Is WhatsApp HIPAA compliant? What healthcare teams need to know

Not for protected health information (PHI). A practice can use a messaging app with PHI only if the vendor signs a business associate agreement (BAA) and the practice controls the app through its own safeguards. Our current understanding is that Meta does not sign a BAA for any WhatsApp product Meta has published no statement either way, but its WhatsApp terms (Business app and Business Platform terms effective 23 Sep 2026; Business Solution Terms last modified 6 Mar 2026) contain no BAA, and the Business app terms make no promise that the app meets the needs of healthcare entities (checked 19 Oct 2026) (whatsapp.com). Without a BAA, PHI should not go into WhatsApp, whatever its encryption. Staff can still use it for messages that contain no PHI, if your practice policy allows that.

The short answer: can you use WhatsApp with PHI?

Last reviewed: Meta's WhatsApp terms were last checked for this page on 19 Oct 2026. This answer depends on Meta's policies, which can change. If you searched for the 2025 or 2026 status, check the review date above.

WhatsApp product	BAA from Meta?	Use with PHI?
WhatsApp Messenger (consumer app)	Not offered, to our knowledge	No
WhatsApp Business app	Not offered, to our knowledge (Business app terms, effective 23 Sep 2026: no promise the app meets healthcare entities' needs) (whatsapp.com)	No
WhatsApp Business Platform / Cloud API	Not offered by Meta, to our knowledge (Platform terms have no BAA; the Messaging Policy, updated 23 Sep 2026, bars telemedicine or health information where the law requires systems meeting heightened requirements) (whatsapp.com)	No, unless a verified BAA chain covers it
WhatsApp voice and video calls	Same as the app used	No

No app is "HIPAA compliant" on its own. HHS does not certify software for HIPAA OCR states that it "does not endorse, certify, or recommend specific technology or products." (hhs.gov). When a vendor calls itself HIPAA compliant, it usually means a covered entity can use the product under a signed BAA with appropriate safeguards. The covered entity remains responsible for how the product is set up and used.

WhatsApp itself is not the problem. Putting PHI in it without a BAA and practice-controlled safeguards is. A message saying "Staff meeting moved to 8:30" is not PHI. A message saying "Can someone call back Mr. Daniels about his biopsy results?" is.

For how other tools compare, see team chat tools compared for HIPAA.

Why end-to-end encryption doesn't make WhatsApp HIPAA compliant

WhatsApp says messages and calls are end-to-end encrypted by default Chats with WhatsApp Business accounts also count as end-to-end encrypted, but once a business receives a message its own privacy practices apply, and it may use other vendors to process messages. (faq.whatsapp.com). Encryption matters, but it is only one technical safeguard 45 CFR 164.312 also sets standards for access control, integrity, person or entity authentication, and transmission security. (ecfr.gov).

HIPAA also requires a BAA with any vendor that creates, receives, maintains, or transmits PHI for you (45 CFR 164.502(e) and 164.308(b)). Encryption does not replace that contract.

The conduit exception. HHS treats some services, such as postal carriers and internet service providers, as "conduits" that only move data in transit and do not need a BAA. Services that store data, even in encrypted form, generally do not qualify HHS says a cloud provider that stores ePHI is generally a business associate even if the data is encrypted and the provider has no key, and that the conduit exception covers only transmission, with any storage merely temporary and incidental to it. HHS does not name messaging apps here, so the next point is our own reading. (hhs.gov). A messaging app that keeps message history on devices and servers is not a simple conduit.

What a practice cannot do in WhatsApp:

• No central admin. Each account belongs to the staff member's personal phone number, not to the practice.
• No control over group membership. Any group admin can add anyone, including a former employee or a personal contact.
• No practice-controlled retention or audit trail. You cannot set how long messages are kept or review who accessed what.
• No offboarding. When someone leaves, the practice cannot remove their copy of work conversations.

Backups. WhatsApp can back up chats to iCloud or Google Drive under the user's personal account. Whether those backups are end-to-end encrypted depends on a setting the user controls WhatsApp now also offers backup to its own cloud storage, which is always end-to-end encrypted; for iCloud and Google backups, end-to-end encryption is an optional setting the user must turn on. (faq.whatsapp.com). In practice, PHI can end up in a personal cloud account that the practice has never seen.

WhatsApp Business, the Business API, and WhatsApp video calls

WhatsApp Business app. The Business app adds a business profile, labels, quick replies, and greeting messages. Those are customer-service features. They do not change the BAA question Meta's Business app terms make no promise that the app meets the needs of healthcare entities, and they state that the app is "not intended for intra-company usage." (whatsapp.com).

WhatsApp Business Platform (Cloud API) and solution providers. Larger organizations reach WhatsApp through the API, often via third-party Business Solution Providers (BSPs). Some BSPs may advertise HIPAA claims. If you evaluate one, ask:

• Who signs the BAA: the BSP, Meta, or both?
• Does the BAA cover message content as it passes through Meta's systems, or only the BSP's own storage?
• What do Meta's platform terms say about health data? WhatsApp's Business Messaging Policy tells businesses not to use WhatsApp for telemedicine or health information where the law requires such information to go only to systems meeting heightened requirements, and the Business app terms make no promise of meeting healthcare entities' needs. (whatsappbusiness.com)

A BSP's BAA covers only that BSP's part of the data flow.

