Is Slack HIPAA Compliant? A Guide for Group Practices

Is Slack HIPAA compliant? Only on Slack's enterprise-level plan, and only after three things are in place: your practice signs a Business Associate Agreement (BAA) with Slack, buys the "Slack - HIPAA Enabled" add-on that Slack has required since March 20, 2023, and follows the rules in Slack's Guide for HIPAA Entities. On Slack's own pricing page, "Support for HIPAA compliance" is marked for Enterprise+ only. Pro and Business+ don't have it, and neither does Slack's unpaid plan. And even on Enterprise+, Slack rules out one use completely: "You may not use Slack to communicate with patients, plan members, or their families or employers."

This guide is for a group practice or a therapy team deciding whether staff can talk about clients in Slack. It answers from Slack's own pages, which we read on October 25, 2026, and gives the date of each one: what Slack requires, where it allows client information and where it bans it, how huddles, apps, Slack Connect and Slack's AI features fit, and what the lower plans mean. Then it covers what HIPAA asks of the practice itself: minimum necessary, de-identifying, retention, closing access when a clinician leaves, and why messaging clients is a separate question from staff chat. You'll also find a Slack policy and a checklist you can copy.

It is general information, not legal advice. Slack isn't a TranqBay competitor, and nothing here is a judgment of Slack as a product. Where the answer turns on your contract, your state or your exact Slack plan, the article says so; those are the points to take to a healthcare attorney.

Is Slack HIPAA compliant? The answer by plan

Slack's pricing page (checked October 25, 2026) lists four plans. Its comparison table marks "Support for HIPAA compliance," described as "Slack can be configured to support protected health information (PHI) in files and message content," on one of them.

So for most small group practices the practical answer is that the Slack they already have can't hold client information, and the plan that can is an enterprise purchase with conditions attached.

What Slack requires before client information goes in

Three documents set the rules. Slack's help article Slack and HIPAA (no date shown; read October 25, 2026) is the summary. The Slack Guide for HIPAA Entities (revised August 12, 2026) holds the detail. Salesforce's Business Associate Addendum Restrictions (last updated September 30, 2026) repeats the Slack requirements as BAA terms. Slack is a Salesforce company, and the guide notes that "references to 'Salesforce' that may be in Customer's contract or BAA include Slack."

Together they ask for six things:

Two more terms are easy to miss. Salesforce's restrictions article makes the customer "responsible for ensuring the secure transmission of PHI data to and from the HIPAA Covered Services," which in practice means managed, encrypted devices and current apps. And the help article notes: "It's not possible to send emails to Slack on HIPAA compliant organizations."

Why vendors attach this many conditions: since the 2013 HIPAA Omnibus Rule, business associates are directly liable for parts of HIPAA, which is one reason a vendor's BAA spells out exactly which uses it covers.

Where Slack allows client information, and where it bans it

Slack's guide is specific. "Users may include PHI in the contents of messages, files, huddles, video and audio clips, and data submitted to custom apps built by Customer to run on Slack Infrastructure." The help article adds file names and "names of private channels or DMs" to the places where PHI is allowed.

The guide then lists fields where users "may not include PHI":

Support requests are off limits too: users "must not include any PHI in the support request or attach any screenshots or documents that include PHI." The guide also says not to include PHI "in any custom invitations to users to join your workspace or channel."

What that looks like in a therapy practice (every name here is invented):

Huddles, apps, Slack Connect and AI features

Huddles

Huddle content is on Slack's allowed list, in a HIPAA-enabled organization. Several pages that rank for this question don't mention huddles at all, so check the date of anything you read. Slack's plans page shows huddles on every paid plan, and one-to-one only on the unpaid plan. Huddle notes are a separate AI feature, covered below.

Other companies' apps

"Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for determining whether an agreement is necessary with an application provider before enabling." That includes scheduling, transcription and note apps, and the third-party "AI assistant apps" Slack's pricing page lists from Pro up.

Slack's app approval article says that by default, members can install apps "without approval from a Workspace Owner." Turn on Only allow pre-approved apps before anyone joins. Restricting an app doesn't remove copies already installed: "members can continue using it," so uninstall what you don't want.

Apps and workflows you build

Data submitted to custom apps your practice builds on Slack's infrastructure can include PHI. The names and code of those apps and workflows can't.

Slack Connect

Slack Connect links your Slack with another company's. The guide allows it, with a condition: "you must ensure that you have the appropriate permissions, where necessary, to share PHI with such recipients and that such communications comply with applicable legal requirements." If you connect with a billing company, it is handling client information for you, so it needs its own BAA with your practice first. Clients can't be brought in this way either: patients "may not be added as users or guests to any Slack workspaces or channels."

Slack's AI features

Slack's lists of allowed and banned places for PHI don't mention conversation summaries, huddle notes, recaps, file summaries, AI search or Slackbot. Neither list covers them, so the guide doesn't settle the question. Here is what Slack's pages do say:

Admins can switch each feature off. Slack's AI access settings let owners choose who can use each AI feature, including No one, and stop new AI features from switching on by themselves (uncheck Always allow access to new AI features). Until Slack confirms in writing which AI features your BAA covers, keep them switched off for the staff who discuss clients in Slack, and turn off automatic huddle notes in clinical channels. A generated summary of a case discussion isn't a progress note, and a huddle transcript that the whole channel can open sits badly with the minimum necessary rule below.

