Is Slack HIPAA compliant?

Yes, on a Slack Enterprise plan with a signed Business Associate Agreement (BAA), and only for messages and files. A free workspace does not qualify, Slack Marketplace apps have no BAA, and Slack may not be used to communicate with patients.

Does Slack's BAA have to be signed before use?

Yes, Slack's BAA must be executed before a practice uses protected health information (PHI) in Slack. Slack's help article states that rule directly. Slack's HIPAA resource page lists signing the BAA as one of its steps.

Which Slack tier does the HIPAA configuration cover?

Slack's help article says its HIPAA configuration is for Enterprise plans and supports message and file collaboration. Slack names that tier three ways across its pages, and the table below shows each name, whether the BAA covers it and how the BAA is signed.

Enterprise+ pricing is sales-led, so a practice that wants Slack for patient information starts by contacting Slack's Sales team.

Can PHI go into Enterprise Grid messages and file uploads?

Yes, on Enterprise Grid, when Slack's requirements are followed, PHI may be shared in direct, group and channel messaging and in file uploads. Slack supplies those requirements in its Requirements for HIPAA Entities guide, which a practice requests from Slack.

What does the Slack BAA leave out?

The Slack BAA leaves out PHI in any Slack feature other than messages, files, file names and the names of private channels or direct messages. The BAA also leaves out third-party apps, because Slack has no BAA with third-party application providers, including those in the Slack Marketplace.

Slack's help article says a practice may not use Slack to communicate with patients, plan members, or their families or employers. Slack states that it is not possible to send emails to Slack on HIPAA-compliant organizations. Salesforce's BAA restrictions change log records a July 31, 2026 update to the service-specific restrictions for Slack Enterprise Plans.

Is a free Slack workspace covered by the BAA?

A free Slack workspace is not eligible for the HIPAA configuration, because eligibility requires a Slack Enterprise plan. The same rule applies to every plan below Enterprise, so a practice on a free workspace has no BAA path in Slack's stated requirements.

Slack's pricing page lists Business+ as a paid per-user plan. Business+ is still below Enterprise, so a practice that pays for Business+ has no BAA path either.

What must a practice set up before using Slack with patient information?

Slack's HIPAA guidance asks a practice to use an Enterprise plan, sign Slack's BAA before any PHI is used, and configure its workspace per Slack's requirements. The steps below come from Slack's help article and HIPAA resource page.

1. Use a Slack Enterprise plan, since eligibility requires one.
2. Sign Slack's business associate agreement before any PHI is used, because Slack requires the BAA to be executed first.
3. Ask Slack for the Requirements for HIPAA Entities guide, which Slack describes as the only complete source of its implementation requirements.
4. Give Slack a list of every org or workspace that will use PHI, as Slack's HIPAA resource page directs.
5. Configure the workspace per Slack's requirements.
6. Keep PHI to messages, files and file names, and out of every other Slack feature.

Where does fax fit when a practice sends patient records?

A practice that must send patient records to an outside fax number needs a fax service that signs a BAA. Whether a fax service needs a BAA explains that step. A small office that shares a fax inbox can read a shared fax inbox for a small office. Every Fax Pigeon plan includes the business associate agreement Fax Pigeon signs at signup, along with a shared inbox with roles and assignment.

* Slack's HIPAA and BAA terms were read on its own site on October 13, 2026. Fax Pigeon is not affiliated with Slack.