WhatsApp voice and video calls. The same rule applies. An encrypted call is still a call through a vendor that has not signed a BAA. If you need video visits with patients, that is a telehealth question, and section 6 covers it.

"Pharma compliant" searches. Pharmaceutical companies face separate rules, such as promotional content review and adverse-event reporting, that this page does not cover . Check with your compliance team.

The real risk: staff group chats on personal phones

Most practices are not choosing WhatsApp as an official tool. It shows up on its own. The front desk starts a group to swap shifts. Medical assistants add a group for "quick questions." A practice manager uses it to reach two locations at once. It works because everyone already has it.

PHI gets in through ordinary work:

• A photo of tomorrow's schedule, with patient names and visit reasons, sent so someone can cover.
• "Can anyone take Ms. Okafor at 3? She's here for her post-op check."
• A screenshot of a referral or an insurance card to ask a billing question.
• A voice note describing a patient's callback request.

Photos and files can also save automatically to the phone's camera roll, depending on settings On iPhone, "Save to Photos" is on by default, and auto-download can be set for each media type. (faq.whatsapp.com). From there they can sync to a personal photo library.

Offboarding is the hardest part. When a medical assistant leaves, they keep the full group history on their own phone. The practice cannot revoke it. If they stay in the group, they keep receiving new messages until someone thinks to remove them.

Already using WhatsApp? A cleanup plan for your practice

Step 1: Map what exists. List every work group across your locations: front desk, MAs, billing, managers, cross-site groups. Note who is in each one, including former staff, and what kind of information is shared. Ask staff directly. Some groups will not be visible to managers.

Step 2: Set a written policy. Ban PHI in WhatsApp starting now and give concrete examples: patient names with any visit detail, photos of schedules, screenshots from the EHR, insurance cards, lab results, and voice notes about patients. Record the use of messaging apps in your security risk analysis 45 CFR 164.308(a)(1)(ii)(A) makes risk analysis a required implementation specification. (ecfr.gov). You can start from our free HIPAA tools and templates.

Step 3: Choose an approved staff tool. Pick a tool whose vendor signs a BAA, and sign it before anyone shares PHI. Set up roles, permissions, and two-factor authentication before inviting staff. Compare options carefully. For example, see Is Slack HIPAA compliant? for how plan level affects BAA availability. Our guides on whether Microsoft Teams is HIPAA compliant and whether Google Chat is HIPAA compliant cover two other common options.

Step 4: Move teams over in stages. Migrate one team or location at a time. Pin the procedures staff look for most often, such as the coverage process, the opening checklist, and IT contacts. Then archive the old WhatsApp groups and ask staff to delete work chats from their devices, but only after a legal or compliance review. Get that review before telling anyone to delete, because retention obligations may apply.

Step 5: Train, then repeat. Train every staff member during the switch and again at onboarding. Remove access on the same day someone leaves.

Staff communication vs. patient communication: pick the right tool

Some people searching this topic want WhatsApp-style messaging with patients: appointment questions, photos of a rash, quick follow-ups. That is a separate category. Patient messaging and telehealth platforms are often tied to the EHR or patient portal and are built around patient identity, consent, and records.

Chanty is for internal staff communication only. It is not a patient messaging, telehealth, or clinical alerting tool, and it does not replace WhatsApp for patients.

For patient communication, evaluate dedicated patient-facing vendors under a BAA. Some products lead with patient communication and also include team chat. Our Spruce Health alternative for staff communication page explains that distinction.

If your staff use other consumer apps, see Signal, iMessage, GroupMe and HIPAA.

Chanty as a WhatsApp alternative for staff chat

If the goal is to give staff the convenience of WhatsApp with practice-controlled safeguards, a staff chat tool under a BAA is the direct replacement. Here is how Chanty fits. See also HIPAA-compliant chat for staff.

Familiar to use. Chanty's interface looks and feels like WhatsApp, so staff need little training. Apps run on iOS, Android, macOS, Windows, and web. That covers front desk staff on desktops and deskless staff on phones.

Compliance. HIPAA compliance with a signed BAA is available on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI. See Chanty security, HIPAA and BAA details The /security/ page does not cover HIPAA; for BAA details see the Chanty healthcare page. The BAA comes with Business and above, Enterprise adds a negotiated MSA, and you request the BAA from the Chanty team through a demo booking before any patient data goes in. (chanty.com).

Controls the practice owns:

• Customizable roles with 120+ permission settings, two-factor authentication, SSO, retention settings, and IP allowlisting on Business.
• SAML SSO, directory sync, and SCIM provisioning on Enterprise.
• Guest access limited to selected conversations, so a contractor or vendor never sees internal channels.

