Is Slack HIPAA compliant? BAA, limits and an alternative for clinic staff

Slack can be used with protected health information (PHI) only on specific plans and only after Slack signs a business associate agreement (BAA) with your organization HIPAA use is supported only on Slack's Enterprise+ plan (or a legacy Enterprise Grid contract) with the Slack – HIPAA Enabled add-on. (slack.com). On other Slack plans, keep PHI out. Even on an eligible plan, the BAA is one piece of compliance. Your practice still has to configure the workspace, control access and train staff. This page covers what Slack's BAA covers, what your team still has to do, and when a simpler staff chat with a BAA from a lower plan tier, such as Chanty Business, may fit a clinic better.

Short answer: is Slack HIPAA compliant?

It depends on the plan and the paperwork.

• Eligible plans: Slack supports HIPAA use on Enterprise+ (legacy: Enterprise Grid) (slack.com) with a signed BAA. To get it, buy Enterprise+ through your Slack sales representative, add the "Slack – HIPAA Enabled" SKU (required since 20 March 2023), sign the BAA, and follow the Slack Guide for HIPAA Entities. The BAA covers only the workspaces or organizations designated as HIPAA-enabled. See Slack's official Slack and HIPAA page. (slack.com)
• Free and standard paid plans: Slack's Free, Pro and Business+ plans are not eligible for a BAA, so they can't be used for PHI (slack.com). If a plan is not covered by a BAA, do not share PHI on it. That includes patient names in a "running late" message or a photo of an insurance card.
• No tool is "HIPAA certified": HIPAA has no official certification program for software HHS states that no HIPAA standard requires covered entities to certify compliance, and it does not endorse or recognize private "HIPAA certifications." (hhs.gov). A vendor that creates, receives, maintains or transmits PHI for you must sign a BAA Under 45 CFR 164.502(e), a covered entity may share PHI with a business associate only with satisfactory assurances documented in a written contract that meets 45 CFR 164.504(e). (ecfr.gov). After that, compliance depends on your safeguards, policies and training.

If you are weighing several tools, compare HIPAA status of popular team chat tools before you commit.

Slack policy checked on 19 October 2026 (Slack Guide for HIPAA Entities revised 12 August 2026; Salesforce BAA restrictions updated 30 September 2026) (salesforce.com). Vendor terms change. Confirm current details on Slack's official HIPAA page before you decide.

What Slack's BAA covers and what it doesn't

A BAA does not cover a whole product. It covers named services and features, under named conditions.

Features in scope. According to Slack's HIPAA documentation, the following are covered when the workspace is set up as required: message contents, files and file names, huddles, video and audio clips, names of private channels and direct messages, and data sent to custom apps your organization builds on Slack infrastructure (salesforce.com).

Features excluded or restricted. Some features may be excluded or restricted for PHI: PHI is not allowed in canvas names, profile data or custom profile fields, custom emoji names, custom statuses, workspace or org names and URLs, EMM custom messages, user-group names, or app and workflow metadata (names, code, datastores), and it must not go into Slack support requests. Slack can't be used to communicate with patients, and patients can't be users or guests. Email-to-Slack doesn't work in HIPAA organizations. Huddles are in scope, and Slack Connect is allowed only if you have permission to share the PHI (salesforce.com). Before go-live, check each feature your staff already use. A front desk team that relies on quick huddles, for example, needs to know whether those are in scope.

Third-party apps. Apps and integrations installed in Slack are generally the responsibility of each app's vendor, not Slack ; Slack states it has no BAA with any third-party app provider, including Slack Marketplace apps, and it is your responsibility to decide whether you need a BAA with each app provider (slack.com). A scheduling bot, a forms app or a file-sync connector needs its own review. If PHI flows through it, it needs its own BAA.

The PCI DSS question. Many searches pair "Slack HIPAA BAA" with "PCI DSS." These are separate frameworks. PCI DSS is a security standard for handling payment card data. HIPAA governs PHI. Slack's PCI DSS status is not published: Slack's current compliance page does not list PCI DSS (slack.com). PCI DSS compliance does not make a tool suitable for PHI. A BAA does not make a tool suitable for card data either.

Configuring Slack for HIPAA: what your team still has to do

Slack-specific setup. Slack requires or recommends specific configuration for HIPAA workspaces: SSO with session limits (mobile apps have no session timeout), monitoring through audit logs or the Discovery API plus DLP, private channels for PHI, custom terms of service, encrypted devices with lock screens and no message content in lock-screen notifications, retention settings, and your own backups, since Slack is not a system of record. Enterprise Key Management is an optional paid add-on, not a HIPAA requirement (salesforce.com). Assign a named admin to own this setup and record each setting and why you chose it.

