Does Slack Sign a HIPAA Business Associate Agreement?

By BAA Generator Research Team  ·  Published Apr 19, 2026  ·  Last reviewed Apr 28, 2026  ·  2 min read

Slack is ubiquitous in modern workplaces, including healthcare. But its HIPAA compliance options are significantly more limited than competitors like Microsoft Teams or Google Workspace. If your healthcare organization uses Slack for any communications involving patient data, understanding these restrictions is critical.

Which Slack Plans Are HIPAA Eligible?

Slack's HIPAA BAA is only available with Slack Enterprise Grid — the top-tier enterprise plan. This plan:

• Requires a custom sales contract — no self-service sign-up
• Is priced on a custom per-seat basis (typically $12.50+/user/month minimum)
• Requires signing a HIPAA BAA directly with Slack's legal team
• Includes advanced security controls, audit logging, and data residency options

Not eligible: Slack Free, Slack Pro ($7.25/user/month), Slack Business+ ($12.50/user/month). Despite Business+ being priced near Enterprise Grid entry levels, it does not qualify for a HIPAA BAA.

What This Means for Smaller Healthcare Practices

For solo practices, small clinics, and startups, Slack Enterprise Grid is rarely a practical option. The custom sales process, minimum seat requirements, and pricing make it inaccessible for most small healthcare teams.

Practical alternatives for smaller organizations:

• Microsoft Teams — HIPAA BAA available on Business Basic and above (from ~$6/user/month)
• Google Chat — covered under Google Workspace's HIPAA BAA on paid plans
• TigerConnect — dedicated HIPAA-compliant healthcare messaging platform
• Klara — HIPAA-compliant patient communication for medical practices

If you're already on Slack and need HIPAA compliance, the most cost-effective path for a small team is typically to migrate internal PHI-related communications to Microsoft Teams or Google Chat, keeping Slack for non-PHI business communications.

The Bottom Line

If your organization is using standard Slack (Pro or Business+) for healthcare communications that involve PHI, you are operating outside of HIPAA compliance. Either upgrade to Enterprise Grid, sign the required BAA, and implement required security controls — or move PHI communications to a more accessible HIPAA-compliant platform.

Slack without a BAA is not just a gray area — it's a violation of 45 CFR § 164.504(e) and potentially a reportable breach if PHI was transmitted.