Is Slack HIPAA Compliant for Therapists?
Quick Answer
Almost never, in practice. Slack's own HIPAA help article confirms a Business Associate Agreement is available only on Enterprise Grid — the Free, Pro, and Business plans that most small practices actually use are explicitly excluded. Enterprise Grid is priced and structured for large organizations, so for a solo or small group practice, Slack should be treated as not usable for client PHI at all.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified August 2026 against Slack's official HIPAA help article
BAA Available?
Yes
On Which Plan
Enterprise Grid only
Even if your practice grows large enough to consider Enterprise Grid, Slack's BAA does not extend to third-party apps installed from the Slack Marketplace — any bot, integration, or app you add still needs its own separate BAA if it touches PHI, which adds real ongoing compliance overhead.
What to Use Instead for Client Work
For any client-facing communication, SimplePractice's secure messaging is covered under its BAA by default at any plan tier — no Enterprise-level commitment required. Slack, if you use it, is best reserved for internal team chatter that never mentions a specific client.
Affiliate link — we may earn a commission at no extra cost to you.
Why the Plan You Probably Have Doesn't Qualify
Most solo and small-group practices that use Slack are on the Free or Pro plan — exactly the tiers Slack's own documentation excludes from its HIPAA program. There is no add-on or setting that unlocks a BAA on these plans; Enterprise Grid is a fundamentally different product tier, typically requiring a minimum seat count and enterprise-level pricing that puts it out of reach for most individual or small group practices.
The Third-Party App Gap
Even a practice large enough to justify Enterprise Grid needs to audit every Slack app it uses. Slack's BAA covers Slack's own infrastructure, not the countless bots and integrations available in its app directory. A calendar bot, form-filler, or AI summarizer added to a HIPAA-covered Slack workspace needs its own independent BAA — otherwise it becomes the weak link.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Slack and HIPAA
Is Slack HIPAA-compliant on the Pro or Business plan?
No. Slack's own HIPAA help article states plainly that Free, Pro, and Business plans are not eligible for a Business Associate Agreement. Only Enterprise Grid qualifies.
Can a solo therapist realistically get a Slack BAA?
Technically yes, but practically no — Enterprise Grid is priced and structured for large organizations, not solo or small group practices. Most therapists will find it far cheaper and simpler to keep client communication in a purpose-built HIPAA platform instead.
Are Slack apps and bots covered under Slack's BAA?
No. Slack's Business Associate Agreement covers Slack's core infrastructure only. Any third-party app or bot added from the Slack Marketplace needs its own separate BAA if it will handle PHI.