BAA guide
Is Slack HIPAA compliant?
Plan by plan, from Slack Technologies's own pages.
Only on a plan where the vendor signs a BAA. Slack is not HIPAA compliant on its own. Enterprise+ and Enterprise Grid: Slack says you must buy Slack HIPAA Enabled with a covered enterprise plan, sign a BAA, and follow the Slack Guide for HIPAA Entities. Business+, Pro, and Free: no BAA. Slack says HIPAA support requires a Slack Enterprise plan.
Checked against Slack's own pages, linked in the table.
Which Slack plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Enterprise+ and Enterprise Grid | BAA only if the condition is met | Slack says you must buy Slack HIPAA Enabled with a covered enterprise plan, sign a BAA, and follow the Slack Guide for HIPAA Entities. | On or after March 20, 2023, Customer must purchase Slack HIPAA Enabled along with a covered enterprise plan (as well as sign a BAA).salesforce.com |
| Business+ | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
| Pro | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
| Free | No BAA | Slack says HIPAA support requires a Slack Enterprise plan. | You must be using a Slack Enterprise plan. You must execute a Business Associate Agreement.slack.com |
Training, retention, and access logs
- Model training
- Slack says it will not use Customer Data to train generative AI models unless the customer gives affirmative opt-in consent.
- Retention
- Slack's HIPAA guide says customers should customize message and file retention, and Slack keeps message and file data for 30 days after the commercial agreement ends unless deleted earlier.
- Access logs
- Slack's HIPAA guide says customers are responsible for using Slack's monitoring APIs, including audit logs and data loss prevention tools, to monitor how users handle PHI.
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Will Slack sign a BAA?
Yes, on an enterprise plan. Slack says that when a customer has signed a BAA and is using Enterprise Grid for PHI, Slack is deemed a business associate.
What do we need to buy to use Slack with PHI?
Slack's HIPAA guide says you must purchase Slack HIPAA Enabled along with a covered enterprise plan and sign a BAA. The Free, Pro, and Business+ plans do not qualify.
Are the Slack Free, Pro, or Business+ plans covered?
No. Slack's HIPAA help article says you must be using a Slack Enterprise plan and must execute a Business Associate Agreement before Slack can support your HIPAA compliance.
Does Slack train generative AI on our messages?
Slack says it will not use Customer Data to train generative AI models unless the customer gives affirmative opt-in consent. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Related
- Is Microsoft Teams HIPAA compliant?
- Is WhatsApp HIPAA compliant?
- Is Zoom HIPAA compliant?
- Is Google Drive HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Microsoft 365 HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: Slack Technologies's own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free