Is Signal, iMessage or GroupMe HIPAA Compliant?

For work messages that may contain protected health information (PHI), treat Signal, iMessage and GroupMe as off-limits. Strong encryption does not change that. Under HIPAA, a vendor that handles PHI for your practice must sign a business associate agreement (BAA), and your practice must be able to control who has access and what happens to the records. Consumer messengers are built for individuals, so they generally provide neither. The sections below give the verdict for each app, explain why, and describe what to use for internal staff chat instead.

The short answer

• Signal: Do not use it for PHI. Unless Signal signs a BAA with your practice, PHI does not belong there, and consumer messengers built for individuals generally do not offer one.
• Apple iMessage / iPhone texting: Do not use it for PHI. Apple does not offer a BAA for iMessage or iCloud Apple's iCloud Terms prohibit covered entities and business associates from using iCloud to create, receive, maintain or transmit PHI, or in any way that would make Apple their business associate. We found no Apple statement that addresses iMessage specifically. (apple.com).
• GroupMe: Do not use it for PHI. GroupMe is not covered by a Microsoft BAA GroupMe is a consumer service under the Microsoft Services Agreement and does not appear in the in-scope services list on Microsoft's HIPAA/HITECH compliance page. (learn.microsoft.com).

No app is "HIPAA compliant" by itself. Compliance depends on how your organization uses a tool. When a vendor creates, receives, maintains or transmits PHI on your behalf, HIPAA requires a signed BAA with that vendor Under 45 CFR 164.502(e), a covered entity may let a business associate create, receive, maintain or transmit PHI only with satisfactory assurances documented in a written contract or other written arrangement, and 45 CFR 164.504(e) sets what that contract must contain. (ecfr.gov).

The practical rule is simple. No BAA means no PHI in that app. That holds even in a "private" group limited to staff, and even when the messages are encrypted.

To skim, jump to the side-by-side table below. For other workplace tools, see our team chat tools compared for HIPAA and our check of whether Google Chat is HIPAA compliant.

Why encryption alone doesn't make an app HIPAA compliant

Encryption is a technical safeguard, and only one part of what HIPAA asks for. The Security Rule also covers administrative and physical safeguards The administrative safeguards in 45 CFR 164.308 require a risk analysis, workforce security measures and business associate contracts (164.308(b)). (ecfr.gov). These include a risk analysis, workforce access management, and contracts with business associates. An app can encrypt every message perfectly and still leave the practice unable to meet those requirements.

To run a staff messaging tool responsibly, a practice needs:

• Admin-managed accounts. The practice decides who is in the workspace. Each person does not decide alone.
• Offboarding. When a medical assistant leaves, you can remove their access to work conversations that same day.
• Role-based permissions. Front desk, billing and clinical leads see what their roles require.
• Retention settings. Messages are kept or deleted under your policy. Each user's settings do not decide it.
• Audit capability. You can reconstruct who had access to what.

Consumer messengers tie accounts to a person's own phone number or Apple ID. That design is deliberate, and it works for personal use. It means the practice owns none of the controls above.

The conduit exception myth. Some staff assume a messaging app is a "conduit," like the postal service, and needs no BAA. HHS describes the conduit exception as narrow. It covers transmission-only services, not services that store messages In FAQ 2077, HHS limits the exception to transmission-only services, allowing only temporary storage incident to transmission. A service that stores ePHI is a business associate even if it cannot read the data because it is encrypted. (hhs.gov). Messaging apps that store messages, sync history across devices or keep backups generally do not qualify.

HHS Office for Civil Rights enforcement and state privacy laws can also apply to how a practice handles messages . Ask your counsel which rules apply to your practice.

Signal and HIPAA

Signal is known for end-to-end encryption through the Signal Protocol and for collecting very little user data Signal's Terms say it cannot access users' messages, holds end-to-end encrypted messages only until offline devices retrieve them, and stores message history on users' own devices. Its support site says Signal is designed to never collect or store sensitive information. (signal.org). As a private messenger, that is its main strength.

Encryption is not the issue for HIPAA. The BAA is. Unless Signal signs a BAA with your practice, PHI does not belong in it, however strong the encryption.