Coordination WhatsApp doesn't offer:

• Turn any message into a task with an owner and a due date, and track it on a Kanban board. A coverage request becomes an assigned task instead of a message that gets buried.
• Send company-wide announcements and scheduled posts on Business.
• Search unlimited message history, including on the Free plan.

Limits to know:

• Encryption is TLS 1.2+ in transit plus encrypted file storage. Chanty is not end-to-end encrypted.
• Chanty has no shift scheduling, time tracking, or HR functions.
• Task management is basic and not built for complex projects.
• Third-party integrations, such as Google Drive or Zapier, are outside Chanty's BAA.
• AI agents are available only on Enterprise. BAA coverage of agent processing is not documented, so confirm it before any agent handles PHI.
• Your practice is still responsible for configuring roles, managing access and offboarding, securing devices, and training staff.

WhatsApp vs. Chanty for staff communication: side-by-side

	WhatsApp	Chanty
Signed BAA available	Not offered by Meta, to our knowledge (Meta's published WhatsApp terms contain no BAA; checked 19 Oct 2026) (whatsapp.com)	Business and Enterprise; not on Free
Admin control and user removal	Accounts tied to personal phone numbers; no practice admin	Admins manage user access and offboarding; directory sync and SCIM on Enterprise
Roles and permissions	Group admin settings only	120+ settings; customizable roles on Business, unlimited custom roles on Enterprise
Retention controls	User-controlled disappearing messages; no practice-level retention	Business and Enterprise
Encryption model	End-to-end by default; backup encryption depends on user setting	TLS 1.2+ in transit, encrypted file storage (all plans); not end-to-end
Guest separation	No distinction between staff and outside contacts	Guests limited to selected conversations (all plans)
Tasks from messages	Not available	All plans, with Kanban board
Patient messaging	Outside the scope of this comparison	No. Chanty is for internal staff communication only

To replace staff WhatsApp groups with a tool you control, start on the Business plan and sign the BAA before anyone shares PHI: https://www.chanty.com/signup.

FAQ

Is WhatsApp HIPAA compliant in 2025 or 2026?

Not for PHI, as of our last review. Meta does not offer a BAA for WhatsApp, to our knowledge Meta's published WhatsApp terms contain no BAA, and its Business app terms make no promise of meeting healthcare entities' needs (checked 19 Oct 2026). (whatsapp.com). Check the "Last reviewed" date at the top of this page, because vendor policies can change.

Will Meta sign a BAA for WhatsApp or WhatsApp Business?

To our knowledge, no, for the consumer app, the Business app, or the Business Platform Meta has made no public statement either way, but its published terms for the Business app and Business Platform contain no BAA, and the Business app terms disclaim suitability for healthcare entities (checked 19 Oct 2026). (whatsapp.com). If a solution provider offers a BAA, confirm exactly what it covers.

Is WhatsApp's end-to-end encryption enough for HIPAA?

No. Encryption is one safeguard. HIPAA also requires a BAA with the vendor, plus administrative controls the practice owns, such as access management and offboarding The BAA requirement is in 45 CFR 164.502(e) and 164.308(b); access management falls under 164.308(a)(4), and offboarding falls under the termination procedures in 164.308(a)(3)(ii)(C). (ecfr.gov).

Is WhatsApp video calling HIPAA compliant?

The same answer applies. An encrypted call does not create a BAA. During the COVID-19 public health emergency, HHS used enforcement discretion for some telehealth on non-public-facing apps, and that discretion has ended The March 2020 notice named Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom and Skype, and HHS's telehealth FAQs also listed WhatsApp video chat. The discretion expired at 11:59 p.m. on May 11, 2023, and the telehealth transition period ended at 11:59 p.m. on August 9, 2023. (hhs.gov).

Can staff use WhatsApp if they never share patient information?

Yes, if your practice policy allows it. Messages with no PHI, such as "Parking lot is closed for paving tomorrow," are not a HIPAA issue. The risk is that PHI slips in over time, which is why many practices move work chat to an approved tool.

Can I use WhatsApp to message patients?

Not for PHI without a BAA. For patient communication, evaluate dedicated patient messaging or telehealth vendors that sign a BAA. Chanty is not a patient messaging tool.

What should we do with old WhatsApp groups that may contain PHI?

Inventory them, stop new PHI immediately, archive the groups, and get legal or compliance advice before asking staff to delete anything. Remove former employees from any groups that remain.

Is Chanty HIPAA compliant on the free plan?

No. The Free plan has no BAA and should not be used for PHI. A signed BAA is available on the Business and Enterprise plans.

Is there official HHS guidance on WhatsApp?

Only in COVID-era material: HHS's telehealth FAQs listed WhatsApp video chat and WhatsApp messaging as "non-public facing" products under the enforcement discretion that ended in 2023. We found no current HHS guidance that names WhatsApp (hhs.gov). HHS guidance on business associates, cloud services, and the conduit exception applies to messaging apps in general HHS says a service that stores ePHI is generally a business associate even if the data is encrypted, and that the conduit exception covers only services that transmit data with merely incidental, temporary storage. (hhs.gov).