Free HIPAA-Compliant Chat: The Complete Guide for Healthcare Providers (2026)

Last updated: September 2026. Pricing and compliance information verified as of this date. Verify current details directly with each vendor.

This guide is reviewed and updated quarterly to reflect changes in HIPAA requirements, platform pricing, and compliance certifications.

---

You already know HIPAA matters. You went through the training, you lock your filing cabinets, you're careful about what you say in the waiting room. Then a patient texts you a question about their medication between sessions, and that careful instinct kicks in: is this okay?

It's a fair question. The answer depends on the platform.

HIPAA-compliant chat is a messaging platform that meets all HIPAA requirements for protecting patient health information (PHI). That means end-to-end encryption, a signed Business Associate Agreement (BAA), audit trails, and access controls, working together so every message is protected in transit, at rest, and in the event of a breach.

Whether you're searching for HIPAA-compliant texting, secure text messaging, or compliant chat, the requirements are the same, and free options that meet every standard exist today.

One distinction to keep in mind: a platform can be secure without being compliant, and capable of compliance without being compliant. Security is one technical layer. Compliance is the full picture: legal agreements, operational policies, and technical safeguards working together.

This guide walks through what free HIPAA-compliant chat requires, which free tools meet those requirements, and how to get set up in under 30 minutes with no IT department.

Disclaimer: This guide provides general information about HIPAA-compliant communication tools for healthcare providers. It is not legal advice, and should not be relied upon as a substitute for consultation with a qualified healthcare compliance professional or attorney. HIPAA compliance requirements may vary based on your specific practice, state regulations, and organizational structure.

---

The Three Pillars of HIPAA-Compliant Chat

HIPAA-compliant chat stands on three pillars. Remove any one and the whole thing collapses. Knowing the three gives you a way to evaluate any platform, free or paid, in about five minutes.

Pillar 1: Secure Infrastructure

End-to-end encryption means messages are scrambled the moment they leave your device and only unscrambled when they reach the intended recipient. Think of a locked filing cabinet that only you and your patient have the key to, except the lock changes with every message.

Secure infrastructure also includes US-based HIPAA-compliant data hosting, automatic session timeouts, and message retention policies that define how long data lives and when it's purged.

Pillar 2: Legal Protection (the BAA)

A Business Associate Agreement is a legally binding contract between you and your technology vendor that spells out how they'll protect patient data and what happens if something goes wrong. It works like the confidentiality agreement you'd sign with an outside billing company.

A platform that won't sign a BAA cannot make you HIPAA compliant. Without that legal agreement, you carry all the liability yourself (HHS.gov, "Business Associates").

Pillar 3: Operational Compliance

This is your part. The platform handles Pillars 1 and 2. Pillar 3 is how you and your team use the tool: written messaging policies, staff training, and access limited to the people who need it. Role-based access makes that separation automatic. Your front-desk coordinator sees scheduling messages, not clinical notes.

The 7-Point HIPAA Chat Compliance Checklist

Before you commit to any platform, run it through these seven non-negotiables:

1. End-to-end encryption: Messages protected in transit and at rest
2. Signed Business Associate Agreement (BAA): Legal accountability from the vendor
3. Audit trail: A log of who accessed what and when
4. Role-based access controls: Different permissions for different team members
5. US-based HIPAA-compliant hosting: Data stored on servers meeting federal standards
6. Automatic session timeout: Idle sessions lock after a set period
7. Message retention policy: Clear rules for storage duration and deletion

Most platforms handle items 1, 2, 5, 6, and 7 automatically. Your main job is setting up access controls and documenting your messaging policies.

---

Why iMessage, SMS, and WhatsApp Aren't HIPAA-Compliant Texting Apps

HIPAA texting guidelines start with what standard messaging apps get wrong. If you've been texting patients on iMessage because it felt secure enough, you're in good company. Encryption is only one of three pillars, and iMessage doesn't clear the other two.

iMessage: Apple encrypts messages end-to-end but will not sign a BAA. No audit trails, no role-based access controls.

SMS / Standard Text: Not encrypted at all. Messages travel through carrier networks in plain text. No carrier offers a BAA.

WhatsApp: End-to-end encryption, but Meta does not sign BAAs. Terms of service allow metadata collection.

Google Chat (Free): Google Workspace paid plans at the Business Plus tier and above can be configured for HIPAA compliance with a signed BAA (Google Support). Lower-tier plans like Business Starter lack the security controls required. The free personal version does not qualify.

