Twelve checks cover the security of a clinic's team chat: a signed Business Associate Agreement (BAA), subprocessor BAAs, encryption in transit and at rest, a clean privacy policy, invite-only membership, passkeys or strong passwords, an inactivity lock, roles and private channels, an audit log, retention with legal hold, notifications without message content, and device rules with same-day offboarding. Print it, check each item, and date it.
How to use this checklist
This is a yes-or-no list for the office manager or owner, not a technical audit. Each item is one thing to confirm in the vendor's documents or in the admin panel. Write the evidence next to each item (a document name, a screenshot, a setting), date the page, and file it with your HIPAA documentation. Repeat it twice a year and whenever you change tools.
Two terms you will see throughout. Protected health information (PHI) is any information that identifies a patient and relates to their health or care. A Business Associate Agreement (BAA) is the contract in which a vendor promises to protect PHI the way HIPAA requires; the practice, as a covered entity, must have it in place before the vendor handles PHI.
Items 1 to 4: the vendor
1. Signed BAA on your plan. Not on an enterprise tier you did not buy. Evidence: the signed PDF with the plan name on it.
2. Subprocessor BAAs. The vendor's hosting, email and storage providers must be under their own BAAs with the vendor. Evidence: the vendor's subprocessor list and a written yes.
3. Encryption in transit and at rest. TLS between the phone and the server, encrypted disks on the server. Evidence: the vendor's security page. End-to-end encryption is not required and usually gets in the way of items 9 and 10.
4. No data selling, no ads, no AI training on your messages. Evidence: the privacy terms. Yodl states all three plainly and hosts on HIPAA-eligible infrastructure with subprocessor BAAs.
Items 5 to 8: who gets in
5. Invite-only workspace. Nobody joins by link. Each person is invited to their exact work email. Evidence: a test invitation.
6. Passkeys or strong passwords, with email verification. Face ID or Touch ID sign-in is both safer and faster than passwords staff reuse. Evidence: the sign-in screen.
7. Inactivity lock. The app locks itself after a short idle period, so a phone left on a desk shows nothing. Yodl locks after 15 minutes. Evidence: leave it idle and watch it lock.
8. Roles and private channels. Viewers who can read but not post, members, managers, and admins. Private channels for clinical and owner topics. Evidence: your channel map with a role next to each name.
Items 9 to 12: what you can prove and what leaves the building
9. Audit log you can export. Sign-ins, membership changes, exports. Evidence: a CSV export from this month in your HIPAA folder.
10. Retention setting and legal hold. The setting matches the number in your policy, and a hold can pause deletion. Evidence: a screenshot of the setting and the policy paragraph.
11. Notifications without content. Push and email notices say there is a new message and nothing more, so a locked phone or a shared inbox never shows PHI. Evidence: a test message to your own phone.
12. Device rules and same-day offboarding. Every phone has a passcode, screenshots are banned, and departing staff are removed before they leave the building. Evidence: the signed policy and the offboarding checklist with a date column.
The checklist on one page
| # | Item | Pass? | Evidence |
|---|---|---|---|
| 1 | Signed BAA on the plan you bought | Signed PDF | |
| 2 | Subprocessor BAAs | Vendor list, written confirmation | |
| 3 | Encryption in transit and at rest | Security page | |
| 4 | No ads, no data selling, no AI training on messages | Privacy terms | |
| 5 | Invite-only workspace | Test invitation | |
| 6 | Passkeys or strong passwords | Sign-in screen | |
| 7 | Inactivity lock | Idle test | |
| 8 | Roles and private channels | Channel map | |
| 9 | Exportable audit log | This month's CSV | |
| 10 | Retention setting matches policy, legal hold available | Screenshot and policy | |
| 11 | Notifications without message content | Test message | |
| 12 | Device rules and same-day offboarding | Signed policy, exit checklist |
What to do with the items you failed
Items 1 to 4 are vendor facts. If the vendor fails any of them, no setting on your side fixes it; you need a different plan or a different vendor. Items 5 to 10 are settings; fix them today in the admin panel. Items 11 and 12 are habits; fix them with the policy and the next staff meeting. In practice the paperwork items are the ones most often missing, and they are the cheapest to fix.
How often to repeat it
Twice a year, and once more whenever you change tools, add a location, or have an incident. The second run takes ten minutes because the evidence is already in the folder. If you want a tool where items 1 to 11 are either included or a single setting, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Twelve yes-or-no checks: four about the vendor, four about access, four about proof and devices. Write the evidence next to each one, date the page, and repeat it twice a year.
Frequently asked questions
Does the checklist replace a HIPAA risk analysis?
No. The Security Rule requires a broader risk analysis of all your systems. This list covers the team chat piece of it and gives you evidence to attach.
Why is end-to-end encryption not on the list?
Because it prevents the audit log, search and retention controls that items 9 and 10 depend on. Encryption in transit and at rest is what HIPAA expects, and it keeps the admin controls working.
What if our vendor will not share its subprocessor list?
Treat item 2 as a fail and ask again in writing. A healthcare-ready vendor can name its hosting and email providers without hesitation.
Do we need all twelve to be compliant?
Compliance is about reasonable safeguards and documentation, so a single missed item is not automatically a violation. But each one is cheap, and a documented fail you never fixed is hard to explain later.
Can a free chat app pass this list?
Rarely. The BAA and the admin controls are usually the first things left out of free plans. Check item 1 before spending time on the rest.