On this page
No. As of November 12, 2026, Meta's terms for the WhatsApp Business Platform say Meta "is not a Business Associate" under HIPAA and that the platform "is not HIPAA compliant." The terms for the WhatsApp Business app make no promise that it suits healthcare. There is no BAA on any version, so WhatsApp is not a place for conversations about a patient's care.
Checked November 12, 2026 on the Meta Terms for WhatsApp Business Platform (last modified September 23, 2026), the WhatsApp Business app terms (effective September 23, 2026) and WhatsApp's business messaging policy. Terms change, so confirm before you rely on this.
What does WhatsApp say?
WhatsApp comes in three forms, and none has a BAA.
- WhatsApp Business Platform (the API that CRMs and chat tools connect to). Section 4.2 of Meta's terms says: "With regard to health information, you acknowledge that Meta is not a Business Associate or Subcontractor" as HIPAA defines those terms, "and that the WhatsApp Business Platform is not HIPAA compliant."
- WhatsApp Business app (the free app for small businesses). Its terms say WhatsApp makes no representations that the service meets the needs of entities regulated by laws "with heightened confidentiality requirements for personal data, such as healthcare, financial, or legal services entities."
- Personal WhatsApp. It is a consumer app. We found no BAA or HIPAA terms for it.
WhatsApp's business messaging policy adds an instruction: "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information." For a US practice covered by HIPAA, that describes you.
But WhatsApp is encrypted. Isn't that enough?
No. WhatsApp encrypts messages end to end, and that is a real protection in transit. HIPAA asks for more than encryption. It asks for a contract, the BAA, in which the vendor takes on duties for the patient information it handles. Meta's terms say in plain words that it won't be your business associate.
Encryption also stops at the phone. Chats sit unlocked in the app, in phone backups, on a linked laptop and in the phone's photo gallery if media is set to save there. A VA's personal phone with patient chats on it is outside anything you control.
What can a practice still use WhatsApp for?
A narrow set of things, none involving patient care:
- talking with your VA or team about schedules and tasks, with no patient names tied to health details
- messages with vendors, lab reps and contractors
- answering a stranger's general question: hours, location, whether you offer telehealth in their state, how to book
Keep out of WhatsApp:
- symptoms, medications, doses and side effects
- lab results, or photos and PDFs of them
- appointment reminders that name the visit type or program
- group chats or broadcast lists of patients, which also show members to each other
- "quick questions" from existing patients about their treatment
What if a patient messages you on WhatsApp first?
It happens often, mostly with patients who use WhatsApp for everything. You can't stop them sending a message. You can choose not to continue the clinical conversation there.
A reply that works: "Thanks for your message. To keep your information private, we don't discuss care over WhatsApp. Please send this through the patient portal, or call us at the office number." Then answer the question in the portal and note it in the chart.
Put the same line in your WhatsApp Business away message and profile, so patients see it before they type. Tell new patients at intake which channel to use for questions, and they are less likely to go looking for you elsewhere. Our guide to reply time for new patient inquiries covers how fast that channel needs to be.
What about WhatsApp inside a CRM or chatbot?
Tools such as GoHighLevel and ManyChat can connect a WhatsApp number through the Business Platform. A BAA with the CRM doesn't change Meta's terms. The messages still travel through a platform whose owner says it isn't HIPAA compliant. Use that connection for general lead questions and booking links only. See Is GoHighLevel HIPAA compliant?
What to use for patient messages instead
| Option | BAA | Plan |
|---|---|---|
| WhatsApp (any version) | No | Not on any plan |
| iMessage | No | Not on any plan |
| Your EHR's patient portal | Covered by the EHR's BAA | Depends on the EHR |
| Spruce Health | Yes | All trials and paid plans |
| Quo (formerly OpenPhone) | Yes, on request | Business or Scale |
| Google Voice with Workspace | Yes, under the Workspace BAA | A Voice license on a paid Workspace account |
For consent and wording, read HIPAA-compliant texting for a solo practice. Related: Is iMessage HIPAA compliant? and Is Google Voice HIPAA compliant?
To check every tool you use, try the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does WhatsApp sign a BAA?
No. Meta's terms for the WhatsApp Business Platform say Meta is not a business associate under HIPAA and that the platform is not HIPAA compliant (as of November 2026).
Is WhatsApp Business HIPAA compliant?
No. The Business app's terms make no promise that it meets the needs of healthcare entities, and there is no BAA for it.
Is WhatsApp safe for patients because it is end-to-end encrypted?
Encryption protects messages in transit, but HIPAA also requires a BAA with the vendor, and Meta doesn't offer one. Chats also stay readable on phones, backups and linked devices.
What should I do when a patient messages me on WhatsApp?
Reply without clinical detail, ask them to use your patient portal or office line, and answer there. Add the same note to your away message.