Last verified: October 2026, against Meta's WhatsApp terms, Signal's terms and Apple's documentation. General information, not legal advice — confirm with your compliance officer or attorney.
Is WhatsApp HIPAA compliant? No, and Meta says so in its own terms. Signal and iMessage are end-to-end encrypted too, and that's the point most articles miss: encryption protects a message in transit, but HIPAA also asks who your vendor is, whether it signed a business associate agreement (BAA), and where copies of the conversation end up.
Short answer (dated) for WhatsApp, Signal and iMessage
Short answer (verified October 2026): Meta's Terms for WhatsApp Business Platform (opens in a new tab) (last modified September 23, 2026) say Meta is not a "Business Associate or Subcontractor" under HIPAA and that "the WhatsApp Business Platform is not HIPAA compliant." Signal's terms (opens in a new tab) don't mention HIPAA, healthcare or business use. Apple's iCloud terms (opens in a new tab) tell covered entities not to use iCloud for protected health information (PHI). We found no BAA offering from any of the three.
| App | What the company says about encryption | BAA offered | Where copies can end up |
|---|---|---|---|
| Personal chats end-to-end encrypted; some business chats run through Meta-operated services that aren't | No; Meta says it isn't a business associate | Phones, and Google Account backups unless encrypted backup is on | |
| Signal | "We can't read your messages or listen to your calls" | None found | Phones; Signal stores message history on your devices |
| iMessage | Messages "secured with end-to-end encryption" | None found | Phones, Macs and iCloud Backup |
Why end-to-end encryption isn't the whole answer
HHS's cloud computing guidance (opens in a new tab) makes the point directly. A service that maintains PHI for you is a business associate, and needs a BAA, "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." The narrow conduit exception "is limited to transmission-only services." None of these companies says it is your conduit or your business associate.
Encryption also does nothing at the two ends of the conversation, which is where practices lose control:
- The message sits on a staff member's personal phone, outside any audit log.
- The practice can't retrieve it, delete it or add it to the chart when that person leaves.
- Anyone who gets past the phone's passcode, or picks up a tablet signed into the same account, can read it.
The Security Rule expects device and media controls (opens in a new tab): policies "that govern the receipt and removal of hardware and electronic media" containing electronic PHI, plus disposal and re-use rules. A personal phone full of patient chats is exactly that hardware. More in Security Rule device controls.
Does Meta, Signal or Apple sign a BAA?
Meta (WhatsApp). Section 4.2 of the Business Platform terms says a business "may not provide any information or data to Meta that is subject to safeguarding and/or limitations on distribution" under law, and that Meta is not a business associate. The WhatsApp Business App terms (opens in a new tab) (effective September 23, 2026) make "no representations or warranties" that the app meets the needs of regulated entities "such as healthcare."
WhatsApp's encryption article (opens in a new tab) adds a detail for businesses: when a business uses a third-party agent through a Meta-operated service to manage chats, "these conversations are not considered end-to-end encrypted."
Signal. Its home page (opens in a new tab) promises end-to-end encryption and says "We can't read your messages." Its terms, effective since May 25, 2018, say nothing about HIPAA, health information or business use. We found no BAA offering.
Apple (iMessage). Apple's iMessage security overview (opens in a new tab) says "Apple can't decrypt the data." We found no Apple page offering a BAA, and its iCloud terms point the other way.
Personal phones, backups and lost devices
Backups are where "encrypted" chats quietly stop being encrypted:
- WhatsApp. Its backup article (opens in a new tab) says Google Account backups aren't end-to-end encrypted unless the user turns it on (Settings > Chats > Chat Backup > End-to-end encrypted backup).
- iMessage. Apple's iCloud data security overview (opens in a new tab) says that under Standard Data Protection, iCloud Backup "includes a copy of the Messages in iCloud encryption key." Only Advanced Data Protection makes the backup end-to-end encrypted.
- Shared family devices. An iPad signed into a parent's Apple Account, or WhatsApp linked on a home computer, shows the same patient threads.
- Staff turnover. When a medical assistant leaves, the patient conversations leave on their phone.
- Lost phones. Without device management, the practice can't wipe a personal phone remotely.
If a patient messages you first
Patients will message you on WhatsApp or iMessage because it's what they use. HHS's email FAQ (opens in a new tab) lets providers rely on a patient's choice of email and tell patients about the risks. It doesn't address a messaging app whose vendor disclaims HIPAA, so the safer course is to move the conversation.
Illustrative example (reply from a fictional practice): "Thanks for reaching out to Northside Pediatrics. To protect your privacy we can't discuss health details here. Please call us at the number on our website or send a message through the patient portal, and we'll take it from there."
Then:
- Don't confirm diagnoses, results or the reason for a visit in the thread.
- Note the patient's request in the chart.
- Follow your records policy for the thread on the device.
- If staff numbers are getting patient messages, publish one official contact route on your website and voicemail.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Safer ways to message patients
- Your patient portal or EHR messaging, under the BAA you already have with your EHR vendor.
- A secure texting tool with a BAA. What to check is in HIPAA-compliant texting.
- Staff coordination in a covered workspace, with patients kept out. See Slack and HIPAA.
- Website requests through HIPAA-compliant forms and HIPAA-compliant website chat.
Medfy doesn't sell messaging apps. Its website forms, and its HIPAA AI chat widget add-on, deliver patient requests into an encrypted patient CRM and inbox. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, covered by the BAA Medfy signs with each practice. More in how Medfy handles patient data.
Video calls on personal apps raise the same questions; see FaceTime and HIPAA, or the HIPAA-compliant email and messaging hub for every tool. A free marketing audit shows how patients find and contact you today.
Frequently asked questions
Can doctors use WhatsApp with patients?
Not for patient health information. Meta's terms for the WhatsApp Business Platform say Meta isn't a HIPAA business associate and that the platform 'is not HIPAA compliant,' and the Business App terms disclaim fitness for healthcare. Use your patient portal, EHR messaging or a tool whose vendor signs a BAA instead. Confirm your messaging policy with your compliance officer or attorney.
Is Signal HIPAA compliant because it's encrypted?
Encryption alone doesn't settle it. HIPAA expects a business associate agreement with vendors that handle PHI, plus device, access and audit safeguards. Signal's terms don't mention HIPAA, healthcare or business use, and we found no Signal BAA offering. Messages also live on personal phones your practice doesn't control. Choose a tool with a BAA, and confirm the decision with your compliance officer or attorney.
Is iMessage safe for patient communication?
Not as a practice channel. Apple says iMessage is end-to-end encrypted, but we found no Apple BAA for it, and Apple's iCloud terms tell covered entities not to use iCloud for protected health information. Under Apple's standard setting, iCloud Backup also holds the key to Messages in iCloud. Use your portal or a BAA-covered tool, and confirm the policy with your compliance officer or attorney.
What if a patient messages us on WhatsApp first?
Reply briefly without health details and move the conversation to a covered channel: your portal, a phone call or a BAA-covered messaging tool. Don't confirm diagnoses, results or the reason for a visit in the thread. Note the patient's request in the chart and follow your records policy for the thread itself. Confirm the reply script with your compliance officer or attorney.