Slack settings for a therapy team

The guide's "Configuration and Use Considerations" read like a setup list for a small practice:

What Slack's lower plans mean for a practice

On Pro, Business+ or the unpaid plan there is no BAA. HHS's guidance on cloud computing (content last reviewed December 23, 2022) is direct about what that means: if a covered entity "uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules." The same page explains that the "conduit" exception covers only transmission-only services, and Slack stores your messages.

That doesn't make Slack useless for a practice without Enterprise+. It means Slack holds the side of the practice that isn't about clients: office logistics, IT problems, policy updates, training reminders, the supply order. Everything about a client goes to the systems that have a BAA.

The trap is scheduling chatter. A first name plus an appointment time, in a practice where everyone can see the calendar, points to one client. Some invented examples:

De-identifying is not the workaround it looks like. Under HIPAA's Safe Harbor method, information is de-identified only when the identifiers are removed and the practice "does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual" (45 CFR 164.514(b)(2)(ii)). In a small practice, colleagues often know the caseload well enough to recognize a client from a few details. Our list of the 18 HIPAA identifiers walks through both conditions with therapy examples. Hold case consultation on a tool covered by a BAA.

If client details are already in a Slack workspace without a BAA, stop adding them, document what happened, and talk to a healthcare attorney before deleting anything. Under the Breach Notification Rule, an impermissible use or disclosure "is presumed to be a breach" unless a risk assessment shows "a low probability that the protected health information has been compromised" (45 CFR 164.402). Our HIPAA violation examples show how these situations have played out for therapy practices.

Minimum necessary in staff chat

A BAA makes Slack a permitted place for client information. It doesn't make every message necessary. HIPAA's minimum necessary standard says a covered entity "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (45 CFR 164.502(b)).

There is an exception that matters for clinicians: the standard doesn't apply to "disclosures to or requests by a health care provider for treatment," and HIPAA's definition of treatment includes "consultation between health care providers relating to a patient" (45 CFR 164.501). But the practice still has to decide who on its own staff sees what. The rule asks you to identify "those persons or classes of persons" in your workforce who need access, the "category or categories of protected health information to which access is needed," and to limit access to match (45 CFR 164.514(d)(2)).

In Slack, that turns into channel design:

Our guide to what therapists can share under HIPAA covers the treatment exception and the minimum necessary rule in more depth.

When a clinician leaves the practice

The Security Rule asks for "procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends" (45 CFR 164.308(a)(3)(ii)(C)). For Slack, that is account deactivation. Slack's deactivation article explains what happens: "People aren't notified when their accounts are deactivated, nor are their messages or files deleted. They'll be removed from all channels, signed out of your workspace(s) on all devices, and unable to sign back in."

Steps for the day someone leaves:

Leaving touches far more than Slack: who tells clients, what options they're offered and who keeps the records. Our guide to starting a group practice covers that plan and the HIPAA program around it.

Messaging clients is a different question

Everything above is about staff talking to staff. Messaging clients is a separate decision with a different answer: Slack's terms rule it out even on Enterprise+ with a BAA, because patients "may not be added as users or guests to any Slack workspaces or channels."

Client messages need a channel built for clients, covered by a BAA with whoever runs it: a client portal, email on a business account, or a business phone line with texting. HHS says the Privacy Rule "does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients," with safeguards such as "limiting the amount or type of information disclosed through the unencrypted e-mail" (HHS FAQ 570). Our guides to Gmail and Google Voice cover the setup, and if your practice runs on Microsoft 365, our Microsoft Teams guide explains when Teams chat can be used.

Whatever you use, keep client messages to logistics, tell clients how quickly you reply, and tell them what to do in an emergency, because a message can sit unread.

A Slack policy you can copy

Fill this in, have every staff member read it before they get an account, and keep it with your HIPAA records.

A Slack HIPAA checklist for group practices

How this works in TranqBay

TranqBay isn't a team chat tool, and it doesn't replace Slack for your staff's conversations. It can shrink what staff need to say in chat. Much of what a therapy team messages about is a client's session: is the booking confirmed, did the intake form come back, is the note written. In TranqBay those details stay with the session, in software covered by a BAA.

See the booking page your clients would use on practice.tranqbay.health, and how a session and its notes fit together in the sessions section.

Questions to take to a healthcare lawyer

Frequently asked questions about Slack and HIPAA

Before anyone types a client's name in Slack

Check three things: your plan is Enterprise+ or an enterprise plan Slack confirms is covered, a signed BAA and the HIPAA Enabled add-on are on file, and staff know which channels can hold client details. If any of the three is missing, Slack is for running the office, and client information belongs in systems that have a BAA with you. When you're ready to move booking, forms, sessions and notes into one place, start with the practice website template and booking page on practice.tranqbay.health.

Sources