Is Slack HIPAA compliant?
Only on Slack's top Enterprise tier with a signed agreement, and only for staff-to-staff messages and file uploads: you may never use Slack to message patients.
Applies to Slack Enterprise Grid / Enterprise+. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- You must be on a Slack Enterprise plan (Enterprise Grid, currently branded Enterprise+). Free, Pro and Business+ do not support this use.
- Execute a business associate agreement with Slack.
- Review and agree to implement Slack's 'Requirements for HIPAA Entities' document, requested through Slack's compliance page or support.
- Confine patient information to message content and file uploads only. Slack prohibits it in other fields.
- Set any channel where patient information may be shared to private.
- Deploy data loss prevention able to monitor public channels, private channels and direct messages and quarantine non-compliant content in near real time: Slack's own DLP or an external provider via the Discovery APIs.
- Deploy single sign-on, use backup and archival tooling, and monitor member usage.
- Train your users on the restrictions. Slack requires you to inform users how to use and configure Slack.
Does Slack sign a business associate agreement?
Yes. Slack offers one. Slack Enterprise plan only (Enterprise Grid / Enterprise+) Contact Slack via slack.com/trust/compliance using the 'Request requirements for HIPAA entities' option, or through your account team. You must both execute the agreement and agree to implement Slack's requirements.
What this means in practice
Slack is the entry where the honest answer for most small organizations is that the door is technically open and practically shut. Coverage exists only on Slack's top Enterprise tier, so Free, Pro and Business+ are out entirely, and there is no partial upgrade. On top of the agreement you must also agree to implement Slack's separate requirements document, which obliges you to run single sign-on, backup and archival tooling, and data loss prevention capable of watching public channels, private channels and direct messages and quarantining content in near real time.
The absolute rule is the one people trip over hardest: Slack may not be used to communicate with patients, plan members, or their families or employers, and those people may not be added as users or guests. There is no exception for a quick billing question.
Even inside the walls, patient information belongs only in message text and file uploads. Channel names, topics and other fields are outside the covered surfaces, and email into Slack does not work for organizations configured this way at all.
How organizations get this wrong
- Sitting on Business+ and assuming there is a middle upgrade path, when Enterprise Grid, now branded Enterprise+, is the only supported tier.
- Adding a patient or a family member as a single-channel guest to resolve a billing query, which Slack prohibits outright.
- Putting a patient's name or condition in a channel name or topic rather than in a message, which places it outside the covered surfaces.
- Signing the agreement but never deploying data loss prevention that can quarantine offending content in direct messages in near real time.
What the agreement does not cover
- Communicating with patients. Slack states it may not be used to communicate with patients, plan members or their families or employers, and they may not be added as users or guests.
- Patient information in any Slack surface other than messages and files.
- Email into Slack. Slack states it is not possible to send emails to Slack on HIPAA-compliant organizations.
- All Slack plans below Enterprise.
Alternatives
In scope under Microsoft's agreement on standard business subscriptions, with no enterprise-only gate
Covered by the Workspace amendment you accept yourself in the Admin console
Built for clinical messaging, including the patient-facing communication Slack forbids
Keep a record of your Slack agreement
Sources
- Slack and HIPAA: Slack. Read July 29, 2026.
- Configure Enterprise Grid to be HIPAA-compliant: Slack. Read July 29, 2026.
- Resources for compliance: Slack. Read July 29, 2026.
Slack can change these terms at any time. If something here no longer matches what Slack tells you, tell us.