Signal also has operational gaps for a practice:

• Personal identity. Accounts are registered with a personal phone number Strictly, Signal requires a phone number that can receive an SMS or call, usually the employee's own. Optional usernames work alongside that number rather than replacing it. (support.signal.org). The account belongs to the employee, not the practice.
• No central admin console. No one at the practice can see all work groups, set policies or provision accounts.
• Limited offboarding. A group admin can remove a member. Messages already delivered to that person's device generally stay there Signal's Terms say message history is stored on users' own devices, and admins can delete a member's message for everyone only within 24 hours of sending. (support.signal.org).

Disappearing messages are not a retention policy. Auto-deleting messages after a day can look like a privacy win. Your practice may still have record-retention obligations for some communications Ask your counsel which retention requirements apply to your practice.. Disappearing messages are also set per conversation, and anyone in the conversation can change them or take a screenshot first. A retention policy is something the organization sets, applies consistently and can document.

iMessage and iPhone texting and HIPAA

"Texting on an iPhone" covers two different things:

• iMessage (blue bubbles): Apple's service between Apple devices, end-to-end encrypted Apple Platform Security says iMessage messages and attachments are protected by end-to-end encryption so no one but the sender and receiver can access them. (support.apple.com).
• SMS/MMS (green bubbles): Used when a recipient is not on iMessage, or when iMessage is unavailable. These messages travel over carrier networks and are not end-to-end encrypted.

Apple does not offer a BAA for iMessage, iCloud or other consumer services Apple's iCloud Terms prohibit covered entities and business associates from using any part of iCloud to create, receive, maintain or transmit PHI. We found no Apple statement covering iMessage or other consumer services specifically. (apple.com). Without a BAA, iMessage is not an appropriate channel for PHI, however strong its encryption.

iPhone messaging also creates exposure points that are easy to overlook in a clinic:

• iCloud backups and Messages in iCloud. Whether Apple can access backed-up messages depends on settings such as Advanced Data Protection By default, iCloud uses standard data protection, under which Apple holds the encryption keys. Advanced Data Protection is optional (iOS 16.2 and later) and adds end-to-end encryption to iCloud Backup and other data categories. (support.apple.com).
• Shared or family devices. Messages can sync to an iPad at home that a spouse or child uses.
• Lock-screen previews. "Mrs. Lopez called about her biopsy results" can appear on a screen at the front desk.
• Lost or replaced phones. The practice cannot wipe work messages from a personal device.

So, is iPhone texting HIPAA compliant? Standard SMS is not end-to-end encrypted. Carriers do not sign BAAs for consumer texting That is not the core issue, though: under HHS's conduit guidance (FAQ 2077), a transmission-only carrier may not need a BAA at all. The real problem with SMS is security. (hhs.gov). iMessage is encrypted, but it has no BAA and gives the practice no admin control. Neither one is a sound choice for PHI.

GroupMe and HIPAA

GroupMe is a free group messaging app owned by Microsoft GroupMe's help pages are hosted on Microsoft Support, and the service is governed by the consumer Microsoft Services Agreement. (microsoft.com). Its encryption matters less for HIPAA than whether a BAA covers it.

A common assumption is that Microsoft's healthcare BAA covers every Microsoft product. It does not work that way. Microsoft's BAA applies to specific enterprise services listed in its product terms, such as Microsoft 365 and Teams. GroupMe is not among them More precisely, Microsoft provides its BAA by default through the Microsoft Online Services Data Protection Addendum. It covers the in-scope services listed on Microsoft's HIPAA/HITECH compliance page, such as Office 365, Microsoft Teams and Dynamics 365, and GroupMe is not on that list. (learn.microsoft.com). If you are weighing Microsoft's enterprise tools, see Microsoft Teams and HIPAA.

GroupMe is popular with shift-based teams because joining is so easy. New staff can join from a link, and people without the app can take part by SMS Microsoft's GroupMe support page says SMS participation is currently supported within the United States only. (support.microsoft.com). A per-diem nurse or a new front-desk hire is in the group within minutes.

