HIPAA-compliant chat for clinic and practice staff

No chat app is HIPAA compliant on its own. A staff chat tool can be used in a HIPAA-compliant way when three conditions are met: the vendor signs a Business Associate Agreement (BAA), the tool provides the required safeguards, and your practice configures and uses it correctly. Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA. This page covers what to check in any chat tool, where Chanty fits, what your practice still owns, and how the common options compare.

Short answer: what makes a chat app HIPAA compliant

HIPAA does not certify software. No government "HIPAA-certified" label exists for chat apps. When a vendor uses that phrase, it is describing its own assessment.

HIPAA does require two things from a covered entity that uses a vendor to handle PHI:

• A BAA with any vendor that creates, receives, maintains or transmits PHI on its behalf.
• Appropriate safeguards for that data HHS guidance states that a cloud provider that creates, receives, maintains or transmits ePHI for a covered entity is a business associate, even if it stores only encrypted data without the key, and must sign a BAA (hhs.gov).

Are chat programs an acceptable way to communicate about PHI? They can be. HIPAA does not ban messaging between staff. It sets conditions for doing it safely HHS says providers may share PHI for treatment "orally or in writing, by phone, fax, e-mail, or otherwise" as long as they use reasonable safeguards (hhs.gov). The usual risk is the setup, not chat itself. Consumer messengers and personal text threads often have these gaps:

• No BAA with the vendor.
• No admin control over accounts.
• No reliable way to remove a former employee from the group.

For Chanty: HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI. For the product overview, see the HIPAA-compliant messaging app for healthcare teams page.

Scope of this page: internal staff chat. That means front desk, administrative staff, operations, clinic managers, and clinical staff working in approved operational workflows. It does not cover messaging or texting patients. For texting and patient-communication topics, see our healthcare communication and HIPAA guides.

HIPAA requirements a staff chat tool must meet

Take this checklist into any vendor evaluation.

Contract

• A signed BAA before any PHI is shared Under 45 CFR 164.502(e), PHI may go to a business associate only after satisfactory assurances, documented in a written contract that meets 164.504(e) (ecfr.gov). Ask three questions:
  • Which plan includes the BAA?
  • Which services does it cover: messages, files, voice notes, calls?
  • What does it exclude?

Technical safeguards (45 CFR 164.312): access control, with unique user identification and emergency access procedure required, automatic logoff and encryption addressable; audit controls (required standard); integrity, with ePHI authentication addressable; person or entity authentication (required standard); and transmission security, with integrity controls and encryption addressable. (ecfr.gov)

• Access control. Each person needs a unique login. Avoid a shared "frontdesk@" account. Roles should limit who sees which conversations, and an admin should be able to cut off access immediately.
• Audit controls. Ask what activity the vendor logs and who can review those logs.
• Integrity. Ask how data is protected from improper changes or loss, for example through replication and backups.
• Person or entity authentication. Two-factor authentication (2FA) or SSO ensures a login reliably identifies the person behind it.
• Transmission security. Data should be encrypted in transit. Ask which protocol version the vendor uses.

Administrative side

• Minimum necessary. Staff share only the PHI the task requires Under 45 CFR 164.502(b), the minimum necessary standard does not apply to disclosures to or requests by a provider for treatment, but limiting chat content and keeping access role-based is still good practice (ecfr.gov). In practice, a message like "Patient in room 3 needs prior auth before the MRI, details in the chart" beats pasting a history into chat.
• Retention. Decide how long messages are kept, then configure the tool to match.
• Offboarding. Remove departing staff the same day, including on their phones.
• Training. Staff should know what belongs in chat, what belongs in the EHR, and what is never shared.

Our free HIPAA tools and templates hub has templates you can adapt for this review.

