Is WhatsApp HIPAA compliant? No, and Meta says so itself.

The short answer

What Meta's terms actually say

Most articles on this question quote other articles. The primary source is Meta's own contract for businesses that use the API: the Meta Terms for WhatsApp Business Platform. In section 4.2, "Prohibited Data", the business acknowledges, with regard to health information, that Meta is not a "Business Associate or Subcontractor" as HIPAA defines those terms, and that "the WhatsApp Business Platform is not HIPAA compliant." The same section says the platform isn't warranted for businesses regulated by laws with heightened confidentiality requirements, and names healthcare.

That settles it. Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information (PHI) for a covered entity has to sign a business associate agreement (BAA). Meta refuses that role in writing, on every WhatsApp product. There is no paid tier, add-on or partner that changes Meta's position, because the messages still travel through Meta's platform.

"But WhatsApp is end-to-end encrypted"

Encryption is one safeguard. HIPAA asks for more than that: a signed BAA, access controls, audit logs, the ability to retrieve and retain records, and control over who sees what when a phone is lost or a staff member leaves. A WhatsApp chat on an employee's personal phone fails most of those tests even before you get to the missing BAA. The HHS guidance on cloud computing is clear that a service provider handling ePHI is a business associate even when the data is encrypted and the provider can't read it. So "they can't see the messages" doesn't remove the BAA requirement.

Who this applies to

HIPAA applies to covered entities (health plans, clearinghouses and providers that bill electronically, such as most physical therapy, chiropractic and medical practices) and their business associates. A cash-only med spa, IV hydration lounge or wellness clinic may or may not be a covered entity; that's a question for your compliance advisor. But even when HIPAA doesn't strictly apply, state privacy laws and client expectations do, and "we kept health details off WhatsApp" is the safe default.

If clients message you anyway

How to use WhatsApp without putting PHI on it

Many US practices didn't choose WhatsApp; their clients did. Pew Research Center's 2026 fact sheet puts WhatsApp use at about 26% of US adults overall, and much higher among Hispanic adults, Asian American adults and urban adults. If those are your clients, refusing the channel loses leads. The workable approach is a fence:

1. Limit the topics. Use WhatsApp only for general questions, prices, hours, directions and booking a callback. Write that limit into your staff policy.
2. Say it in the first reply. A short line such as "please don't share medical details here; we'll collect those securely" sets expectations and protects the client.
3. Move health details to a covered channel. Send a link to an intake form hosted by a vendor that signs your BAA, or call the client back.
4. Keep the number off personal phones. Use a WhatsApp Business number connected to a system your team logs into, so conversations don't leave with an employee.
5. Log the lead, not the diagnosis. The CRM record should say "asked about consultation pricing", not why.

How JBMOnboard360 handles this

JBMOnboard360's WhatsApp concierge (Business plan) is built around that fence. It answers people who message you first, from a knowledge base you write: services, starting prices, hours, location and how to book. It saves the lead to the client record and books a callback for your team. It does not answer phone calls, it does not send SMS, and it is not a marketing broadcast tool, since Meta blocks those messages to US numbers.

Be precise about what our BAA covers. JBMOnboard360 includes a Business Associate Agreement on every plan, and it covers JBMOnboard360's own system, hosted on AWS in the United States: client records, intake forms, scheduling and notes. It does not and cannot cover the WhatsApp transport, which runs through Meta. So the rule inside JBMOnboard360 is the same as above: no PHI over WhatsApp. Clinical questions go to your HIPAA-ready intake forms and your own clinical system; JBMOnboard360 is not an EHR.