BAA guide
Is Slack HIPAA compliant?
Plan by plan, from Slack's own pages.
Only on a plan where the vendor signs a BAA. Slack is not HIPAA compliant on its own. Enterprise+ and Enterprise Grid: Slack says you must buy Slack HIPAA Enabled with a covered enterprise plan, sign a BAA, and follow the Slack Guide for HIPAA Entities. Business+, Pro, and Free: no BAA. Slack says HIPAA support requires a Slack Enterprise plan.
Checked against Slack's own pages, linked in the table.
Which Slack plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Enterprise+ and Enterprise Grid | BAA only if the condition is met | Slack says you must buy Slack HIPAA Enabled with a covered enterprise plan, sign a BAA, and follow the Slack Guide for HIPAA Entities. | On or after March 20, 2023, Customer must purchase Slack HIPAA Enabled along with a covered enterprise plan (as well as sign a BAA).salesforce.com |
| Business+ | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
| Pro | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
| Free | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
Training, retention, and access logs
- Model training
- Slack says it will not use Customer Data to train generative AI models unless the customer gives affirmative opt-in consent.
- Retention
- Slack's HIPAA guide says customers should customize message and file retention, and Slack keeps message and file data for 30 days after the commercial agreement ends unless deleted earlier.
- Access logs
- Slack's HIPAA guide says customers are responsible for using Slack's monitoring APIs, including audit logs and data loss prevention tools, to monitor how users handle PHI.
Rivvi
HIPAA BAA included
A HIPAA BAA is included on every plan, Free included.
Questions
Will Slack sign a BAA?
Yes, on an enterprise plan. Slack says that when a customer has signed a BAA and is using Enterprise Grid for PHI, Slack is deemed a business associate.
What do we need to buy to use Slack with PHI?
Slack's HIPAA guide says you must purchase Slack HIPAA Enabled along with a covered enterprise plan and sign a BAA. The Free, Pro, and Business+ plans do not qualify.
Are the Slack Free, Pro, or Business+ plans covered?
No. Slack's HIPAA help article says you must be using a Slack Enterprise plan and must execute a Business Associate Agreement before Slack can support your HIPAA compliance.
Does Slack train generative AI on our messages?
Slack says it will not use Customer Data to train generative AI models unless the customer gives affirmative opt-in consent. Rivvi is a free AI workspace for healthcare teams, and a HIPAA BAA is included.
Free to start. Most teams are using it the same day.
Get started for free