Signal: Excellent encryption protocol, but no BAA, no audit trails, not designed for healthcare use.

Telegram: Default chats are not end-to-end encrypted (only "Secret Chats" use E2E encryption). No BAA. Does not meet HIPAA standards by any measure.

RCS: Encryption support is carrier-dependent and inconsistent. No BAA available for healthcare use.

The Gray Areas

What if a patient texts you first on iMessage? You haven't violated HIPAA by receiving that message. The problem starts if you respond with PHI on a non-compliant platform. Acknowledge receipt, then redirect: "Thanks for reaching out. Let me respond through our secure messaging so we can discuss this properly."

What about peer consultation on Signal? Discussing a case with a colleague without any identifying patient information is generally acceptable. The safer habit is to use a compliant platform for all professional communication.

---

Free HIPAA-Compliant Chat Tools That Actually Work

A free tool can be HIPAA compliant.

HIPAA compliance means meeting specific technical, legal, and operational standards. Those standards don't have a price floor. A platform that encrypts messages, signs a BAA, maintains audit trails, and hosts data on compliant servers meets the requirements whether it charges $200 a month or nothing.

The real question is why would a company offer this for free? Some companies use a product-led growth model: offer a useful free product, build trust, and grow revenue through optional paid features or adjacent services. No data monetization, no selling patient information, no hidden costs.

Free HIPAA-compliant instant messaging is available today, no enterprise contract required.

Free HIPAA-Compliant Texting and Chat Apps

Disclosure: This guide is published by the Mahla team, built on our experience developing a behavioral health platform for a multi-state practice. We evaluate all platforms against the same compliance criteria, but readers should be aware of our commercial interest in Mahla. Verify all claims independently.

If you're looking for a HIPAA-compliant texting app or secure text messaging platform, these are the options that meet every requirement, and what each one costs.

Mahla: The base platform is free. No trial, no per-user fees. Built for solo therapists, new graduates, and small clinics (1-5 providers). End-to-end encryption, BAA included at signup, full audit trail, role-based access, US-based hosting, configurable retention. The AI layer drafts session notes, coordinates appointments, and creates follow-up templates, work that eats administrative time every day, at about $1 per task. Built by a behavioral health team that built and ran a multi-state practice. 7/7 on compliance checklist. Mahla meets all seven technical and legal requirements above. Your operational policies (Pillar 3) complete the picture.

Spruce: A 14-day free trial, no credit card, and the BAA is included on the trial and on every paid plan (Spruce Health). After the trial, plans start at $24/user/month. Encrypted messaging, phone, fax, and team chat. 7/7 on core compliance. Free for 14 days, then paid.

OhMD: No free tier. Plans start at $300/month with a BAA included. Two-way patient texting, call deflection, video visits, and web chat. Solid for practices that need high-volume two-way SMS. 7/7 on core compliance. Paid only.

Google Chat (Workspace BAA): If you already pay for Google Workspace at the Business Plus tier or above (~$22/user/month annually), Google Chat can be configured for HIPAA compliance (Google Support). Not a free standalone solution. Requires manual security configuration. 7/7 when properly configured. Requires a paid subscription.

When Paid Options Make Sense

If your practice has more than five providers, needs EHR integration, or operates across multiple locations, paid platforms like TigerConnect, Klara, or Halo Health offer enterprise features that justify the cost. The compliance standards are the same. You're paying for operational scale, not better security.

---

HIPAA-Compliant Chat Comparison: Free vs. Paid at a Glance

Pricing and feature information verified as of September 2026. Platform offerings change frequently. Verify current pricing, features, and compliance certifications directly with each vendor before making decisions.

Finding the best HIPAA-compliant text messaging app depends on your practice size, budget, and workflow needs. Here's how the leading options compare.

Key Takeaways

For solo providers and small clinics, free options cover all essential HIPAA requirements. You don't need to spend $24-50+ per user per month to message patients compliantly.

Paid platforms add enterprise features (EHR integrations, multi-department routing, admin dashboards), but these aren't compliance requirements.

AI is the emerging differentiator. Most legacy platforms treat chat as a static messaging pipe. AI-native platforms handle work on your behalf: drafting responses, coordinating appointments, generating documentation.

---

How to Choose the Best HIPAA-Compliant Messaging App for Your Practice

Start with your practice size, then narrow by budget and feature priorities. Whether you need a HIPAA-compliant texting platform for patient outreach or an internal messaging tool for your clinical team, the decision framework is the same.