How Chanty supports HIPAA-compliant staff chat

	Free	Business	Enterprise
HIPAA and BAA	No BAA	HIPAA compliance and signed BAA	HIPAA compliance, BAA and negotiated MSA
Encryption	TLS 1.2+ in transit; encrypted file storage	Same	Same
Login and identity	2FA and SSO not included	One-time-code login, 2FA, SSO	SAML SSO, directory sync, SCIM
Roles and permissions	Not included	Customizable roles; 120+ permission settings	Unlimited custom roles
Retention settings	Not included	Customizable retention	Customizable retention
IP allowlisting	Not included	Included	Included
DLP and governance controls	Not included	Not included	Included
Data residency and on-premise	No regional commitment	No regional commitment	US, EU or APAC residency; on-premise option

Encryption. Data in transit uses TLS 1.2+ with forward secrecy and AES-128-GCM. File system and file storage are encrypted. Chanty is not end-to-end encrypted, so describe it to your security officer as "encrypted in transit and in storage." Chanty has not published the algorithm or key-management details for storage encryption. Raise this during your security review.

Access and identity. Permissions span more than 120 settings. They control what each person can see and do, so you can keep billing conversations away from staff who don't need them. Enterprise adds SCIM, so accounts can be created and removed from your directory instead of by hand.

Guests. Contractors, vendors and outside billing services join as guests. Guests are limited to the conversations you select and stay separate from internal teams. Business includes 3 free guest seats per paid member.

Integrity and testing. The database uses synchronous replication, and snapshots are stored in a separate data center. Chanty runs application and infrastructure penetration tests.

Certifications and hosting. Chanty lists SOC 2 Type II and ISO/IEC 27001 but does not publish scope, report period or certificate dates, so request the SOC 2 report and ISO certificate before signing (chanty.com). Hosting runs on Amazon Web Services (EC2, S3, Elasticsearch). The default AWS region is not published. Regional data residency and on-premise deployment are Enterprise only. Full security, HIPAA and BAA details are on the security page.

What clinic teams use it for, and what it is not

Front desk and admin coordination. Set up a channel per location, use threads for each issue, and @mention the person who needs to act. For example: "@Maria, insurance verification for tomorrow's first three appointments isn't done yet." Message history is unlimited and searchable, so last month's decision on a payer policy is still findable.

Announcements, procedures and files. Pin the updated after-hours phone procedure in each location's channel and share the current version of forms and checklists. Business adds:

• Company-wide announcements and scheduled posts.
• Polls and surveys.
• An employee directory.
• Onboarding tools.

Tasks with an owner. Turn any message into a task in one click and give it an owner, a due date, a status and a priority. Suppose someone posts "The Eastside autoclave is showing an error again." That message becomes a task for the operations manager, due Friday, and it is tracked on the Kanban board until it is closed. Teambook gathers tasks, files, links and pinned messages in one place.

Voice notes and calls. Staff can send voice notes on every plan. That suits a medical assistant between rooms who can't stop to type. Free includes unlimited 1:1 calls. Business adds unlimited group calls and screen sharing for routine staff calls, such as the weekly managers' check-in. Before discussing PHI on calls or screen shares, confirm that the BAA covers them Chanty does not publish what its BAA covers service by service, so confirm in writing that messages, files, voice notes, calls and screen sharing are all included (chanty.com). Apps are available for iOS, Android, macOS, Windows and web.

What it is not. Chanty is not:

• Patient messaging or telehealth.
• An EHR or EMR.
• A clinical documentation tool.
• An urgent clinical alerting or clinical handoff system.

It runs alongside those systems and handles the operational work around them. See more on healthcare communication software for clinics.

What stays your responsibility

A BAA covers the vendor's side. Your practice still owns the following:

• Sign the BAA before anyone shares PHI. Keep PHI off the Free plan entirely, including during a trial.
• Configure roles, permissions and retention. Defaults are not a policy. Decide who sees each channel.
• Manage access and offboarding. Remove departing staff the same day, and review guest access every quarter.
• Secure staff devices. Require screen locks on phones that run the app, especially personal phones.
• Write staff policies and run training. Include the policy in new-hire onboarding.

Third-party integrations are outside Chanty's BAA scope. If you connect Google Drive, Dropbox, Zapier, Make or n8n, data that flows through them falls under that vendor's terms. Evaluate each integration and check whether it offers its own BAA before PHI passes through it. You can check whether other tools are HIPAA compliant in our tool checks.