That same ease causes the compliance problem. Anyone with the link can join. Members bring personal accounts. SMS participants send messages over carrier networks. The practice has no admin control over who stays in the group after they leave.

Side-by-side: Signal vs iMessage vs GroupMe for staff messaging

Vendor cells as of October 19, 2026. Every vendor cell needs a source before publication.

	Signal	iMessage	GroupMe	Chanty
Vendor signs a BAA	No published BAA offering	No (Apple's iCloud Terms prohibit PHI; no iMessage-specific statement found) (apple.com)	No (not on Microsoft's HIPAA in-scope services list) (learn.microsoft.com)	Yes, on Business and Enterprise. No BAA on Free.
End-to-end encryption	Yes (per Signal's Terms of Service) (signal.org)	Yes, Apple to Apple. SMS fallback is not	Not documented	No. Encrypted in transit with TLS 1.2+ and encrypted file storage.
Admin-managed accounts	No, personal accounts	No, personal Apple ID	No, personal accounts	Practice admins manage the workspace and member access
Remove a departed employee	Group removal only; delivered history may remain	No central removal	Group removal only	Practice controls access and offboarding. SCIM and directory sync on Enterprise.
Role permissions	Basic group admin roles	None	Basic group admin roles	120+ permission settings. Customizable roles on Business.
Retention controls	Per-chat disappearing messages	Per-device settings	Not documented	Customizable retention on Business (per Chanty's healthcare page: signed BAA included from the Business plan, not on Free; Enterprise adds a negotiated MSA) (chanty.com)
2FA / SSO	Not documented	Apple ID 2FA	Not documented	2FA and SSO on Business. SAML SSO on Enterprise.
Work vs. personal identity	Mixed	Mixed	Mixed	Separate work workspace. Guests limited to selected conversations.

This table describes vendor features. It is not a legal determination for any specific practice. Confirm your own obligations with counsel.

For more workplace apps, see more popular tools checked for HIPAA.

The real risk: staff group chats on personal phones

The usual pattern goes like this. A front-desk lead starts an iMessage or GroupMe group called "AM Front Desk" to cover call-outs and schedule swaps. Over a year it grows to 14 people across two locations. Most messages are harmless: "Running 10 min late," "Who can cover Saturday?" Then someone writes "Room 3 patient needs a callback about their prior auth." Now there is PHI in a group the practice does not control.

The exposure points:

• Former staff keep the history. The billing coordinator who left in March still has every message on her phone.
• No record the practice controls. If you need to know what was said and when, the messages sit on a dozen personal devices.
• Screenshots and forwarding. One tap moves a message into a family chat by mistake.
• Shared devices. Tablets at home, phones handed to kids, previews on car displays.

Banning the apps rarely works when nothing replaces them. Staff need to reach each other fast, often from the parking lot or between rooms. If the approved tool is harder to use than a messenger, the group chat simply moves somewhere else. Replace the group chat with a tool that is just as easy.

WhatsApp is the most common version of this pattern. We cover it separately in Is WhatsApp HIPAA compliant?

What to use instead for internal staff communication

Use this checklist for a replacement:

• The vendor signs a BAA on the plan you are buying. Some vendors offer BAAs only on top tiers. See Slack's HIPAA requirements for one example.
• Admins create and remove accounts, and offboarding takes minutes.
• Role permissions separate front desk, billing, clinical leads and managers.
• Retention settings match your written policy.
• 2FA or SSO is available.
• Mobile apps work well for staff who are rarely at a desk.
• The interface is familiar enough that people use it without training sessions.

Know the boundary. An internal staff chat tool is for coordinating work among employees. It does not replace patient messaging, clinical alerting or your EHR. Patient communication needs its own approved channel, and clinical documentation belongs in the EHR.

Shared responsibility. A BAA does not make you compliant by itself. Your practice still configures permissions, manages access and offboarding, secures devices, writes staff policies and trains people on what belongs in chat.

