Last verified: October 2026, against Slack's help center and the Slack Guide for HIPAA Entities. General information, not legal advice — confirm with your compliance officer or attorney.
Is Slack HIPAA compliant? Only on an Enterprise plan, with a signed business associate agreement (BAA) and Slack's HIPAA rules switched on. Free, Pro and Business+ workspaces don't qualify. And even a covered workspace is for staff only: Slack forbids using it to talk with patients. If you're a growing practice moving the team's chatter off text messages, here's what that means in practice.
Short answer (dated) from Slack's documentation
Short answer (verified October 2026): Slack's help article Slack and HIPAA (opens in a new tab) says "You must be using a Slack Enterprise plan," "You must execute a Business Associate Agreement," and you must follow the Slack Guide for HIPAA Entities (opens in a new tab). The guide (revised August 12, 2026) says purchases on or after March 20, 2023 also need the "Slack - HIPAA Enabled" SKU. And: "You may not use Slack to communicate with patients, plan members, or their families or employers."
Slack's compliance page (opens in a new tab) puts it in one line: Slack "can be configured for HIPAA compliance." Configured is the operative word.
Which Slack plans a BAA can cover
| Slack plan | Can hold PHI? |
|---|---|
| Free | No |
| Pro | No |
| Business+ | No |
| Enterprise, with the HIPAA Enabled SKU and a signed BAA | Yes, in the workspaces you designate, following Slack's guide |
Three conditions come with the Enterprise route:
- Designate each workspace. On Enterprise Grid, Slack's guide says the HIPAA flag covers every workspace in a designated organization, including later ones. BAA coverage doesn't automatically extend to every organization you own.
- Monitor. Slack makes you responsible for data loss prevention (DLP), using Slack's own DLP or an outside provider through its Discovery APIs.
- Keep the chart elsewhere. "Slack cannot serve as your system of record for PHI." Anything clinically relevant belongs in the EHR.
If your practice already runs on a business Microsoft 365 plan, Microsoft Teams and HIPAA may be the shorter path, because Teams sits under Microsoft's BAA by default.
Features and integrations to restrict
Slack's guide is specific about where PHI may and may not go:
| PHI allowed | PHI not allowed |
|---|---|
| Message contents | Canvas names |
| Files | User profiles and custom profile fields |
| Huddles | Custom statuses and custom emoji names |
| Video and audio clips | Workspace and organization names and URLs |
| Data sent to custom apps you build on Slack's infrastructure | User group names, app and workflow names, workflow code |
More rules from Slack's guide and help article:
- No PHI in support requests, including /feedback, the Contact Us page, Live Chat and screenshots.
- No email-to-Slack. Slack says it isn't available for HIPAA organizations.
- Public channels are public to the workspace. Their content is visible to every member, and search returns results from all public channels. A file posted to a public channel can't be made private again unless it's deleted.
- Slack Connect, shared channels with another organization, needs your permissions and legal basis confirmed before PHI goes in.
- Apps are outside the BAA. Slack has no BAA with third-party app providers, including Marketplace apps. A scheduling bot or automation that connects Slack to other tools works with your data under its own provider's terms; see Zapier integrations and PHI.
Channel rules for a practice
Illustrative example (a staff channel policy for a fictional clinic):
- Clinical coordination happens only in private channels such as #care-team-north. Channel names never include a patient's name.
- Use the fewest identifiers that get the job done, as our policy allows: a chart number, not name plus date of birth plus diagnosis.
- No screenshots of the EHR. Type what's needed.
- Patients and family members are never added as users or guests.
- Before adding someone to a private channel, check they should see its history. New members can read earlier messages.
- Phones: device encryption on, lock screen on, notification previews hidden.
Rule 2 is HIPAA's minimum necessary standard applied to chat. Rule 6 comes from Slack's guide, which also notes that mobile devices have no session timeouts, so it recommends single sign-on and session limits.
Slack is for staff. For patient messages, see texting and HIPAA.
Retention, exports and offboarding
Retention. Workspace Owners set message retention; on paid plans the options are to keep everything or delete after a custom timeline, per Slack's retention article (opens in a new tab). Paid plans also allow member overrides for private channels and DMs. Decide whether staff may set their own, and pick the period with your compliance officer.
Exports. Slack's guide says that after your agreement ends, Slack keeps message and file data for 30 days unless deleted sooner. Export anything you must keep within that window, using the Discovery API tools. Slack also expects you to keep your own backup and recovery procedures.
Offboarding. In an Enterprise org, Slack's deactivation article (opens in a new tab) says accounts are deactivated at the org level. The person is removed from channels and signed out everywhere; their messages and files stay. Do it the day someone leaves.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
What a BAA has to say, and how to keep track of yours, is in business associate agreements. Other tools are on the HIPAA-compliant email and messaging hub.
Medfy doesn't sell staff chat tools. For its own services, Medfy signs a BAA with each practice, and patient information from website forms and chat is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit reviews the public side of your practice: website, listings and ad tracking.
Frequently asked questions
Will Slack sign a BAA?
Yes, but only on an Enterprise plan. Slack's help article requires an Enterprise plan, a signed BAA and agreement to its Guide for HIPAA Entities, and the guide says purchases since March 20, 2023 also need the 'Slack - HIPAA Enabled' SKU. You must also monitor use with data loss prevention tools. Confirm the terms with Slack and with your compliance officer or attorney.
Can staff share patient names in Slack?
In a HIPAA-enabled Enterprise workspace under the BAA, PHI is allowed in message contents, files, huddles and clips, but not in canvas names, profiles, custom statuses, emoji or user group names. Share only what the task needs, in private channels limited to the people involved, and never add patients as users or guests. Confirm your channel policy with your compliance officer or attorney.
Are Slack integrations covered by the BAA?
No. Slack says it has no business associate agreement with third-party app providers, including apps in the Slack Marketplace, and that you must decide whether you need your own agreement before enabling one. Treat every connected app, automation or AI tool as a separate vendor: check its BAA, what data it can reach and who installed it.
Is free Slack HIPAA compliant?
No. Slack's HIPAA article requires an Enterprise plan and a signed BAA, so Free, Pro and Business+ workspaces can't hold patient information. If your team already chats on free Slack, keep patient details out entirely, move clinical coordination to a covered tool, and decide what to do with any PHI already posted. Confirm next steps with your compliance officer or attorney.