AI agents are available on the Enterprise plan only. Agents work inside conversations, and Chanty states that conversations are not used to train outside models. However, BAA coverage of agent processing and of connected external models is not documented. Do not route PHI to agents until Chanty confirms coverage in writing Chanty's homepage names GPT, Claude, custom agents and MCP connections with an audit trail and human approval, but nothing official addresses BAA treatment of agents or connected models (chanty.com).

Comparing HIPAA chat options: Slack, Teams, Google Chat, WhatsApp and open source

Tool	BAA availability and required plan	Notes
Chanty	Business and Enterprise; none on Free	Internal staff chat, calls, tasks and files
Slack	Enterprise plans only (Enterprise Grid), with a signed BAA and Slack's HIPAA requirements; no BAA coverage for third-party apps (slack.com)	General-purpose team chat; larger native integration catalog than Chanty
Microsoft Teams	BAA via Microsoft's Data Protection Addendum, with Teams in scope; qualifying subscriptions not confirmed (learn.microsoft.com)	Bundled with Microsoft 365, with native meetings and telephony
Google Chat	Covered under the Google Workspace BAA, which an admin must accept; Google Chat is on the HIPAA Included Functionality list (support.google.com)	Bundled with Google Workspace
WhatsApp	No BAA; Meta says it is not a business associate (whatsapp.com)	Consumer messenger that staff groups often adopt informally
Mattermost	No published BAA offer found; HIPAA guidance is for customer-run deployments (docs.mattermost.com)	Self-hosted team chat for regulated industries
Rocket.Chat	BAA available on commercial enterprise plans; self-managed deployment option (rocket.chat)	Open-source team chat; self-hosting is its compliance approach
Spruce Health	Signed BAA included on every plan (sprucehealth.com)	Leads with patient communication; also team chat, phone and fax for independent practices
qliqSOFT	BAA available, including AI features; SOC 2 Type II (qliqsoft.com)	Secure texting and care-team messaging

As a Slack alternative. Practices that switch to Chanty usually cite three reasons:

• Lower per-seat cost Chanty Business is $3 per user/month billed annually versus $7.25 for Slack Pro, though Slack's HIPAA-eligible Enterprise tier has no published price (chanty.com).
• Simpler setup.
• Unlimited message history on the free plan.

Chanty includes a BAA on Business. The tradeoff is integrations. If your workflows depend on a specific Slack app, check whether Chanty or an automation platform covers it before you switch.

Open-source and self-hosted. Mattermost and Rocket.Chat use self-hosting as their compliance approach. Your team runs the servers and owns that security work. Chanty is not open source. On-premise deployment is available only on the Enterprise plan.

Healthcare-specific tools. Spruce Health and qliqSOFT focus on patient communication, secure texting and care-team messaging. Chanty's scope is different: internal staff coordination, meaning announcements, requests and tasks with owners. Some practices pair a patient-communication tool with a separate staff workspace.

See the full vendor pages in team chat tools compared for HIPAA.

Plans, limits and fit

• Free: up to 5 members, 10 integrations and 20 GB per team, with unlimited searchable history. No BAA. Use it to try the product without PHI.
• Business: HIPAA compliance with a signed BAA. Adds unlimited group calls and screen sharing, customizable roles and retention, SSO, 2FA, IP allowlisting and internal communications tools. Includes a 99.9% uptime guarantee (chanty.com) at $3 per user/month billed annually or $4 billed monthly (chanty.com).
• Enterprise: AI agents with an audit trail of agent actions and governance controls. Adds SAML SSO, directory sync and SCIM, DLP, US/EU/APAC data residency, on-premise deployment, white labeling and a negotiated MSA Pricing is by custom quote from sales, with a negotiated MSA alongside the BAA. (chanty.com).

