Is WhatsApp HIPAA compliant?
No, Meta's own platform terms state that it 'is not a Business Associate' and that the WhatsApp Cloud API 'is not HIPAA compliant', and no WhatsApp product on any tier comes with an agreement.
Applies to WhatsApp. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
If you keep using it anyway
- Do not message patients on WhatsApp, personal or Business. Meta's business terms disclaim exactly this use: it makes 'no representations or warranties that our Business Services meet the needs of entities regulated by laws and regulations with heightened confidentiality requirements for personal data, such as healthcare' entities.
- Do not read end-to-end encryption as a compliance answer. OCR's guidance treats encrypted transmission as one factor in a risk analysis, and requires an agreement with any vendor that is 'more than a mere conduit for PHI'.
- If patients initiate contact on WhatsApp, move the conversation to a covered channel and keep the WhatsApp thread free of anything clinical.
Does WhatsApp sign a business associate agreement?
Meta does not offer one. Not applicable. Meta's terms state it is not a business associate rather than offering a route to become one.
What this means in practice
WhatsApp is the no-verdict where the vendor did the site's work for it: Meta's own platform terms state that Meta is not a business associate and that the WhatsApp Cloud API is not HIPAA compliant, and its business terms disclaim suitability for healthcare entities outright. There is no enterprise tier, no add-on and no sales conversation that changes this: regulated health information is classified as Prohibited Information that Meta accepts no liability for.
The encryption argument fails here the same way it fails for FaceTime, with one addition. End-to-end encryption covers the message in transit; it does not cover the metadata Meta holds, the chat backups sitting in a phone's cloud account, or the absence of the agreement OCR requires with any vendor that is more than a mere conduit. A message can be unreadable in transit and still be a compliance failure at both endpoints.
The hard part is patients, who start WhatsApp conversations because it is how they message everyone. The workable policy is a redirect script the front desk actually uses: acknowledge, move the conversation to the covered channel, and keep anything clinical out of the WhatsApp thread. International patient populations make this a live daily issue rather than an edge case, which is an argument for a covered channel patients find as easy as WhatsApp, not for quietly using WhatsApp.
How organizations get this wrong
- Reading end-to-end encryption as compliance, when Meta's own terms state the platform is not HIPAA compliant and Meta is not a business associate.
- Replying clinically in a WhatsApp thread a patient started, instead of redirecting to the covered channel.
- Using WhatsApp Business or the Cloud API for appointment reminders because it is a business product: the business terms are where Meta's disclaimer lives.
- Forgetting device backups: staff phones backing up WhatsApp chats put patient conversations into personal cloud accounts nobody assessed.
What the agreement does not cover
- Everything, on every tier. The Cloud API terms classify regulated health information as Prohibited Information and state Meta 'has no liability' for it.
- The consumer app, by silence: no Meta document addresses its HIPAA status directly, and no agreement exists that could cover it.
- Metadata and backups, which sit with Meta and the phone's cloud backup regardless of message encryption.
Use instead
Patient texting where the patient taps a link into a secure session instead of installing anything
A practice phone line and secure messaging app patients actually adopt, with the agreement in the standard terms
The cautionary comparison: even a vendor that signs excludes SMS from its agreement
You just found one. What else is in your stack?
If WhatsApp was a surprise, the rest of your tools are worth checking the same way.
Sources
- WhatsApp Business Platform Cloud API Terms: Meta. Published April 2, 2026. Read August 30, 2026.
- WhatsApp Business Terms of Service: WhatsApp (Meta). Published February 16, 2024. Read August 30, 2026.
- Guidance on How the HIPAA Rules Permit Covered Health Care Providers and Health Plans to Use Remote Communication Technologies for Audio-Only Telehealth: HHS Office for Civil Rights. Published June 13, 2022. Read August 30, 2026.
Meta can change these terms at any time. If something here no longer matches what Meta tells you, tell us.