Only with an add-on. Zenzap will sign a Business Associate Agreement (BAA), but as of November 2026 it sells "HIPAA Compliance + Signed BAA" as a paid add-on with no published price, available by contacting sales, and no base plan includes it. Get the add-on and the signed agreement before any patient information goes in.
The short answer and why
Zenzap is a team chat app for small and mid-size businesses, with AI agents that act inside chats and a Medical page among its industry pages. The HIPAA answer has two halves. Yes, Zenzap offers a BAA. No, not on any plan as listed: it arrives only with an add-on whose price is not on the site.
A BAA, or Business Associate Agreement, is the contract HIPAA requires before a vendor can store or send PHI, protected health information, meaning any detail that identifies a patient and relates to their care. The practice is the covered entity, the organization HIPAA applies to directly, and the vendor becomes its business associate once the BAA is signed (45 CFR 164.502(e) and 164.308(b)).
Gating the BAA behind an add-on is not unusual; Slack also limits HIPAA to its top tier. It only means a practice cannot sign up for the free plan, start chatting about patients and assume it is covered. Terms change, so verify on zenzap.co.
What HIPAA actually asks of a chat app
The Security Rule lists safeguards rather than products. Here is Zenzap against each one, using only its pricing page, FAQ and trust center.
| Requirement | What the rule needs | What Zenzap offers per its own site |
|---|---|---|
| Signed BAA | A written contract before any vendor touches PHI | Yes, as the "HIPAA Compliance + Signed BAA" add-on. Price not published; by contacting sales. |
| Access controls | Only the right people see each conversation | Admin permissions listed; SAML, SCIM and SSO on Enterprise. |
| Audit log | A record of who read, sent and deleted what | Listed on the Enterprise plan only. |
| Encryption in transit and at rest | Protect data while moving and while stored | Trust center lists "Encryption-at-rest"; transit not stated on the pages read. |
| Retention and deletion | Keep records as long as policy says, then delete | "Data archiving" is listed; retention settings are not described. |
| Minimum necessary | Share only the PHI a task needs | No tooling described; a staff policy question on any app. |
Audit logs appear only on Enterprise, so a practice on Business+ should ask whether the add-on brings one along, and ask about encryption in transit, which the trust center does not mention on the pages we read.
What Zenzap says
As of November 2026, the pricing page lists Free at $0 with "Unlimited users", 100 AI credits a month and 1 GB of storage. Business+ is "$50 total / month" for "Up to 5 users", with 400 AI credits and 10 TB of storage; the annual toggle is selected by default and a monthly rate is not shown separately. Lite, labeled "Just chat, no AI", is "$51 total / month" for up to 20 users with 100 GB. Enterprise is custom, with SAML, SCIM, SSO, audit logs, encryption key management and a custom SLA. Larger tiers show "Book a Demo" instead of a price.
The add-on is listed as "HIPAA Compliance + Signed BAA", described as "For teams handling protected health information", and the FAQ says it is available by contacting sales. The homepage shows a HIPAA badge, but that pricing line and FAQ answer are the only written HIPAA statements our research found. The trust center shows SOC 2 Type 2, ISO/IEC 27001, GDPR and HIPAA badges with the documents gated.
In Zenzap's favor, the product is more than chat: AI agents inside chats, workflows with over 400 connectors claimed, to-dos, scheduled messages, voice and video calls on Business+ and Lite, and a public API.
What a practice would have to do
- Contact Zenzap sales and ask for the HIPAA add-on price and which base plan it requires. Get the number in writing, because it is not on the site.
- Read the BAA before you sign it. Check whether it covers the AI agents that read your chats and the connectors you plan to turn on.
- Ask whether the add-on includes an audit log on Business+, and ask for an encryption-in-transit statement in writing.
- Set admin permissions so only the staff who need a channel are in it, and write that down as your minimum necessary rule.
- Keep PHI out of Zenzap until the signed BAA is back in your inbox. The free plan is fine for a test with made-up names.
The real risk in a small practice
Picture a med spa with two injectors and one front desk lead. They pick Zenzap's free plan because it costs nothing and allows unlimited users, and they use the WhatsApp migration tool to bring over a year of group chat full of before-and-after photos, treatment notes and phone numbers. Now it sits in a workspace with no BAA, with AI agents able to read it.
The risk is not Zenzap's product. It is the gap between a HIPAA badge on a homepage and an add-on that was never bought. That gap is invisible until a phone is stolen, an employee leaves angry or a patient asks who saw her photos. Then the practice needs a signed BAA, an audit trail and retention controls, and on the free plan it has none.
Alternatives with a BAA
Prices below are as of November 2026 and change; verify on each site.
- Yodl: $10 a month for 5 users and one location, with the BAA included on every plan and signed at checkout with no sales call. Invite-only workspaces, channel roles, retention controls with legal hold, an audit viewer with CSV export and a 13-gate HIPAA readiness checklist in the admin panel. 20 GB per location; extra users $2 each. No AI in the $10 plan; the optional PhiClaw AI teammate is a separate product. See Yodl vs Zenzap.
- Hypercare: Starter is shown at "$8 USD / month", with a second price set showing $10, and the site does not label which is annual and which is monthly. Starter and up include a signed BAA; the 90-day free trial does not.
- Chanty: Business is "$3 user/month" on the plan card, which the FAQ explains as $3 per user billed annually or $4 monthly, and it lists "HIPAA compliance and BAA". The Free plan for up to 5 members does not. For 5 people that is $15 a month at the annual rate.
If you like Zenzap's AI agents, buy the add-on and get the BAA signed first. If you mainly need a covered place for staff to talk, Yodl's pricing is $10 a month for 5 people with the BAA included.
Zenzap will sign a BAA, but only as an unpriced add-on sold through sales, so no Zenzap plan is covered as listed. Get the price and the signed agreement in writing before any patient detail goes in.
Frequently asked questions
Does encryption make Zenzap HIPAA compliant?
No. Encryption is an addressable safeguard in the HIPAA Security Rule: you use it or document why not. Zenzap's trust center lists encryption at rest; ask about transit. Neither replaces the signed BAA, which on Zenzap comes only with the add-on.
How much does Zenzap cost with a BAA?
Zenzap does not publish it. As of November 2026, Business+ is "$50 total / month" for up to 5 users and the HIPAA add-on is priced by contacting sales, so the real total is $50 plus an unpublished amount.
Is Zenzap's free plan HIPAA compliant?
No plan is on its own. The free plan has unlimited users and 1 GB of storage, and the BAA comes only through the add-on. The site does not say whether the add-on can attach to the free plan, so ask.
Can Zenzap's AI agents see patient information?
Only after the BAA is signed, and only if the BAA covers them. Ask Zenzap in writing what the agents read, what they store and whether that is inside the agreement.
How does Yodl compare on price?
Yodl is $10 a month for 5 users with the BAA included, against Zenzap's $50 a month for 5 users plus an unpublished add-on. Zenzap includes AI agents and calls; Yodl does not.