Solo provider (1 provider):

• $0 → Mahla. Full HIPAA compliance, BAA at signup, AI handles scheduling and follow-ups for about $1 per task.
• $25-50/mo → Spruce Health. All-in-one communication with phone, fax, and messaging.

Small practice (2-5 providers):

• Free → Mahla. AI workflow automation on a free base.
• $24-49/user → Spruce Health. Add OhMD ($300/month) if you need high-volume two-way SMS.
• Moderate with EHR → Klara or Spruce Health.

Growing practice (6-15 providers):

• Klara, Spruce, or Google Workspace for internal communication alongside a patient-facing tool.

Enterprise (15+ providers, multi-location):

• TigerConnect or Halo Health for clinical alerting and system-wide communication infrastructure.

Questions to Ask Before You Sign Up

1. Does the BAA activate automatically at signup? If you have to negotiate terms separately, the platform wasn't designed for small practices.
2. Where is my data physically stored? Look for US-based, HIPAA-compliant cloud infrastructure.
3. What happens to my data if the company shuts down? Understand data portability before you commit.
4. Is there a minimum user requirement? Enterprise platforms often require 5-25+ seats.
5. Does the platform add work or remove it? A compliant tool that creates more administrative overhead solves one problem while creating another.

Red Flags

• "HIPAA capable" instead of "HIPAA compliant": configuration responsibility falls on you.
• BAA costs extra: a legal requirement shouldn't be a premium feature.
• Pricing hidden behind "Contact Sales": budget-conscious providers deserve upfront costs.

---

HIPAA-Compliant Texting for Therapists, Counselors, and Small Practices

If you're a newly licensed therapist juggling clients, a supervisor, and a growing practice, communication eats hours you could spend on your clients. Somewhere in the back of your mind, you're wondering whether those text threads are HIPAA compliant. HIPAA-compliant texting for therapists solves both problems: secure patient messaging that protects your license while cutting administrative work.

How It Fits Therapeutic Workflows

• Intake coordination: Send secure intake forms, consent documents, and pre-session questionnaires from the first interaction.
• Appointment reminders: Automated reminders reduce no-shows without adding to your workload.
• Between-session check-ins: "How did the breathing exercise go this week?" strengthens rapport compliantly.
• Session follow-ups: Share homework summaries, resource links, or treatment plan updates securely.
• Supervision communication: Discussing case details with your supervisor requires a compliant channel, not a text thread on your personal phone.

HIPAA-compliant patient messaging keeps every clinical exchange, from intake to discharge, documented, encrypted, and audit-ready.

Three Real-World Scenarios

Solo therapist, 15 clients. Monday morning, your platform has already sent automated appointment reminders. Two clients reschedule in-thread in three minutes. After your first session, you send a follow-up with a mindfulness resource. No phone tag, no compliance anxiety.

Pre-licensure counselor with supervisor. You need to discuss a client's treatment plan before your next session. Your compliant chat lets you message your supervisor with case details and document the consultation with a built-in audit trail.

Small 3-provider group practice. Three therapists coordinate schedules, share client handoff notes when covering for each other, and discuss admin issues, all in HIPAA-compliant group chat with audit logs and access controls.

A Note on Substance Use Treatment

If any clients are receiving substance use disorder treatment, 42 CFR Part 2 adds confidentiality protections beyond standard HIPAA. Even a message that could identify someone as a substance use treatment patient triggers Part 2 requirements. Your chat platform must support the additional consent documentation Part 2 requires. The February 2024 final rule aligned Part 2 with HIPAA in several ways, including a single-consent framework for treatment, payment, and healthcare operations. The compliance deadline for these changes was February 16, 2026 (HHS, "42 CFR Part 2 Final Rule," 2024).

---

Set Up HIPAA-Compliant Chat in Under 30 Minutes

If you can set up an email account, you can set up HIPAA-compliant chat. This five-step process takes under 30 minutes.

Note: These steps cover platform setup. Full HIPAA compliance also requires a documented risk assessment, written messaging policies, staff training records, and ongoing review. Your platform handles the technical safeguards. Operational compliance is your responsibility.

Step 1: Choose Your Platform (~2 minutes)

Use the comparison table above. If you're a solo provider starting at $0, Mahla is the most direct path: free, BAA included at signup.

Step 2: Sign Up and Complete the BAA (~5 minutes)

Create your account. During onboarding, sign the BAA electronically, the contract that makes your vendor legally responsible for protecting patient data. On most platforms, this is a standard 3-5 page document that activates automatically.