Honest limits:

• Task management is basic: lists and a Kanban board. It is not suited to complex projects.
• About 28 native integrations (chanty.com). Zapier, Make and n8n extend the catalog.
• No shift scheduling, time tracking or HR functions. Keep your workforce management system.
• Some user reviews report video-call and notification reliability issues. Test on your own network and devices.
• The AI models and agent frameworks Chanty supports are not publicly documented.
• Practices standardized on Microsoft 365 that want Teams-native meetings and telephony may be better served by Teams.

Moving staff off personal messengers: getting started

1. Choose Business or Enterprise, then sign the BAA before you invite any staff.
2. Set up roles and channels. Create one channel per location, one per team (front desk, billing, managers), and one company-wide announcements channel. Restrict billing and HR channels to the roles that need them.
3. Add guests narrowly. Your IT contractor joins the IT channel only. Your outside biller joins one shared billing conversation.
4. Publish a one-page staff policy. Cover three things:
   • What goes in chat: scheduling issues, supply requests, coverage questions.
   • What goes in the EHR: anything clinical about a patient.
   • What is never shared: screenshots of charts and photos of patient documents.
5. Retire the old groups. Set a cutover date and post a pinned message in the old group pointing to Chanty.

Chanty's messenger-like interface looks familiar to anyone who uses WhatsApp, so training usually takes one short session. For related workflows, browse the operations library for practice managers. When you're ready, start at chanty.com/signup.

FAQ

Is there such a thing as a HIPAA-certified chat app?

No. HIPAA has no software certification. A chat app can support compliance through a signed BAA and the right safeguards. Compliance also depends on how your practice configures and uses the tool.

Are chat programs an acceptable way to communicate about PHI?

They can be, when the vendor has signed a BAA, safeguards are in place, and staff follow the minimum necessary standard ; minimum necessary applies outside treatment disclosures, and HHS permits sharing PHI for treatment by phone, e-mail or otherwise with reasonable safeguards (hhs.gov). Consumer messengers without a BAA are the common risk.

Does Chanty sign a BAA, and on which plan?

Yes. The Business plan includes HIPAA compliance and a signed BAA. Enterprise includes HIPAA compliance, a BAA and a negotiated MSA.

Can we use Chanty's free plan for patient information?

No. The Free plan has no BAA, so keep PHI off it. Use Free only to try the product.

Is Chanty end-to-end encrypted?

No. Chanty encrypts data in transit with TLS 1.2+ and encrypts file storage.

Is Chanty a HIPAA-compliant Slack alternative?

Chanty is HIPAA-compliant with a signed BAA on Business and Enterprise. Practices choose it over Slack mainly for cost and simpler setup. Slack offers more native integrations. Check Slack's own BAA terms Slack signs a BAA only on Enterprise plans (Enterprise Grid), limits PHI to messages and files, and does not cover third-party apps (slack.com).

Is there an open-source HIPAA-compliant chat, and can Chanty be self-hosted?

Mattermost and Rocket.Chat are self-hosted options that rely on self-hosting as their compliance approach ; in fact, Mattermost publishes deployment guidance but no BAA offer, while Rocket.Chat offers a BAA on its commercial enterprise plans (rocket.chat). Chanty is not open source. On-premise deployment is available only on the Enterprise plan.

Are voice messages and calls covered by the BAA?

Voice notes on Business and Enterprise fall within the BAA scope, along with messages and files. Coverage of audio and video calls and screen sharing should be confirmed before you discuss PHI on them ; note that Chanty does not publish its BAA scope service by service, and voice notes also exist on Free, which has no BAA, so confirm coverage of messages, files, voice notes, calls and screen sharing (chanty.com).

Can staff use Chanty to message patients?

No. Chanty is internal communication for staff. It is not patient messaging, patient texting or telehealth.

Are integrations and AI agents covered by Chanty's BAA?

Third-party integrations are outside Chanty's BAA scope. Evaluate each integration and check its own BAA. AI agents are available on Enterprise only. Their BAA coverage, and that of connected models, is not documented, so don't send PHI to agents until Chanty confirms coverage in writing ; note that Chanty does not actually state integrations are excluded, it just doesn't say they are covered, so treat them as outside the BAA unless confirmed (chanty.com).