Is Slack HIPAA Compliant?

Only if your practice uses a Slack Enterprise plan, signs Slack's Business Associate Agreement (BAA), and follows Slack's HIPAA setup rules. Slack's HIPAA page names no other plan. We read Slack's own help article on October 15, 2026. The page shows no last-updated date.

Slack and HIPAA at a glance

• Slack signs a BAA for Enterprise plans.
• Admins must agree to the "Slack Guide for HIPAA Entities."
• The practice must monitor use, for example with Slack Data Loss Prevention (DLP).
• PHI is allowed only in messages, files, file names and private channel or DM names.
• Slack may not be used to message patients or their families.
• Third-party apps are not covered by Slack's BAA.

Does Slack sign a BAA?

Yes, on Enterprise plans. Slack's Slack and HIPAA help article says: "On Enterprise plans, Slack can be configured to support HIPAA-compliant message and file collaboration." It lists the first condition plainly: "You must execute a Business Associate Agreement."

The BAA is not a Slack preference. It is a HIPAA rule. HHS cloud computing guidance says the covered entity "and the CSP must enter into a HIPAA-compliant business associate agreement (BAA)" when the cloud service handles patient data.

Which Slack plans can be used with patient data?

Only Enterprise. Slack's article states: "You must be using a Slack Enterprise plan." The background section refers to Enterprise Grid. Ask Slack sales to confirm which Enterprise tier your contract covers.

Where can PHI go inside Slack?

In a short list of places. Slack says members "may not include PHI when using Slack features," except in "messages, files and file names, and names of private channels or DMs." Everything else is off limits.

Can a practice message patients in Slack?

No. Slack's article says you may not use Slack to communicate with patients, plan members, or their families or employers. Slack is for staff. For patient messages, see our guide on HIPAA compliant texting. Slack also says it should not be the system of record for health information. The chart stays in your EHR.

Are Slack apps covered by the BAA?

No. Slack states: "Slack does not have a business associate agreement with any third-party application providers." Each app that can read messages or files needs its own review. If the app sees PHI, you need a BAA with that vendor.

What happens if staff share PHI in Slack without a BAA?

The practice has a compliance gap. Slack becomes a vendor that holds patient data with no contract in place. HHS is clear that technical protections do not fix this. Its cloud guidance states: "Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules."

Many small practices start on a non-Enterprise workspace for scheduling chatter. Over time, staff paste a patient name or a lab result into a channel. That one message brings PHI into a workspace with no BAA. Set a written rule now. Either move to a HIPAA-configured Enterprise plan, or ban patient details in Slack and use a tool that signs a BAA.

Does HIPAA require audit logs for a chat tool like Slack?

Yes, for any system that holds patient data. The HIPAA technical safeguards require mechanisms that "record and examine activity in information systems" containing electronic PHI. They also require a way to "verify that a person or entity seeking access to electronic protected health information is the one claimed."

Slack's HIPAA article does not describe which audit logs come with each Enterprise contract. Ask Slack in writing before you sign. Then decide who on your team reviews the logs, and how often. Turn on single sign-on or multifactor login for every account that can read PHI channels.

How do you set up Slack for HIPAA?

1. 1

   Confirm the plan

   Move to a Slack Enterprise plan before any PHI goes in.

2. 2

   Sign the BAA

   Execute Slack's Business Associate Agreement and keep a copy.

3. 3

   Accept the HIPAA guide

   An admin agrees to the Slack Guide for HIPAA Entities.

4. 4

   Turn on monitoring

   Set up Slack DLP or an external DLP tool through the Discovery APIs.

5. 5

   Audit apps and train staff

   Remove apps without a BAA. Teach staff where PHI may and may not go.

What are the alternatives to Slack for a small practice?

Many practices already pay for a suite with a chat tool. Read Is Microsoft Teams HIPAA compliant? and Is Google Workspace HIPAA compliant? The same test applies to each: a signed BAA, a covered plan and correct settings.

How Webpatch helps

Webpatch manages HIPAA compliance for practice technology. We list the tools your staff use, check which ones have a BAA, review settings like Slack's PHI limits, and document the result. We are not a law firm. Contact us for a review of your team's tools.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.