Step 3: Configure Security Settings (~3 minutes)

Verify these are active: two-factor authentication, automatic session timeout, encryption confirmed, and device passcode enabled. Most platforms designed for small practices handle these by default.

Step 4: Invite Your First Patient (~10 minutes)

Sample message you can copy:

Hi [Patient Name], I'm transitioning to a secure, HIPAA-compliant messaging platform. [Platform Name] protects your health information with encryption, and all our messages will be stored securely. Here's how to get started: [link]. Questions? I'm happy to walk you through it at our next session.

Start with 2-3 patients you have good rapport with.

Step 5: Establish Messaging Policies (~10 minutes)

Document a brief policy covering: what you'll message about (reminders, scheduling, intake forms, brief check-ins), what you won't (detailed clinical discussions, crisis intervention), your response time, and crisis protocol (direct patients to 988 Suicide and Crisis Lifeline or 911 for emergencies).

Already Using Non-Compliant Tools?

Send patients the introduction message, give them a week to transition, then stop sending PHI through non-compliant channels. Most patients adopt the new platform without friction.

Start using Mahla free today: HIPAA-compliant messaging with AI that does the work for you at about $1 per task. No credit card. No per-user fees. Set up in under 10 minutes.

---

HIPAA-Compliant Chat in the AI Era

Providers keep asking: Is there a HIPAA-compliant version of ChatGPT? No, not in the way you might hope. Standard ChatGPT is not HIPAA compliant. OpenAI does not sign BAAs for consumer accounts, and conversation data may be used for model training (OpenAI Help Center). Google Gemini and Anthropic Claude have similar limitations at the consumer tier.

The bigger issue: most HIPAA-compliant chat platforms today are dumb pipes. They encrypt your messages but do nothing to help you write them, organize them, or act on them. Security without utility is a missed opportunity.

AI-native HIPAA chat is a different category. Instead of bolting AI onto a legacy messenger, AI-native platforms build compliance infrastructure and workflow support into the same architecture:

• Auto-generated session notes from chat conversations
• Appointment coordination without a separate tool
• Follow-up message drafts tailored to clinical context
• Intake form processing that extracts and organizes information automatically

These capabilities exist today inside platforms that meet every HIPAA requirement (BAA, encryption, audit trails, access controls) while cutting the administrative hours that pull providers away from clinical work.

AI will change healthcare communication. The question is whether your tools will be HIPAA compliant when it does.

---

Common HIPAA Chat Misconceptions That Put Providers at Risk

Here are the myths that trip up even careful providers.

"If It's Encrypted, It's HIPAA Compliant"

Encryption is one requirement in the HIPAA Security Rule. Without a signed BAA, audit trails, and access controls, encryption alone leaves you exposed. A locked door protects your office, but if you have no visitor log, no key policy, and no agreement with the cleaning service about what they can access, the lock is doing less than you think.

"BAAs Are Optional for Small Practices"

The HIPAA Privacy Rule requires a BAA with any vendor that stores, transmits, or processes PHI, regardless of practice size (45 CFR § 164.502(e)). Solo therapists carry the same BAA requirements as hospital systems. There is no small-practice exemption.

"Regular Texting Is Fine If You Don't Use Full Names"

PHI includes any information that could identify a patient in a healthcare context: an appointment time, a medication name, a reply confirming a session, or a text thread connecting a phone number to a treatment relationship (45 CFR § 160.103). De-identification requires far more than dropping a last name.

"Setting Up HIPAA-Compliant Chat Requires an IT Department"

This was true a decade ago. Modern platforms handle encryption, BAA execution, audit logging, and access controls automatically during signup. If you can set up an email account, you can set up HIPAA-compliant chat.

---

FAQ: Your HIPAA-Compliant Chat Questions Answered

What free messaging apps are HIPAA compliant?

Among the options in this guide, Mahla is the one with a free base platform: signed BAA, end-to-end encryption, audit trails, and no per-user fees, with AI features at about $1 per task. Spruce Health offers a 14-day trial with the BAA included, then $24/user/month. OhMD has no free tier. Google Chat qualifies only through a paid Google Workspace subscription with a signed BAA. The free personal version does not meet HIPAA requirements. Be cautious with platforms that gate compliance-critical features like BAA execution behind a paid tier.

Is iMessage HIPAA compliant?

