Partly, and you must check the fine print. As of November 2026, Zoom says healthcare organizations can sign a Business Associate Agreement (BAA) with Zoom, and its healthcare bundles list "HIPAA-compliant + BAA". The pages our research read name Zoom Phone and Zoom Meetings under that BAA but do not explicitly name Team Chat, so before staff discuss patients in Zoom Team Chat you need written confirmation from Zoom that chat is covered.
The short answer and why
Zoom Team Chat is the messaging part of Zoom Workplace, included in every plan, even the free Basic plan. Many practices already pay for Zoom for telehealth, so Team Chat looks like free staff chat from a vendor they trust. That instinct is half right.
HIPAA requires a BAA, a Business Associate Agreement, before a vendor stores or transmits PHI, protected health information, which is any detail that identifies a patient and relates to their care. The practice is the covered entity, the organization HIPAA applies to directly. A BAA is not a blanket. It lists the services it covers, and a service outside that list is just a service.
So Zoom's BAA question has two layers. Does Zoom sign one? Yes, for healthcare organizations. Is Team Chat inside it? The current pages our research read name Phone and Meetings; older Zoom materials listed Zoom Chat under Zoom for Healthcare, but the current pages do not say so. Terms change, so verify on zoom.com.
What HIPAA actually asks of a chat app
The Security Rule asks for safeguards, not brand names. Here is Zoom Team Chat against that list, using only Zoom's pricing, HIPAA and healthcare pages.
| Requirement | What the rule needs | What Zoom Team Chat offers per its own site |
|---|---|---|
| Signed BAA | A written contract before any vendor touches PHI | Yes: "Healthcare organizations can sign a Business Associate Agreement (BAA) with Zoom". Phone and Meetings are named; Team Chat is not. |
| Access controls | Only the right people see each conversation | SSO and managed domains are listed on the Business plan and above. |
| Audit log | A record of who read, sent and deleted what | "Archival and DLP APIs" on Business and above; a built-in audit view is not described. |
| Encryption in transit and at rest | Protect data while moving and while stored | Not discussed on the Zoom HIPAA page our research read. |
| Retention and deletion | Keep records as long as policy says, then delete | Archival APIs on Business and above; chat retention settings are not described. |
| Minimum necessary | Share only the PHI a task needs | No tooling described; set by your channel design and policy. |
Notice how many controls sit on Business ($18.33 per user a month billed annually) rather than Pro.
What Zoom says
As of November 2026, Zoom's pricing page lists Basic as free, with Team Chat described as instant messaging and meetings capped at 40 minutes and 100 participants. Pro is $16.99 per user a month billed monthly or $14.16 billed annually. Business is $21.99 monthly or $18.33 annually, with SSO, managed domains and archival and DLP APIs. Enterprise is contact sales. The healthcare bundles, Essentials, Patient Connect and Complete, are $20.50, $45.50 and $49.50 per user a month billed annually, or $24, $49 and $54 monthly. Essentials includes Zoom Phone Pro Plus and lists "HIPAA-compliant + BAA".
On HIPAA, Zoom's small-business healthcare page says "Healthcare organizations can sign a Business Associate Agreement (BAA) with Zoom", naming Zoom Phone and Zoom Meetings. Its HIPAA page says Zoom "aligns its controls to the HITRUST CSF" and offers a SOC 2 plus HITRUST report and a HIPAA Compliance Guide. The BAA process and plan eligibility are not detailed on those pages.
In Zoom's favor: one vendor for video visits, phone and chat has real appeal, and the healthcare bundles bring the BAA into the price. The chat question is narrow: is it in the contract?
What a practice would have to do
- Be on a paid Zoom account under the practice's name. The healthcare bundles list the BAA outright; on Pro or Business, request it, since the pages do not spell out eligibility.
- Read the list of covered services in the BAA. If Team Chat is not named, ask Zoom in writing whether it is covered, and keep the reply with the signed agreement.
- If Zoom will not confirm chat coverage, keep patient discussion in Meetings and Phone, which are named, and move staff chat to a tool whose BAA covers it.
- Make sure every staff member is under the practice's account. Team Chat also exists on free Basic accounts, and a personal account was never part of any BAA.
- Write the channel rules: which channels may hold PHI, who is in them and how long messages are kept.
The real risk in a small practice
The risk here is assumption. A behavioral health group pays for Zoom Pro for sessions and signed a BAA two years ago for video. The clinicians naturally use Team Chat to coordinate between sessions: "Client in room 2 is in crisis, can you join?" Nobody checks whether the BAA's service list includes chat.
If the list names Meetings and Phone only, every one of those messages is PHI outside the contract. The practice would find out only when it matters: a lost laptop, a records request or a complaint. Then it would be explaining to the HHS Office for Civil Rights (OCR) why patient details sat in a service its own BAA did not mention.
Alternatives with a BAA
If Zoom confirms chat coverage, you may be done. If it does not, or you would rather not wait, these are covered options. Prices as of November 2026; verify on each site.
- Yodl: $10 a month for 5 users and one location, with a signed BAA on every plan and no scope question, because chat is the whole product. Channels, threads, 20 GB of files per location, an audit viewer with CSV export, retention controls with legal hold, passkeys with Face ID or Touch ID and a 15-minute inactivity lock. No video or voice calls: keep Zoom for visits and use Yodl for staff.
- Google Workspace Business Starter: $7 per user a month on an annual plan or $8.40 flexible. The BAA is accepted in the Admin console, and Google's HIPAA page lists Google Chat and Google Meet among the services it covers.
- Celo: a Free plan for up to 10 users that lists HIPAA compliant messaging without a BAA line, and a Growth plan at $49 a month billed annually for up to 20 users that lists a Business Associate Agreement (BAA). Built for care teams.
Whichever you choose, get chat named in a signed BAA before staff use it for patients. Yodl's pricing is $10 a month for 5 people with the BAA included.
Zoom will sign a BAA with healthcare organizations, but the pages our research read name Phone and Meetings, not Team Chat. Get Zoom to confirm chat coverage in writing, or use Zoom for video and a chat tool with a clear BAA for staff messages.
Frequently asked questions
Does encryption make Zoom Team Chat HIPAA compliant?
No. Encryption is one addressable safeguard in the Security Rule, and the Zoom HIPAA page our research read does not discuss it for chat. What decides the question is the signed BAA and whether Team Chat is inside its scope.
How much does Zoom Team Chat cost with a BAA?
As of November 2026, the Healthcare Essentials bundle lists "HIPAA-compliant + BAA" at $20.50 per user a month billed annually, or $24 monthly, and includes Zoom Phone Pro Plus. Pro is $14.16 annual or $16.99 monthly with the BAA on request.
Can we use the free Zoom Basic plan for staff chat about patients?
Team Chat is included on Basic, but the Zoom pages our research read do not describe a BAA for free accounts, so treat a Basic account as uncovered.
We already signed a BAA with Zoom for telehealth. Does it cover chat?
Check the covered services list in your copy. If Team Chat is not named, ask Zoom in writing and keep the answer.
Is Yodl a replacement for Zoom?
No. Yodl has no video or voice calls and is not for patient messaging. It replaces the staff chat part only, which is why many practices keep Zoom for visits and use Yodl for the team.