Is Slack HIPAA compliant? Only on Enterprise, with conditions.

The short answer

What Slack's own help article requires

Slack's help center article, Understand Slack's approach to HIPAA compliance, says that on Enterprise subscriptions Slack can be configured to support HIPAA-compliant message and file collaboration. The requirements it lists:

• An Enterprise subscription. "You must be using a Slack Enterprise subscription."
• A signed BAA with Slack.
• Following Slack's guide for HIPAA entities, which you agree to implement.
• No patient communication. Don't use Slack to communicate with patients, plan members, or their families or employers.
• PHI only in certain places: messages, files, file names, and private channel or DM names. Not in other features.
• Monitoring with Slack's data loss prevention or an external DLP provider through Slack's Discovery APIs.
• Not a system of record. Slack isn't to be treated as your record of health information.

The article adds two practical limits: email-to-Slack doesn't work on HIPAA-compliant organizations, and Slack has no BAA with any third-party app provider, so every app you connect is your own decision and needs its own agreement if PHI flows to it. Slack's healthcare resource page also says you submit a list of the workspaces that will hold PHI. Slack's standard terms say that, without a written agreement, Slack isn't a business associate.

The article doesn't address newer features such as huddles or Slack AI. If you plan to use them with PHI, ask your Slack account team in writing.

Why this matters for small practices

Slack doesn't publish Enterprise pricing; it's a sales conversation. For a hospital system that already runs Slack Enterprise with a security team monitoring DLP, the requirements are routine. For a physical therapy clinic, med spa or multi-location wellness brand with 10 to 50 staff, it usually means one of three things happens:

1. The team uses Slack Pro anyway and tells itself it won't discuss patients (it will).
2. Staff use personal text messages or WhatsApp, which is worse.
3. The practice looks for team chat that comes under a BAA it already has.

Team chat under one BAA

How JBMOnboard360 handles team chat

JBMOnboard360 includes team chat, internal audio and video calls between staff, and AI meeting summaries on the Professional plan: $79 per user per month billed annually ($99 monthly). The same Business Associate Agreement, included on every plan, covers the chat, the client records, scheduling, intake forms and invoices, hosted on AWS in the United States. A 10-person team is $790 a month on annual billing, with no separate chat tool to sign a BAA for.

The practical benefit is less about price than context: when a front-desk coordinator asks a practitioner about a client, the conversation happens next to that client's appointments, forms and notes, not in a channel that nobody can find six months later. For multi-location groups, the Business plan ($399 per location per month billed annually, $499 monthly, unlimited users) adds the lead inbox, follow-ups, help desk and WhatsApp concierge.

Where Slack still wins: hundreds of integrations, huge communities, and staff who already know it. If your team runs on Slack for non-clinical work, keep it for that and keep patient talk in the system covered by your BAA. JBMOnboard360 is not an EHR, doesn't send SMS and doesn't process US card payments.