No. Apple does not offer a Business Associate Agreement, which is a non-negotiable HIPAA requirement. Receiving a patient's iMessage doesn't itself violate HIPAA. The patient chose that channel. Responding with any PHI on iMessage creates a compliance violation because the platform lacks the BAA, audit trail, and access controls HIPAA requires. Redirect patient conversations to a compliant platform immediately.

Is Google Chat HIPAA compliant?

It depends on the version. Free personal Google Chat is not HIPAA compliant. Google Workspace paid plans at the Business Plus tier and above (starting around $22/user/month annually) can be HIPAA compliant with a signed BAA and proper security configuration (Google Support), including disabling chat history for external users and restricting file sharing. You are responsible for proper configuration. The BAA alone does not make a misconfigured account compliant.

Is TextFree HIPAA compliant?

No. TextFree does not offer a BAA, does not provide enterprise-grade encryption for healthcare, and its terms of service do not support HIPAA-covered communications. It provides a second phone number, which some providers mistakenly believe creates sufficient separation. Using TextFree for patient communication involving PHI is a HIPAA violation.

Is RCS messaging HIPAA compliant?

No. RCS lacks a standardized BAA framework. Encryption support varies by carrier, device, and whether both parties have RCS enabled. There is no way to verify that every patient message meets consistent encryption and compliance standards. Until RCS develops healthcare-specific compliance with BAA support, it carries the same risks as standard SMS.

Is there a HIPAA-compliant version of ChatGPT?

Standard ChatGPT is not HIPAA compliant. OpenAI does not sign BAAs for consumer accounts (OpenAI Help Center). OpenAI offers BAA support through its Enterprise tier, API access, and the newer ChatGPT for Healthcare product (OpenAI, 2026), but all are designed for larger organizations and aren't practical or affordable for solo providers. AI-native HIPAA platforms like Mahla build AI capabilities (session note generation, appointment coordination, follow-up drafts) directly within HIPAA-compliant infrastructure, so providers get AI productivity without feeding PHI into a consumer tool.

What are the HIPAA texting guidelines?

HIPAA does not prohibit texting patients. It does require that any text-based communication containing PHI meet specific safeguards. The core HIPAA texting guidelines require: (1) end-to-end encryption for messages in transit and at rest, (2) a signed Business Associate Agreement with the platform vendor, (3) audit trails logging who accessed what and when, and (4) role-based access controls limiting PHI visibility to authorized users. These requirements apply equally to SMS, chat, and instant messaging. Use the 7-point compliance checklist in this guide to verify any texting or messaging platform. HIPAA texting rules don't distinguish between a chat app and a text messaging app. Both must meet the same encryption, BAA, and audit trail standards.

Do I need a BAA for patient messaging?

Yes, always. Any third-party platform that stores, transmits, or processes PHI requires a signed BAA under the HIPAA Privacy Rule. This applies to solo therapists and hospital systems equally. No exemption based on practice size or patient volume. Before signing up for any messaging tool, confirm that the vendor provides a BAA activating upon account creation, not at a paid tier.

How much does HIPAA-compliant chat cost?

Pricing ranges from $0 to custom enterprise rates. Mahla's base platform is free with no per-user fees (BAA, encryption, and audit trails included), and AI features cost about $1 per task. Spruce starts at approximately $24/user/month. OhMD's plans start at $300/month. Enterprise platforms like TigerConnect use custom pricing (contact vendor for quotes). For solo providers and small practices, free and low-cost options provide all essential compliance features.

Can I text patients from my personal phone?

You can use your personal phone as a device, but not your personal phone number or standard SMS/iMessage app. Install a HIPAA-compliant chat application and all patient communication stays encrypted and auditable within that app, separate from your personal messages. The compliant app creates its own secure channel. Your phone is the hardware running it. Enable a passcode, automatic lock, and remote wipe as additional safeguards.

What happens if I use non-compliant messaging with patients?

HIPAA violations carry civil penalties ranging from $145 to $73,011 per violation, with annual maximums up to $2,190,294 per violation category (HIPAA Journal, "HIPAA Violation Fines — Updated for 2026"). Beyond fines, violations trigger corrective action plans, damage patient trust, and create professional liability exposure malpractice insurance may not cover. A single patient complaint to HHS can trigger an Office for Civil Rights investigation, and the investigation itself is disruptive even if no fine is imposed. Prevention through compliant tools costs far less than remediation.