Duties that apply to any tool, Slack or otherwise:

• Access control: Use role-based access so billing staff, front desk and clinical staff see only the channels they need.
• Offboarding: Remove access on a former employee's last day, including on personal phones.
• Device security: Require screen locks and decide whether personal devices are allowed.
• Minimum necessary: Train staff to share only what a task requires. "Room 3 patient needs a ride at 2pm" works better than a full name and date of birth in a busy channel.
• Training: Run onboarding and periodic refreshers on what can and can't go in chat.
• Risk analysis: Include the chat tool in your documented risk analysis HIPAA requires an accurate and thorough risk analysis as a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A). (ecfr.gov).

Cost and size threshold. Slack's HIPAA-eligible plan is Enterprise+, listed at $45 USD per user per month when paying annually and sold through Slack's sales team rather than self-serve. The required HIPAA Enabled SKU costs extra with no published price, and Slack publishes no seat minimum (slack.com). A 10–200 person practice needs to know whether that plan is self-serve or sales-led, and whether seat minimums apply. Those terms can decide whether the eligible plan fits at all.

"Care team messaging." Slack is a general-purpose team chat. It is not built as a clinical alerting system, a validated handoff tool or a care-team clinical messaging platform. The same limit applies to Chanty. Both work for operational coordination: room turnover, supply requests, schedule changes, staff announcements. Time-critical clinical alerts and formal handoffs belong in systems designed and validated for that purpose.

Common mistakes when clinics use Slack

1. Sharing PHI in a free or non-BAA workspace. Staff assume "Slack is secure," so PHI ends up in a workspace with no BAA. Security features and a BAA are different things.
2. Assuming the BAA covers everything connected. Bots, third-party apps and AI features may be outside the BAA. A connected forms app or file sync can expose PHI even if the core workspace is covered.
3. Mixing external partners with internal PHI conversations. Shared channels with a billing vendor, IT contractor or partner practice need clear rules. Keep PHI-bearing channels internal unless the external party is covered and access is deliberate.
4. Keeping informal backups. The workspace is controlled, but staff still text each other or keep a WhatsApp group "just in case." PHI then leaves the system you secured. See why WhatsApp groups are a HIPAA risk.

A HIPAA-ready Slack alternative for clinic staff: Chanty

Chanty is internal team communication for staff. It puts chats, voice and video calls, announcements, files and assigned tasks in one workspace. You use it alongside your EHR, scheduling and billing systems, not instead of them. It is not a patient messaging, telehealth or clinical alerting tool.

BAA by plan:

• Free: No BAA. Do not store PHI.
• Business: HIPAA-compliant with a signed BAA.
• Enterprise: BAA plus a negotiated MSA.

Pricing: Business costs $3 per user per month billed annually or $4 billed monthly; Enterprise pricing is by contacting sales. (chanty.com).

Follow-ups that don't get lost. Turn any message into a task with an owner, a due date, a status and a priority, then track it on a built-in Kanban board. For example, a front desk message saying "fax from the cardiology office never arrived" becomes a task assigned to the referral coordinator, due Thursday, and visible to the office manager.

Security controls:

• All plans: Encryption in transit with TLS 1.2+ and encrypted file storage.
• Business: Adds 2FA, SSO, customizable roles and retention, 120+ permission settings and IP allowlisting.
• Enterprise: Adds SAML SSO, directory sync, SCIM and DLP.

Guests and devices. Guest access limits contractors and vendors to selected conversations. Business includes 3 free guest seats per paid member. Apps run on iOS, Android, macOS, Windows and web. The messenger-style interface needs little training for front desk and deskless staff.

For more, see HIPAA-compliant chat for staff and Chanty security, HIPAA and BAA details.

Slack vs Chanty for HIPAA: side-by-side

	Slack	Chanty
Plan where a BAA is available	Enterprise+ (or legacy Enterprise Grid) plus the Slack – HIPAA Enabled SKU (salesforce.com)	Business and Enterprise
BAA process	Buy Enterprise+ with the HIPAA Enabled SKU through Slack sales, sign the BAA, and follow Slack's HIPAA guide (slack.com)	Signed BAA included on Business; Enterprise adds a negotiated MSA
PHI on the free plan	No. Free is not HIPAA-eligible and has no BAA. (slack.com)	No. Free has no BAA.
Message history	90 days of message and file history on Free; data older than 1 year is deleted (slack.com)	Unlimited searchable history on all plans, including Free
Group calls	Huddles are 1:1 only on Free; group huddles on Pro and above (slack.com)	Unlimited 1:1 calls on Free; unlimited group calls and screen sharing on Business
Tasks	Lists on Pro and above; canvases on Free limited to channels and DMs (slack.com)	Tasks from any message; list and Kanban views
Roles and permissions	Posting permissions limited to #general on Free and Pro, any channel on Business+ and Enterprise+; custom roles on Enterprise+ only (slack.com)	Customizable roles and 120+ settings on Business; unlimited custom roles on Enterprise
SSO / SCIM	Google OAuth on Pro; SAML SSO and SCIM on Business+; multi-SAML on Enterprise+ (Slack also lists SSO and SCIM on Free and Pro when a Salesforce org is connected) (slack.com)	SSO on Business; SAML SSO, directory sync and SCIM on Enterprise
Data residency	Business+ and Enterprise+ (slack.com)	US, EU or APAC on Enterprise only
Uptime	No published uptime percentage; the SLA commits only to commercially reasonable efforts to keep the service available (slack.com)	99.9% uptime guarantee on Business
Integration catalog	Over 2,600 apps (slack.com)	About 28 native integrations 28 live integrations listed on Chanty's apps page, plus 4 coming soon (chanty.com), extended via Zapier, Make and n8n

Slack is stronger on integrations. Its app marketplace is much larger than Chanty's. If your workflows depend on many native apps, weigh that heavily. Google Workspace practices may also want to read Is Google Chat HIPAA compliant?.