Migration in four steps:

1. Sign the BAA first, before anyone posts a message that could include PHI.
2. Set up channels by role and location, for example #front-desk-northside, #billing and #managers. Add a pinned post that says what may and may not be shared.
3. Move on a set date. Announce it in the old group a week ahead. Send invites and stay available to help on day one.
4. Archive the old group. Post a final message pointing to the new workspace, then close the group. Ask your counsel how to handle the existing history.

Where Chanty fits

Chanty is a team chat for internal staff communication. It brings chats, calls, announcements, files and assigned tasks into one workspace. It runs alongside your EHR and does not replace it. If you are also evaluating Spruce, see our Spruce Health alternative for staff communication.

HIPAA with a signed BAA is available on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI Before entering any patient data, ask Chanty's team to put a BAA in place, for example by booking a demo. (chanty.com). Learn more about HIPAA-compliant chat for staff.

Chanty covers the gaps that consumer apps leave:

• Roles and permissions with 120+ settings, with customizable roles on Business.
• Customizable retention, plus 2FA and SSO, on Business (chanty.com).
• Guest access that limits contractors and vendors to selected conversations and keeps them separate from internal teams.
• Encryption in transit with TLS 1.2+ and encrypted file storage.

For adoption, Chanty has a WhatsApp-like interface and apps for iOS, Android, macOS, Windows and web. Voice messages let staff send updates hands-free. You can turn any message into a task with an owner and a deadline. "Can someone call the lab about the missing requisition?" becomes a task assigned to one person, due by 2 p.m.

Start at chanty.com/signup. Before handling any PHI, read Chanty security, HIPAA and BAA details and sign the BAA on a Business or Enterprise plan.

FAQ

Is Signal HIPAA compliant if messages are end-to-end encrypted?

Encryption alone is not enough. Unless Signal signs a BAA with your practice, the encryption does not settle the question, and the app gives a practice no admin control over accounts, access or retention. Without a BAA, do not use it for PHI.

Is iMessage HIPAA compliant for texting between doctors and staff?

No. Apple does not offer a BAA for iMessage We found no Apple statement on iMessage specifically, but Apple's iCloud Terms prohibit using iCloud, where messages can sync, to create, receive, maintain or transmit PHI. (apple.com). Messages can also fall back to SMS, sync to iCloud or appear on lock screens. Keep PHI out of iMessage.

Is texting on an iPhone HIPAA compliant?

Standard SMS is not end-to-end encrypted, and carriers do not sign BAAs for it Strictly, a transmission-only carrier may fall under HHS's conduit exception and not need a BAA at all. The problem with SMS is security. (hhs.gov). iMessage is encrypted but has no BAA. Neither one is appropriate for PHI.

Is GroupMe HIPAA compliant since Microsoft owns it?

No. Microsoft's BAA covers specific enterprise services. GroupMe is not among them (see the in-scope list on Microsoft's HIPAA/HITECH compliance page; the BAA is provided through the Data Protection Addendum) (learn.microsoft.com). Its encryption status does not change that.

Can staff use Signal or GroupMe if they never mention patient names?

PHI includes far more than names. Dates, appointment times or a description that identifies someone can all count, especially in combination. In practice, a "no names" rule breaks down quickly. Strictly non-patient logistics carry less risk, but a single approved tool is easier to enforce than a set of rules about what to leave out.

Do disappearing messages make Signal safe for PHI?

No. Disappearing messages are a per-chat setting that any participant can change or bypass with a screenshot. They do not create a BAA, and they may conflict with your record-retention obligations Ask your counsel which retention requirements apply to your practice..

Does a BAA alone make a messaging app HIPAA compliant?

No. A BAA is required, but your practice must still configure permissions, manage access and offboarding, secure devices, and train staff.

What should a clinic use instead of group texts for staff communication?

Use a team chat tool whose vendor signs a BAA on your plan. It should have admin-managed accounts, role permissions, retention settings, 2FA or SSO, and mobile apps that staff find as easy as a messenger. Keep patient communication on a separate approved channel.

Is Chanty's free plan HIPAA compliant?

No. The Free plan has no BAA and should not be used for PHI. HIPAA with a signed BAA is available on the Business and Enterprise plans.