---

Your Next Step: Get Free HIPAA-Compliant Chat Today

HIPAA-compliant chat isn't a luxury reserved for hospital systems with six-figure IT budgets. The standards are clear, free tools that meet every requirement exist today, and setup takes less time than most intake appointments. You now have the framework to evaluate any platform, the comparison data to choose, and a step-by-step path to your first compliant patient message.

Free HIPAA-compliant chat puts secure, auditable patient messaging within reach of every provider, whether you're a solo therapist in private practice or a growing group clinic.

The only thing left is to start.

Sign up for Mahla: free, HIPAA-compliant messaging with AI built for your practice. No credit card required.

---

Editorial Process: This guide was written by a health technology professional with direct experience building HIPAA-compliant communication platforms and clinically reviewed by a licensed professional counselor associate. All regulatory claims are verified against current HHS guidance and federal regulations. Platform pricing and features are verified directly with each vendor.

About the Author

Jonathan Read is a two-time health tech founder and Head of Product at Mahla, where he leads development of a free HIPAA-compliant platform with built-in AI for behavioral health providers. He previously co-founded a multi-state virtual practice for substance use and mental health treatment, and Keet Health, a patient engagement platform acquired by Clinicient. Jonathan has spent over a decade building HIPAA-compliant communication infrastructure for healthcare.

Clinically reviewed by Alex Cohan, MS, LPC-Associate, NCC, is a clinical therapist trained in EMDR who works with adults, adolescents, and families. He reviewed this guide for clinical accuracy.

---

Sources & References

1. U.S. Department of Health & Human Services. "Business Associates." HHS.gov, 2024. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

2. 45 CFR § 164.502(e) and § 164.504(e). "Business Associate Contracts." Code of Federal Regulations. https://www.law.cornell.edu/cfr/text/45/164.504

3. 45 CFR § 160.103. "Definitions — Protected Health Information." Code of Federal Regulations. https://www.law.cornell.edu/cfr/text/45/160.103

4. Google. "HIPAA Compliance with Google Workspace." Google Support, 2025. https://support.google.com/a/answer/3407054

5. HIPAA Journal. "Is Google Workspace HIPAA Compliant? Updated for 2026." 2026. https://www.hipaajournal.com/is-google-workspace-hipaa-compliant/

6. Spruce Health. "Plans & Pricing." SpruceHealth.com, 2025. https://sprucehealth.com/plans

7. OhMD. "HIPAA Compliant Texting." OhMD.com, 2025. https://www.ohmd.com/

8. U.S. Department of Health & Human Services. "42 CFR Part 2 Final Rule Fact Sheet." HHS.gov, 2024. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html

9. OpenAI. "How Can I Get a BAA with OpenAI?" OpenAI Help Center, 2025. https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai

10. OpenAI. "OpenAI for Healthcare." OpenAI.com, 2026. https://openai.com/index/openai-for-healthcare/

11. HIPAA Journal. "HIPAA Violation Fines — Updated for 2026." 2026. https://www.hipaajournal.com/hipaa-violation-fines/

12. HIPAA Journal. "Is ChatGPT HIPAA Compliant? Updated for 2026." 2026. https://www.hipaajournal.com/is-chatgpt-hipaa-compliant/

13. HIPAA Journal. "Is WhatsApp HIPAA Compliant?" 2025. https://www.hipaajournal.com/whatsapp-hipaa-compliant/

14. HIPAA Journal. "Is Signal HIPAA Compliant?" 2025. https://www.hipaajournal.com/is-signal-hipaa-compliant/

15. Anthropic. "Business Associate Agreements (BAA) for Commercial Customers." 2025. https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers

16. OpenAI. "Enterprise Privacy at OpenAI." OpenAI.com, 2025. https://openai.com/enterprise-privacy/

17. American Medical Association. "HIPAA Violations & Enforcement." AMA, 2024. https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement

18. Telegram. "Telegram FAQ." 2025. https://telegram.org/faq

19. Google for Developers. "Data Security for RCS for Business." 2025. https://developers.google.com/business-communications/rcs-business-messaging/terms-and-policies/data-security

20. Compliancy Group. "Is iMessage HIPAA Compliant?" 2025. https://compliancy-group.com/is-imessage-hipaa-compliant/

21. Paubox. "Is WhatsApp HIPAA Compliant?" 2025. https://www.paubox.com/blog/whatsapp-hipaa-compliant

22. Text-Em-All. "HIPAA-Compliant Texting: Everything You Need to Know." 2025. https://www.text-em-all.com/hipaa-compliant-texting