When Slack is still the better choice

• You already run Slack on an eligible plan with a signed BAA and depend on many Slack apps. Switching may cost more than it saves.
• You need hundreds of native integrations or advanced project management in chat. Chanty's tasks are list and Kanban, not built for complex projects.
• You need patient messaging, telehealth or clinical alerting. Neither Slack nor Chanty is built for that. Use a dedicated clinical or patient communication platform.
• You need built-in scheduling, time tracking or HR. Chanty doesn't include these. You'd keep a separate workforce management system either way.

If your organization is standardized on Microsoft 365, also read Is Microsoft Teams HIPAA compliant?.

How to switch from Slack to Chanty

1. Sign the BAA first. Choose Business or Enterprise and have the BAA in place before any PHI enters the workspace. Until then, use only test content.
2. Set up structure before people. Configure roles and permissions, create separate internal and guest channels (for example, #front-desk-main vs #it-vendor-support), and set a retention policy that matches your records policy.
3. Review every integration. Third-party integrations, including Zapier and Google Drive, are outside Chanty's BAA scope. Keep PHI out of them unless the vendor has signed its own BAA with you.
4. Plan the move of history and habits. Decide what Slack history you need to keep and where it will live In Slack, full-workspace export is on Business+ and Enterprise+, single-user export is Enterprise+ only, and custom retention is on Pro and above. Under Slack's HIPAA guide, Slack keeps data for 30 days after the contract ends, so export through the Discovery APIs within that window and keep your own backups and emergency access. (slack.com). Set a cutover date. Retire informal staff group chats on the same day so there's one place to look.

Browse Chanty features for healthcare teams, or start at https://www.chanty.com/signup.

FAQ

Is Slack HIPAA compliant on the free plan?

Slack's free plan is not eligible for HIPAA use, and Slack offers no BAA for it (slack.com). Without a signed BAA covering the plan, do not share PHI on it.

Does Slack sign a BAA, and on which plans?

Slack offers a BAA on its Enterprise+ plan (or a legacy Enterprise Grid contract) with the Slack – HIPAA Enabled SKU (salesforce.com). The process is to buy Enterprise+ and the "Slack – HIPAA Enabled" SKU through your Slack sales representative, sign the BAA, and follow the Slack Guide for HIPAA Entities; see Slack's official Slack and HIPAA page (slack.com).

Is Slack Enterprise Grid HIPAA compliant?

Enterprise Grid can support HIPAA use with a signed BAA and the required configuration (the plan is now called Enterprise+; Enterprise Grid is the legacy name, and the Slack – HIPAA Enabled SKU is also required) (salesforce.com). Your practice still has to meet its own HIPAA duties.

What does Slack's BAA not cover?

Exclusions may include PHI in canvas names, profile fields, custom emoji names and statuses, workspace names and URLs, user-group names, and app or workflow metadata, plus any communication with patients; huddles are in scope, and Slack Connect is allowed only with permission to share the PHI (salesforce.com). Third-party apps are generally outside it ; Slack has no BAA with any third-party app provider, including Marketplace apps, and you must decide whether you need a BAA with each provider (slack.com).

Can I use Slack for care team messaging?

You can use it for operational coordination among staff on an eligible, configured plan. It is not a clinical alerting or validated handoff system, and neither is Chanty.

Is Slack PCI DSS compliant, and is that the same as HIPAA?

Slack's PCI DSS status is not published: Slack's current compliance page does not list PCI DSS (slack.com). PCI DSS covers payment card data. HIPAA covers PHI. They are separate requirements.

Does Chanty sign a BAA on its free plan?

No. The BAA is available from the Business plan. Enterprise adds a negotiated MSA. The Free plan should not hold PHI.

Do Chanty's AI agents fall under the BAA?

AI agents are available only on Enterprise. BAA coverage of agent processing and third-party models is not publicly documented (Chanty's pricing and healthcare pages list only "AI compatibility" on Enterprise and say nothing about BAA coverage for AI) (chanty.com). Keep PHI away from agents until your BAA explicitly covers them.

Does using a HIPAA-eligible chat tool make my practice HIPAA compliant?

No. A signed BAA and good security controls are required. Compliance also depends on your risk analysis, access management, policies and staff training.