairing works out to Spruce for patients and a covered staff chat for everyone else. Yodl's pricing is $10 a month for 5 people with the BAA included.
Spruce Health includes a BAA on every trial and paid plan and is built for patient communication, so the vendor half of HIPAA is handled. Budget $24 per user a month before fees, and make sure your internal staff chat is covered too.
Frequently asked questions
Does encryption make Spruce Health HIPAA compliant?
No single feature does. Encryption is an addressable safeguard, and the pages our research read do not detail Spruce's encryption, though the homepage shows HIPAA, HITRUST and SOC 2 badges. The BAA agreed at signup is what matters legally.
How much does Spruce Health cost with a BAA?
As of November 2026, Basic is $24 per user a month and Communicator is $49 per user a month, both month to month, both with the BAA included, and both before taxes and fees. Five users on Basic come to $120 a month before fees.
Is the Spruce free trial covered by the BAA?
Yes. Spruce's FAQ says the BAA applies to all Spruce trials and paid plans. SMS texting is excluded from the 14-day trial.
Can we use Spruce just for staff chat?
You can, since team messaging is in the Basic plan, but you would pay $24 per user for phone, fax and video you may not use. For staff-only chat, a tool like Yodl covers 5 people for $10 a month.
Does Spruce have an API?
"Integrations & API Access" is listed on the Communicator plan at $49 per user, with no separate API price shown. Yodl's API is $20 a month per workspace on any plan.